stealth

README

🥷 playwright-go-stealth

This is a simple shim to inject the puppeteer-extra-plugin-stealth evasions using berstend's extraction for playwright-go.

Example Comparison
🚨 Without the stealth script injected
✅ With stealth script injected

Usage

import stealth "github.com/jonfriesen/playwright-go-stealth"

// pass a playwright.Page and the script will be injected
err = stealth.Inject(playwrightPage)
if err != nil {
    log.Fatalf("could not inject stealth script: %v", err)
}

Example

The example/main.go will generate two, full page screenshots showing the bot detection results. This can be run with go run example/main.go and the screenshots will be saved in the location you run the command from.

Updates

The stealth.min.js file will be periodically updated in this repo. Further updates or specific versions are not supported or tracked at this time. However, I would accept contributions to include this functionality.

Running make update-stealth-js will pull the latest evasions script.

Note: This requires npx.

Additional Stealth Tips

Disable blink automation control

browser, err = m.PW.Chromium.Launch(playwright.BrowserTypeLaunchOptions{
    Args: []string{"--disable-blink-features=AutomationControlled"},
})

Set a custom UserAgent

🔗 UserAgent Repositry

const userAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9"
page, err := browser.NewPage(playwright.BrowserNewPageOptions{
    UserAgent: playwright.String(userAgent),
})

Experiment with less common headers

page, err := browser.NewPage(playwright.BrowserNewPageOptions{
    ExtraHttpHeaders: map[string]string{
        "Cache-Control":      "no-cache",
        "Sec-Ch-Ua":          `"Google Chrome";v="125", "Chromium";v="125", "Not.A/Brand";v="24"`,
        "Sec-Ch-Ua-Platform": "macOS",
    },
})

Documentation

Index

• Variables
• func Inject(page playwright.Page) error
• func InjectWithOptions(page playwright.Page, opts Options) error
• type Options
  • func DefaultOptions() Options

Variables

var ChromeStealthJS string

var StealthJS string

Functions

func Inject

func Inject(page playwright.Page) error

Inject adds a stealth JavaScript script to the given Playwright page to make it less detectable by automated detection mechanisms.

The stealth script modifies various browser characteristics to evade detection by websites that block or track bots. The script is embedded in the Go binary using the //go:embed directive, which includes the contents of the "stealth.min.js" file as the StealthJS variable. Get the latest version of playwright-go-stealth for more up to version os the evasions.

Usage example:

page, err := browser.NewPage()
if err != nil {
    log.Fatal(err)
}
err = stealth.Inject(page)
if err != nil {
    log.Fatal(err)
}

The Inject function uses the AddInitScript method to ensure the stealth script is executed before any other scripts on the page. This method is effective in bypassing many bot detection systems that run their detection logic early in the page lifecycle.

func InjectWithOptions

func InjectWithOptions(page playwright.Page, opts Options) error

InjectWithOptions adds stealth JavaScript scripts to the given Playwright page with configurable options for additional evasion techniques.

The base stealth script (stealth.min.js) is always injected. Additional scripts can be enabled via the Options struct.

Usage example:

page, err := browser.NewPage()
if err != nil {
    log.Fatal(err)
}
opts := stealth.Options{
    ChromeStealth: true, // Enable additional Chrome evasions
}
err = stealth.InjectWithOptions(page, opts)
if err != nil {
    log.Fatal(err)
}

The scripts are injected using AddInitScript to ensure they execute before any other scripts on the page.

Types

type Options

type Options struct {
	// ChromeStealth enables additional Chrome-specific evasions including:
	// - Chrome app/runtime object patching
	// - Console method silencing
	// - Permissions query modification (changes "prompt" to "denied")
	// - Event listener isTrusted spoofing
	// - Automatic Cloudflare challenge checkbox clicking
	//
	// This is useful for bypassing additional bot detection mechanisms
	// that the base stealth script doesn't cover.
	// See: https://github.com/jonfriesen/playwright-go-stealth/issues/2
	ChromeStealth bool
}

Options configures which stealth scripts to inject.

func DefaultOptions

func DefaultOptions() Options

DefaultOptions returns the default stealth options with all features disabled. The base stealth script is always injected by InjectWithOptions.