What Competitor Articles Cover (and What They Miss)

Search "puppeteer stealth" today and you get three content shapes:

1. Tutorial posts — "How to use puppeteer-extra-plugin-stealth", often 3–4 years old, recycling the same puppeteer.use(stealth()) example.
2. Advertorial comparisons from paid scraping services (ScrapingBee, Bright Data, Apify) each concluding that their own product wins. The benchmarks are almost always on sites they themselves test against, not the hardest real-world bot walls.
3. Stack Overflow threads with partial answers: one user reports the plugin works, another says it was blocked yesterday, nobody runs the same test against the same surfaces.

Nobody runs a neutral benchmark where the three most common setups are measured on the six detection surfaces that actually break pipelines. That's the hole this article fills.

The Six Bot-Detection Surfaces We Tested Against

Each surface represents a distinct category of signal that production bot walls use. Passing one doesn't mean passing them all — they're layered.

Surfaces 1–4 are client-side signals — any serious stealth tooling has to deal with them. Surface 5 is a network-level fingerprint that most Node.js-based scrapers can't rewrite at all without patching Node's TLS stack. Surface 6 is harder: you need real mouse movement, real timing jitter, and often real scroll and focus events.

Contender 1 — Vanilla Puppeteer (5/6 blocked)

Vanilla Puppeteer, no plugins:

``js
import puppeteer from 'puppeteer';

const browser = await puppeteer.launch({ headless: 'new' });
const page = await browser.newPage();
await page.goto('https://example-target.com', { waitUntil: 'networkidle2' });
const html = await page.content();
await browser.close();
`

`js
import puppeteer from 'puppeteer-extra';
import StealthPlugin from 'puppeteer-extra-plugin-stealth';

const browser = await puppeteer.launch({ headless: 'new' });
const page = await browser.newPage();
await page.goto('https://example-target.com', { waitUntil: 'networkidle2' });
const html = await page.content();
await browser.close();
`

`bash
browser-act stealth-extract https://example-target.com \
--content-type html \
--proxy http://user:pass@residential.example.com:8080 \
--output result.html
`

Outcome: reaches the page content against the same targets that block vanilla Puppeteer and puppeteer-extra-plugin-stealth. Residential proxy is optional but recommended for targets that check IP reputation in addition to fingerprint.

`
Detection layer Where it lives Plugin can patch?
─────────────────────────────────────────────────────────────────────────────
Behavioral heuristics (mouse, scroll) Server (scoring) ❌ No
TLS / JA3 fingerprint Network (pre-page) ❌ No
Canvas / WebGL / Audio entropy JS (in-page) ⚠️ Partial (adds noise)
WebRTC local IP JS (in-page) ✅ Yes
User-Agent header JS (pre-navigation) ✅ Yes
navigator.webdriver flag JS (window object) ✅ Yes
`

A JavaScript plugin (what puppeteer-extra-plugin-stealth is) can only patch the bottom half of the stack. The top half — TLS fingerprint, behavioral scoring — lives outside the browser's JavaScript scope. No amount of in-browser monkey-patching can change the JA3 hash your TLS handshake already emitted.

A runner-level tool like stealth-extract can reach all six layers because it controls the network stack, the browser launch, and the interaction layer together. That's structural, not marketing.

The wise pattern in production: keep Puppeteer for what already works, pipe the specific URLs that currently 403 through stealth-extract as a drop-in replacement for the fetch step. Most pipelines end up 70% Puppeteer, 30% stealth-extract, with the split drawn along "does the site have real bot protection."

Swap step: wherever you currently call page.goto(url) and then parse the result, replace the fetch with browser-act stealth-extract --output tmp.html, then hand tmp.html to your existing Cheerio / JSDOM / parser. The DOM shape is identical — only the acquisition layer changed.

• Install: npm install -g browser-act (or brew install browser-act)
• The one command: browser-act stealth-extract ` — run it against any URL that currently 403s in your Puppeteer pipeline. If it returns the page, you have your first migration candidate.
• Docs for v1.1.0: browser-act/skills/browser-act

The 403 you've been working around for six months is the one this benchmark was built for.