Puppeteer Stealth + Mobile Proxies: Undetectable Browser Automation

The stealth plugin is a collection of small evasion modules, each targeting one specific headless Chromium tell. They're injected via page.evaluateOnNewDocument before any site JavaScript runs. These are the modules that ship with the default StealthPlugin():

Source: berstend/puppeteer-extra — evasions/. You can toggle individual modules with stealth.enabledEvasions.delete('name').

npm install puppeteer puppeteer-extra puppeteer-extra-plugin-stealth

If you prefer the smaller runtime, swap puppeteer for puppeteer-core and point it at a local Chrome binary with executablePath. The stealth plugin works identically with either.

Chromium can't read the user:pass inline in the --proxy-server flag — you authenticate through page.authenticate(), which responds to the HTTP 407 challenge transparently.

const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');

puppeteer.use(StealthPlugin());

(async () => {
  const browser = await puppeteer.launch({
    headless: 'new',
    args: [
      '--proxy-server=http://hostname:http_port',
      '--no-sandbox',
    ],
  });

  const page = await browser.newPage();
  await page.authenticate({
    username: 'USER',
    password: 'PASS',
  });

  await page.goto('https://bot.sannysoft.com/', {
    waitUntil: 'networkidle2',
  });
  await page.screenshot({ path: 'stealth-test.png', fullPage: true });

  await browser.close();
})();

That's the whole integration — puppeteer.use(StealthPlugin()) before launch, --proxy-server in args, and page.authenticate for credentials.

Point your stealthy browser at these public fingerprint test pages and inspect the screenshot or the network tab:

• →bot.sannysoft.com — the canonical stealth test. Every row should be green.
• →abrahamjuliot.github.io/creepjs — CreepJS, the most invasive browser fingerprint audit you can run. Aim for a trust score above 60%.
• →browserleaks.com — WebRTC, canvas, WebGL, and DNS leak probes.
• →pixelscan.net — cross-checks fingerprint consistency (UA vs. timezone vs. geo of the exit IP).

Run the same tests without the proxy to see the difference the carrier IP makes on the network-level checks (ASN, geo, reputation).

Rotate between independent sessions, not mid-page. Tear the browser down, hit the rotate endpoint, wait for the modem to reconnect, relaunch:

const API_BASE = 'https://buy.mobileproxies.org';

async function rotateIP(slotId, apiKey) {
  const res = await fetch(
    `${API_BASE}/api/v1/proxies/${slotId}/switch`,
    {
      method: 'POST',
      headers: { 'Authorization': `Bearer ${apiKey}` },
    }
  );
  if (!res.ok) {
    throw new Error(`rotate failed: ${res.status}`);
  }
  // Modem takes ~10s to reconnect and pick up a new carrier IP
  await new Promise(r => setTimeout(r, 10000));
}

async function listProxies(apiKey) {
  const res = await fetch(
    `${API_BASE}/api/v1/proxies`,
    { headers: { 'Authorization': `Bearer ${apiKey}` } }
  );
  if (!res.ok) throw new Error(`list failed: ${res.status}`);
  return res.json();
}

The endpoints use Bearer authentication and match the Swagger at buy.mobileproxies.org/api/docs. Rotate per account, per campaign, or per scrape target — whatever your isolation unit is.