University of Bamberg

Before JS even runs, a stock Go client's TLS handshake is one of several layers that can flag it as a bot

A practitioner who builds an automation browser argues bot detection fires in a fixed order, starting at the TLS handshake. The Bamberg crawl he cites found 75% of blocks on headless Chromium needed only HTTP headers.