OpenWAF Browsers is built for agents that are allowed to be where they are: your own sites, sites that welcome automation, and tasks a person would do in a browser for themselves. It is not a tool to get past sites that do not want bots. If that is what you need, this is the wrong product.
What we do not offer
| Not offered | What you get instead |
|---|---|
| Stealth mode or anti-detection patches | Google Chrome as shipped. Automation over CDP is visible to sites that look for it. |
| Fingerprint spoofing (fake User-Agent, canvas, WebGL, fonts, time zone) | Chrome's real fingerprint and User-Agent. You can choose viewport and lang, nothing more. |
| Residential, mobile or per-country proxies | Traffic leaves from OpenWAF's own addresses in Germany. |
| CAPTCHA solving | A person can solve a CAPTCHA in the live view, if the site allows it. |
| Bypassing logins, paywalls, rate limits or blocks | Profiles keep your own logins. A site that refuses the agent stays refused. |
| Hidden identity | Requests are signed with Web Bot Auth by default, so sites can tell an agent is visiting. |
Why
Sites decide who may use them. An agent that announces itself lets the site make that choice; an agent that hides takes the choice away. OpenWAF also runs a WAF and AI Crawl Control that help site owners spot disguised bots, so we will not sell the disguise.
There is also a practical reason. Declared, signed agents are easy to allow on purpose. Disguised agents end up in an arms race with every bot defence on the web.
Acceptable use
Use of OpenWAF Browsers is covered by the Acceptable Use Policy (external link) and its addendum for OpenWAF Browsers (external link). The addendum is binding; in short, it does not allow:
- credential stuffing, account takeover, or logging in to accounts you are not authorised to use;
- getting around access controls, logins, paywalls, rate limits or CAPTCHAs;
- mass account creation, fake reviews, votes, clicks or other fake engagement;
- scraping against a site's terms or a robots.txt that forbids automated access, or collecting personal data without a legal basis;
- spam, fraud, phishing, malware, illegal content, or attacks on or scans of third parties;
- passing the agent off as a person, with or without Web Bot Auth, or getting around the egress proxy rules.
The egress log keeps request metadata (host, port, decision, bytes, time), not page content, and is used to handle abuse. Keys or organizations that break these rules can be suspended without notice. Report abuse to abuse@openwaf.dev.