A User-Agent is a text string sent with every web request that identifies the browser, operating system, and device making the request. Websites and anti-bot systems inspect the User-Agent to distinguish real browser traffic from automated scripts, though it's one of the easiest signals for scrapers to spoof.

A typical User-Agent string looks like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36..., identifying a specific browser version and platform. Because the User-Agent alone is trivial to fake, sophisticated anti-bot systems cross-check it against harder-to-spoof signals, like TLS fingerprint or browser behavior, and flag requests where the claimed User-Agent doesn't match those other signals.

Because User-Agent strings are just plain text sent by the client, they're trivial to spoof, which is why anti-bot systems treat them as only one signal among many rather than a reliable identifier on their own.

A convincing User-Agent string still has to match the rest of the connection's behavior, which is why it's typically paired with browser fingerprinting checks rather than trusted on its own.