signup.automation_user_agent
The end user's User-Agent names a scripted HTTP client or a headless browser.
What it looks at#
Send the end user’s User-Agent header (the one your backend received from their browser,
not your own server’s) as user_agent. The check matches it, case-insensitively, against a
list of tokens: HeadlessChrome, PhantomJS, python-requests, curl/, Go-http-client,
axios/, node-fetch, Scrapy, Java/, Wget, Playwright, Puppeteer, Selenium and
similar.
Not matched on purpose: native mobile HTTP stacks (okhttp, CFNetwork, Dalvik), because
real app signups use them, and an empty User-Agent, which is a separate and weaker signal.
Why it matters#
Most scripted signups never bother to change the default User-Agent of the library they use. A match is the client announcing itself.
What to do#
Medium severity. The header is client-controlled, so a clean User-Agent proves nothing; only a match is informative. If you accept signups from your own scripts or a partner’s integration, expect matches from them.