Does anyone here use this? Does it accurately detect hits from residential VPN's?
2013: The original Client Hints proposal was developed by Google engineers.
2015: The proposal became an IETF Internet-Draft, and early Chromium versions began supporting hints such as DPR, Width, Viewport-Width, and Save-Data. Thus, these hints could start appearing in real HTTP traffic in the mid-2010s.
2020: Chromium introduced the newer User-Agent Client Hints including headers such as Sec-CH-UA, Sec-CH-UA-Platform, and Sec-CH-UA-Mobile.
2021: The general HTTP Client Hints mechanism was documented in RFC 8942, which defines the Accept-CH response header and the opt-in process.
Google's Intended Solution: User-Agent Client Hints (UA-CH)
Google did not remove this data entirely; they moved it behind User-Agent Client Hints. If a website operator needs the exact browser minor version or underlying OS build to catch bots, the server must actively request it:
Your server receives the initial request with the reduced Chrome/151.0.0.0 header (Chrome has been at version 152 for about 12 days now, but I'm still seeing 151). If your server suspects something or requires full validation, it issues an HTTP response header: Accept-CH: sec-ch-ua-full-version-list, sec-ch-ua-platform-version. Legitimate Chrome browsers will comply on subsequent requests and send back the exact, high-entropy details. Basic automated scripts or poorly written proxies often fail to handle this renegotiation loop, immediately exposing them as bots.
Firefox and Safari appear to not be using this, while Chrome, Edge and Opera do.
A video explainer (from a wider bot-detection perspective):
[
youtube.com...]
