HeadlessChrome is a bot in the headless browsers category, operated by Google.
HeadlessChrome is the user agent Chrome sends when it runs in headless mode, without a visible window. Testing tools, page renderers and scrapers use it to load pages that need JavaScript.
Headless browsers run a full browser engine without a screen. They are used for testing, rendering and scraping sites that need JavaScript. Most scrapers that evade simple checks run in a headless browser, so client side detection matters more than the user agent here.
Sample user agent strings sent by HeadlessChrome:
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.7922.34 Safari/537.36Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/112.0.5615.49 Safari/537.36Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.0.0 Safari/537.36Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/155.0.0.0 Safari/537.36Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36Anyone can copy a user agent string. Transfon Security also checks where each request comes from, so a request that claims to be a known crawler but comes from the wrong network is treated as a fake, not as the real crawler.
Share of HeadlessChrome requests to sites protected by Transfon Security in the 7 days to 27 October 2026.
| United States | 87% |
| Turkey | 7% |
| China | 1% |
| Amazon.com, Inc. AS14618 | 58% |
| Amazon.com, Inc. AS16509 | 26% |
| Equinix (EMEA) Acquisition Enterprises B.V. AS15830 | 7% |
| Google LLC AS396982 | 1% |
HeadlessChrome does not read robots.txt. The rules below record your policy, but they will not stop it. To actually block HeadlessChrome, use a WAF rule as shown in the next section.
User-agent: HeadlessChrome Disallow: /
User-agent: HeadlessChrome Disallow: /private/ Disallow: /search
User-agent: HeadlessChrome Allow: /blog/ Disallow: /
User-agent: HeadlessChrome Allow: / User-agent: * Disallow: /
User-agent: HeadlessChrome group, HeadlessChrome ignores your User-agent: * rules, so repeat any that should still apply.HeadlessChrome from HeadlessChrome's user agent; check Google's own documentation if it publishes a different robots.txt name.Treat robots.txt as a statement of your policy, and enforce it where requests arrive.
HeadlessChrome is a common tool for scrapers. Real readers never use it, so block it on article pages and keep it out of ad requests.
Transfon Security for publishersTraffic from HeadlessChrome on landing pages is automated. It inflates clicks and visits, so filter it from campaign data and raise it with the ad network.
Transfon Security for advertisersPrice scrapers, stock checkers and card testing scripts often run on HeadlessChrome. Block it on product, cart and checkout pages.
Transfon Security for e-commerceHeadlessChrome is normal for API clients but not for your web app. Allow it only on API routes that need a key, and rate limit it there.
Transfon Security for SaaS and APIsHeadlessChrome ignores robots.txt, so it has to be stopped when the request arrives. Transfon Security shows HeadlessChrome by name in the Top Bots report, so you can see how often it visits and which pages it reads. Block or allow it with a User Agent rule, or slow it down with a rate limit decision rule.
Transfon Security
HeadlessChrome is a bot in the headless browsers category, operated by Google. HeadlessChrome is the user agent Chrome sends when it runs in headless mode, without a visible window. Testing tools, page renderers and scrapers use it to load pages that need JavaScript.
No. HeadlessChrome does not follow robots.txt, so a Disallow rule will not stop it. Block it by user agent at your server, CDN or WAF instead.
Block requests whose user agent contains "HeadlessChrome" at your server, CDN or WAF, because HeadlessChrome does not read robots.txt. In Transfon Security that is one User Agent block rule.
No. robots.txt is voluntary, so HeadlessChrome may not follow it, and anyone can send HeadlessChrome's user agent, so a fake HeadlessChrome ignores your rule. Enforce the rule where requests arrive, at your WAF, and check the source network.
Headless browsers run a full browser engine without a screen. They are used for testing, rendering and scraping sites that need JavaScript. Most scrapers that evade simple checks run in a headless browser, so client side detection matters more than the user agent here.
Transfon Security identifies every bot in this directory in your traffic reports, flags fake search crawlers, and lets you allow, block or rate limit each bot.
Privacy, security, monetization, and performance insights. A few emails a month, no spam.