A headless browser is a web browser without a visible interface.
It loads pages, runs JavaScript and fills in forms, but is controlled by a program instead of a mouse.
Functionality of a Headless Browser
A headless browser uses the same engine as a normal browser but does not display the result.
Commands come from scripts through interfaces such as the Chrome DevTools Protocol or WebDriver.
Automated Testing
Developers use it to test websites automatically: open pages, click, enter data and check that everything works.
This is fast and can be repeated with every change.
Web Scraping
Headless browsers are also used for web scraping, the automatic extraction of content, prices and data.
Because they run JavaScript, they also reach dynamically loaded content.
Security Implications of Headless Browsers
What is practical for testing is also used by attackers: headless browsers behave almost like real visitors and are ideal for bots, for example for account takeover, spam and card testing.
Defending Against Headless Browser Attacks
Detection through browser traits is getting harder because tools hide them.
It is more effective to make every request cost something: CDPCaptcha asks the browser for computational work that becomes expensive across many automated requests, combined with rate limiting.
Security Testing with Headless Browsers
Security teams use headless browsers themselves to test applications for weaknesses such as cross-site scripting.
Penetration tests are automated with them too.
Popular Headless Browsers
Chrome and Firefox can be started in headless mode.
Common control tools are Puppeteer, Playwright and Selenium;
older projects such as PhantomJS are no longer maintained.
Choosing a Headless Browser
Important factors are the supported browsers, the programming language, stability and how actively a project is maintained.
For testing, the browser should match the users’ browser as closely as possible.
Using a Headless Browser
A script starts the browser, opens an address, performs actions and reads results or screenshots.
When scraping, the website’s rules and the law should be respected.
Conclusion
Headless browsers are valuable tools for development and testing, but also the basis of many bots.
Websites protect their forms best with methods that rely on real costs for bots rather than browser traits.