Identification
Its full user-agent string, exactly as it arrives at the gate:
There is no operator to verify against. This name is what software calls itself when nobody gave it one.
How to block HeadlessChrome
HeadlessChrome does not read robots.txt, so a polite sign is wasted on it. Refuse it at your web server or firewall instead. User agents are easy to fake, so pair this with rate limiting.
# robots.txt will not stop HeadlessChrome. Block it at the server.
# nginx
if ($http_user_agent ~* "HeadlessChrome") {
return 403;
}The same thing on Apache:
# Apache (.htaccess)
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} HeadlessChrome [NC]
RewriteRule .* - [F,L]Observed behaviour
Most active around 12:00. Office hours, like a professional.
Requested 0 disallowed pages out of 1 requests. Never read robots.txt.
Has never followed the hidden link to /trap/. Either well trained or very lucky.
Where it comes from
Scripts and scanners run from wherever their owners rent a server. These are the networks behind the visits on file:
Networks and countries come from the visitor's IP address, looked up in a local copy of the DB-IP database. The addresses themselves are never stored.
Keeper's field notes
Questions site owners ask
Does HeadlessChrome respect robots.txt?
We can't say yet. It has not fetched robots.txt here, and it has not touched a disallowed page either.
Will blocking HeadlessChrome hurt my search rankings?
No. Nothing respectable will miss it.
How often does HeadlessChrome visit?
Here, about 0 requests a day over the last week. Visits to your site depend on its size, how often it changes, and how many links point to it.