Headless Chrome is the Chrome browser running without a visible window, which lets scripts load pages and click through flows.
Teams use it for legitimate testing, and other operators use the same windowless browser to imitate a person at high speed.
How it works
Because there is no screen, a script can open pages, fill forms, and follow links on a server that nobody is watching.
The browser engine is still Chrome, so the traffic can look much closer to a normal visit than a crude download of raw page text.
Absence of a window is not proof of abuse, since test labs and accessibility checks use the same mode every day.
Abuse shows up when many windowless sessions hammer checkouts, signups, or searches that were meant for people sitting at a screen.
Concrete examples
- A release engineer runs the storefront tests in windowless Chrome on a build server before a Friday deploy.
- A reseller script drives windowless Chrome through a limited drop and completes purchase forms faster than shoppers on laptops.
- A monitoring job uses windowless Chrome to confirm that a public status page still renders after a template change.
Protective measures
- Do not treat the mere presence or absence of a visible window as proof that a visitor is human.
- Pair browser automation signals with limits on expensive actions such as checkout, signup, and password reset.
- Give your own test systems a documented path so security controls do not break legitimate windowless tests.
- Review spikes of identical browsing flows that never pause the way a person reading a page would pause.
How CDPCaptcha helps
Proof of work on the page raises the cost of windowless browser automation because every scripted visit must complete computation before the site accepts it.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.
Related articles
Holiday scripts that buy scarce stock ahead of shoppers are described in What are grinch bots during limited holiday sales?.
A hidden form field that automated clients often fill is explained in What is a honeypot field hidden on a web form?.
A tool abused for repeated automated login checks is covered in What is OpenBullet in large scale automated login checking?.