Skip to content
bytetouristbytetourist

Anti-bot & TLS fingerprints

Getting a 200 is not the same as getting the page. Many sites inspect the shape of a connection — not just its contents — and misclassify ordinary automated clients as bots. bytetourist makes your requests look like the real browser traffic they stand in for, so legitimate collection isn’t blocked by accident.

What sites inspect

Section titled “What sites inspect”
  1. TLS fingerprinting (JA3/JA4) — servers fingerprint your TLS ClientHello. A default Go or Python client looks nothing like Chrome, which is enough to get flagged on its own.
  2. HTTP header analysis — header ordering and consistency with the User-Agent are checked.
  3. JavaScript-rendered content — some pages only assemble their content after running JavaScript, so a plain fetch returns an empty shell.

What bytetourist does

Section titled “What bytetourist does”
  • Browser-grade TLS fingerprints. The node originates TLS with a real browser JA3/JA4 profile rather than the default client stack, so the connection presents as a mainstream browser instead of a generic library.
  • Consistent headers. Requests are shaped so header order and defaults match the browser profile being presented.
  • Headless-browser fallback. For JavaScript-heavy pages, the node can run a real headless browser to execute the page and return the rendered result.

You can also rely on bytetourist’s circuit breaker to route around individual nodes a target is actively rate-limiting, and on routing strategies like freshest_ip to spread traffic across your own IPs.

On the roadmap

Section titled “On the roadmap”

Header-order normalisation and a managed “auto” mode — which detects a challenge and automatically escalates the rendering path, then retries — are planned. See the Scrape API preview.