The beacon checks whether the browser engine really is the version the User-Agent claims, by probing features that shipped in known versions. A spoofed User-Agent string cannot change what the engine can do.
| Code | Weight | What it means |
|---|---|---|
ua_older_engine | 85 | The User-Agent claims a version whose features the engine does not have |
ua_newer_engine | 85 | The engine has features that shipped after the claimed version |
ua_probe_<major> | 0 | Which probe caught it — diagnostic only |
A scraper can set any User-Agent string it likes, but it cannot retrofit a JavaScript engine. The probe table pairs a browser major version with a function that first shipped natively in it:
var UA_PROBES = [
63, 'Promise.prototype.finally',
69, 'Array.prototype.flat',
73, 'Object.fromEntries',
85, 'String.prototype.replaceAll',
93, 'Object.hasOwn',
98, 'structuredClone',
110, 'Array.prototype.toSorted',
122, 'Set.prototype.union'
];Given a User-Agent claiming version N: every entry at or below N minus two must be present, or the engine is older than claimed; every entry at or above N plus two must be absent, or the engine is newer than claimed. The grace of two majors means a browser mid-upgrade, an enterprise pin, or one of the browser’s own User-Agent reduction quirks is never flagged.
Adding a row as the browser advances
Roughly every ten releases, pick a feature that is shipped in a known version — look it up rather than guessing, because a wrong version number here manufactures false accusations against real people — that is reachable as a function by a dotted path, and that is not commonly polyfilled. Never remove old rows; they are what catches ancient engines.
The polyfill guard: the probe requires the function to report as native code, or a site loading a compatibility library would make an old engine look new and get its own visitors flagged. The iOS exclusion: every browser on iOS is one engine wearing another’s User-Agent, so their feature set has nothing to do with the version in the string and they are skipped outright. Flagging them would be a pure false positive on millions of real phones.
Detection
- The fingerprint cluster
- Automation & headless signals
- Browser claim probes
- Consistency & human evidence