BotBlocker identifies the visitor’s IP and basic headers, and also the browser version, operating system, and device type. This deep analysis is a key part of accurate bot detection and security filtering.
Why Detect Browser Version, OS, and Device Type?
- Helps distinguish real users from bots and automation tools
- Allows custom security rules for different devices (e.g., stricter checks for mobile)
- Detects suspicious or impossible combinations (e.g., outdated browsers, Windows OS with iPhone user-agent)
How Detection Works
1. Browser Version Detection
BotBlocker analyzes the User-Agent string and related browser properties to determine the exact browser and its version.
Key signals:
- Chrome, Firefox, Edge, Safari, Opera, and many others
- Version numbers (e.g., Chrome 124, Firefox 115, Safari 17)
- Detection of outdated, rare, or unusual browser versions (risk factors for automation or exploits)
2. Operating System Detection
The User-Agent, along with additional properties, reveals the visitor’s OS:
- Windows, macOS, Linux, Android, iOS, ChromeOS, and others
- Specific versions (e.g., Windows 10, Android 13)
- Matching browser/OS pairs (e.g., Safari only on Apple devices, IE only on Windows)
Anomalies, such as a Windows-only API present on an iOS device, raise suspicion.
3. Device Type Identification
By analyzing screen size, touch support, hardware features, and User-Agent:
- PC/Desktop: Large screen, keyboard/mouse input, desktop OS, typical browsers
- Mobile Phone: Touch screen, mobile OS, compact display, mobile-specific user-agent
- Tablet: Medium-sized screen, touch input, tablet-optimized browsers (often detected as iPad, Android Tablet)
The combination of these factors allows BotBlocker to classify the device accurately.
Why Is This Important for Security?
- Bot Detection: Bots and automation tools often fail to mimic real devices accurately, especially in fine details of browser and OS versions.
- Suspicious Combos: Unusual or impossible combinations (e.g., Chrome 90 on iOS, or Windows 11 with a 7-inch display) are a clear sign of automation or spoofing.
- Targeted Filtering: You can apply specific rules, require extra verification, or block outdated software known for vulnerabilities.
Real-World Examples
- A visitor claims to use Safari on Windows (impossible: Safari is not released for Windows in modern versions), flagged as suspicious.
- Device reports Android 8, but browser version is Chrome 124 (inconsistent: Chrome 124 requires newer Android), flagged for review.
- User-Agent claims \”iPad,\” but screen size is typical for a smartphone, possible spoofing or bot.
How BotBlocker Responds
- Logs and flags inconsistent or impossible combinations for further review
- Offers site owners options: block, challenge with captcha, or allow with monitoring
- Updates detection logic regularly to follow browser and OS developments
Why the Browser Can Lie
Browsers shorten the User-Agent: Chrome froze minor versions and moved some data to Client Hints. Client Hints arrive only when the server asks for them, and not every client answers. A script can copy a real browser string and look correct on paper.
So the version and OS are signals, not proof. The decision is stronger when the string matches the fingerprint, the screen, and the behavior.
Where to See It
The log shows the browser, OS, and device type for each record. That makes it clear why a session was flagged, instead of guessing from one User-Agent string.
FAQ
Can real users be misidentified?
Rarely, but possible with unusual devices or outdated browsers. BotBlocker minimizes false positives by analyzing multiple factors.
How does this help block bots?
Bots often use random or mismatched User-Agents, outdated versions, or fake device types, easy for BotBlocker to spot.
Do I need to configure this feature?
No, detection is automatic and works out of the box. Advanced settings are available for fine-tuning.
Is an IP address personal data?
In the EU, yes. BotBlocker keeps it locally, limits retention, and does not hand it to third parties.
Do I need root access?
No. BotBlocker needs access to the site files and wp-config.php; root is for server setup.