TLS fingerprinting
Identifying a client from the structure of its TLS handshake, before any HTTP request is sent.
TLS fingerprinting derives an identifier from how a client opens an encrypted connection. The Client Hello message exposes the cipher suites offered, their order, supported extensions and their order, and version preferences. Different software produces reliably different combinations.
#Why it defeats naive scraping
A script can send any User-Agent it likes, but the TLS handshake is produced by the underlying library. A Python HTTP client claiming to be Chrome still handshakes like Python — and the mismatch between the two is itself a strong signal, arguably stronger than either alone.
This happens before the HTTP request, so the server can decide to block you without ever seeing the request you intended to make.
#What can be done about it
Use a client that reproduces a real browser’s handshake, or drive a real browser. Header-level disguises alone do not address it. Fingerprint databases such as JA3 and its successors are widely used to catalogue these signatures.
#Related
Browser fingerprinting works at a higher layer, using JavaScript. TLS fingerprinting needs no JavaScript at all.