How to Protect APIs From Unwanted Automation
An API cannot simply block automation. The practical job is to decide which automated use belongs on each route, then control the rest without breaking legitimate clients.
Fingerprints Are Evidence, Not Identity
Browser and network fingerprints are useful security evidence, but they should not be treated as proof of a person's identity.
Account Security Without Tracking People
Safer logins do not require treating people as products. Account defence should use minimised, purpose-bound risk signals and proportionate decisions.
The Invisibility Cloak
Residential proxies change the network path while anti-detect browsers change the client presentation. Detection works by finding inconsistencies across the request, not by treating either signal as identity.
How MTU Fingerprinting Identifies VPNs and Mobile Users
Infer an apparent path MTU from TCP handshake data, compare it with common tunnel overheads and use it as one bounded network-path signal.
Anti-Detect Browsers
Anti-detect browsers represent one of the most sophisticated threats facing modern web applications and APIs. Learn how these tools work, why they pose a significant threat to application security, and how modern security platforms can detect and mitigate their use.
Google Chrome IP Protection vs Apple Private Relay
Apple Private Relay and Chrome IP Protection both reduce IP exposure, but they protect different traffic and should not be treated as residential proxies or automatic fraud signals.
JA4 and JA4+ Network Fingerprinting
How JA4 constructs a TLS client fingerprint, what JA4+ names, and which details sorting and hashing discard.
Google Chrome's IP Protection and Online Privacy
Chrome IP Protection masks a user's address for selected third-party requests in Incognito. That is narrower than a VPN and should be treated as privacy infrastructure, not proof of abuse.
Chrome's TLS Extension Randomisation Experiment
Does TLS extension randomisation assist in hiding Chrome?
TLS Fingerprinting
What is fingerprinting, and in particular TLS fingerprinting?