Your scraper can rotate through ten thousand residential IPs and still get blocked in one request. Why? Because the target is scoring your TLS fingerprint — the cryptographic handshake before HTTP even starts.
What JA3 and JA4 measure
During TLS Client Hello, your client advertises:
- TLS version
- Cipher suites (order matters)
- Extensions (SNI, ALPN, supported groups)
- Elliptic curves
JA3 concatenates these fields into a hash. JA4 (newer) normalizes the same idea for HTTP/2 and QUIC-aware clients. Bot vendors maintain allowlists of browser JA3 hashes and block everything else.
| Client | Typical use | JA3 looks like |
|---|---|---|
| Chrome 120 | Real users | Browser-like hash |
Python requests | Scripts | Distinct library hash |
| curl | CLI tests | Distinct hash |
| Playwright | Automation | Matches bundled Chromium |
[!TIP] Pro Tip: If IP rotation fixes nothing but Playwright works immediately, suspect TLS or HTTP/2 fingerprinting — not bandwidth or geo.
TLS vs IP vs HTTP headers
Think in layers:
- IP reputation — residential vs datacenter (Premium vs Elite)
- TLS (JA3/JA4) — browser vs library
- HTTP headers — User-Agent, Accept-Language, sec-ch-ua
- Behavior — timing, mouse events, scroll depth
SOCKS5 vs HTTP proxy only changes how you reach the target — not what TLS fingerprint you present. See SOCKS5 vs HTTP for scraping.
How to pass TLS checks in production
Option A — Real browser (recommended)
Route Playwright through Aethyn:
- Chromium supplies a mainstream JA3
- JavaScript runs for Cloudflare interstitials
- Cookies persist in a sticky session (1–1440 minutes, default 30) when you set session params in the proxy username
Use Elite residential when the target pairs TLS checks with strict IP reputation (major retail, fintech, social login).
Option B — TLS impersonation libraries
Some HTTP clients mimic Chrome's JA3. They help on moderate sites but lag behind browser updates — maintain them like any other dependency.
Option C — HTTP-only targets
News sites, legacy APIs, and internal tools often skip JA3 scoring. Premium residential at €2.00/GB is sufficient.
JA3 + Cloudflare 1020
Cloudflare Bot Management combines JA3 with IP and behavior. Fixing only one layer fails.
Follow the combined playbook: Fix Cloudflare error 1020.
Glossary cross-reference
- Browser fingerprinting — headers, canvas, WebGL beyond TLS
- Anti-bot system — Cloudflare, Akamai, DataDome overview
Practical checklist
- Reproduce block in Playwright with proxy — if pass, TLS was the issue
- Match geo on proxy username to target market
- Hold sticky session through login and checkout
- Escalate IP tier to Elite if TLS-fixed traffic still 403s
- Log JA3-related failures separately from 429 rate limits
Common questions about this article
What is JA3 fingerprinting?
Does SOCKS5 hide TLS fingerprinting?
Do I need Elite residential for TLS-blocked sites?
Guides, integrations & docs
Continue reading
curl_cffi vs Requests vs Playwright for Web Scraping (2026)
Use the least expensive client that reliably produces the required document. A three-client test — requests, curl_cffi, Playwright — on one residential exit. Record status and body class, not a pass-rate table.
How to Fix Cloudflare Error 1020 When Scraping (2026 Guide)
Cloudflare error 1020 means access denied — usually IP reputation, TLS fingerprint, or behavior scoring. Here is a practical fix order for scrapers in 2026.
How to Avoid IP Bans Using Rotating Residential Proxies
IP bans are the enemy of automation. Learn the science of rotation and how to mimic human behavior to stay invisible on any website.
Premium or Elite residential proxies
Join developers scaling scraping and automation with Aethyn Premium and Elite pools from €2.00/GB.