The TLS/SSL handshake is the process by which a browser or client and a server establish a secure, encrypted connection before any data is exchanged, verifying the server's identity and agreeing on encryption keys. Websites and anti-bot systems can analyze the specific parameters of this handshake to fingerprint and identify automated (non-browser) traffic.

This is the basis of "TLS fingerprinting" as a detection technique: real browsers produce a distinctive, consistent handshake signature (the specific cipher suites, extensions, and order they offer), while many scraping libraries and HTTP clients produce a handshake that looks noticeably different from a genuine browser's, this holds even when other signals, like the User-Agent header, are spoofed correctly.

The handshake also negotiates a shared session key used to encrypt everything that follows, so a proxy sitting between client and server generally can't read the resulting traffic unless it terminates the handshake itself.