Measured 10 September 2026, both runs on the same day from the same server. We rerun this monthly.
Every guide about scraping protected sites ends with the same advice: “use a real browser.” It is repeated so often that nobody checks it. So we did. We took the three residential proxy providers we had already measured with plain HTTP requests that morning, and ran the identical test again in the evening with one change: the requests were made by a real Chromium instead of curl.
The result is not “the browser wins.” The browser opened one site that nothing else could, closed one that plain requests had passed, and cost seven to ten times more traffic for the same nine pages.
Setup
- Targets: the same nine as in every test on this site. Amazon search, Google search, Zillow listings, Walmart search, the Best Buy homepage, a LinkedIn company page, an Indeed job search, a Nike category page, and api.ipify.org as the control that proves the proxy is in the path.
- Providers: Oxylabs, Decodo and SOAX residential, US, rotating. Plus a baseline with no proxy from our Hetzner server in Helsinki.
- Run A, plain requests:
curlwith current Chrome headers, no JavaScript, 30-second timeout. Five requests per target, each from a fresh exit address. - Run B, headless browser: Chromium via Playwright, headless, proxy configured at browser level with authentication. Every request in a fresh browser context, so no cookies carry over and each request gets a new exit address. The browser waits up to 15 seconds after the page loads for the real content to appear or for a challenge to resolve. Images, fonts and media are blocked to save traffic; HTML, CSS, scripts and API calls load normally. No stealth plugins, no CAPTCHA-solving service, no fingerprint patching.
- Success means the real page arrived: a marker that only exists on the genuine result page (Amazon’s
s-search-resultblocks, Zillow’s listing cards, Indeed’s job cards). A status 200 alone does not count.
The browser run is deliberately naive. It is what a developer gets on day one with playwright.chromium.launch({ proxy }). The point is to measure what the browser itself buys, before any anti-detection work.
The numbers
| Provider | Plain requests | Headless Chromium | Browser gained | Browser lost | Traffic, plain | Traffic, browser |
|---|---|---|---|---|---|---|
| No proxy (datacenter) | 15 / 45 | 20 / 45 | Best Buy 5/5 | – | 2 MB | 31 MB |
| Oxylabs | 20 / 45 | 19 / 45 | Indeed 4/5 | Zillow 0/5 | 3 MB | 27 MB |
| Decodo | 19 / 45 | 19 / 45 | Indeed 4/5 | Zillow 0/5 | 3 MB | 21 MB |
| SOAX | 19 / 45 | 20 / 45 | Indeed 5/5 | Zillow 0/5 | 3 MB | 23 MB |
Totals barely move. What moved is which sites passed, and that is the part that matters when you are choosing a setup for one target.
Target by target
| Target | Defence | Plain, datacenter | Plain, residential | Browser, datacenter | Browser, residential |
|---|---|---|---|---|---|
| Amazon search | own | 5/5 | 5/5 | 5/5 | 5/5 |
| Nike category | Akamai | 5/5 | 5/5 | 5/5 | 5/5 |
| Zillow listings | PerimeterX | 0/5 | 4–5/5 | 0/5 | 0/5 |
| Indeed job search | Cloudflare | 0/5 | 0/5 | 0/5 | 4–5/5 |
| Best Buy homepage | Akamai + geo | 0/5 | 0/5 | 5/5 | 0/5 (timeout) |
| Google search | own | 0/5 | 0/5 | 0/5 | 0/5 |
| Walmart search | Akamai + PerimeterX | 0/5 | 0/5 | 0/5 | 0/5 |
| LinkedIn company | own | 0/5 | 0/5 | 0/5 | 0/5 |
Three sites are the whole story.
Indeed: the case for pairing a residential address with a browser
Indeed sits behind Cloudflare. With plain requests it returned 403 to everyone, datacenter and residential alike. With the headless browser from the datacenter address it still returned 403 five times out of five. With the headless browser through a residential proxy, the Cloudflare challenge resolved on its own within a few seconds and the job cards arrived: four of five for Oxylabs and Decodo, five of five for SOAX.
Neither ingredient works alone. The residential address without a JavaScript engine cannot pass the challenge; the browser from a hosting-company address is not trusted enough to be offered one it can pass. Together they get through. This is the one result in the test that justifies the price of both.
Zillow: a plain headless browser is a fingerprint
Zillow is protected by PerimeterX (now HUMAN). In the morning run, plain curl requests with Chrome headers passed from every residential provider: five of five for Oxylabs and SOAX, four of five for Decodo. In the evening run, the headless Chromium from the same three networks got 403 on every single request, fifteen out of fifteen.
The address did not change in kind; the exits were Charter, Comcast, Cablevision and T-Mobile customers in both runs. What changed is that PerimeterX runs JavaScript in the page, and that JavaScript can see that it is inside a headless browser: the navigator.webdriver flag, the missing plugins, the rendering quirks. A curl request never runs that script, so there is nothing to inspect beyond headers and TLS, and those looked fine.
The lesson is uncomfortable for the “just use a browser” advice: a browser that has not been patched to look like a user’s browser is a louder signal than no browser at all, on sites that fingerprint the JavaScript environment.
Best Buy: the odd one
Best Buy blocked plain requests from everywhere. With the headless browser from our Helsinki datacenter address, the homepage loaded five out of five. Through every residential proxy, the same browser hung until the 30-second timeout, having downloaded four to nine megabytes without ever finishing.
We do not have a confident explanation. Akamai’s behaviour of leaving a connection hanging is its way of blocking without a status code, and it applied it to the residential exits but not to the datacenter one on this day. It is a single day’s observation, and it is why the table is rerun monthly rather than written once.
The four that did not move
Google returned its “sorry” page to every browser request, regardless of address; a headless browser asking for search results is exactly what its detection is built for. Walmart redirected to its blocked page. LinkedIn returned 404 to the browser through proxies and 999 from the datacenter, both meaning “no.” These sites block the automation, not the network, and a residential address plus a stock headless browser does not change that.
What the browser costs
Plain requests moved about 3 MB per provider for the whole run of 45 requests. The browser moved 21 to 31 MB for the same 45 pages, with images, fonts and media already blocked. That is seven to ten times the traffic, and residential proxies are billed by the gigabyte.
At the list prices on our buying guide, a thousand successful plain requests cost from about $0.29. The same thousand pages through a headless browser cost seven to ten times that before you add the CPU to run the browser. For a target that plain requests already pass, Amazon or Nike in this test, the browser is pure cost. For Indeed it is the price of admission.
What we would do with these numbers
- Try plain requests first, with real browser headers. Two of the nine sites let them through from a datacenter address, four from a residential one. The browser adds nothing there.
- Add a residential address before adding a browser if the block is address-based. You can tell: the same request from a residential exit passes.
- Add a browser only for challenge-based defences such as Cloudflare’s. Indeed is the pattern to look for: a 403 with a challenge page in the body that a JavaScript engine could execute.
- Do not expect a stock headless browser to pass a fingerprinting defence. PerimeterX, DataDome and their peers look at the JavaScript environment. That is a separate problem, solved by patched browsers or by a scraping browser product, and it deserves its own measurement.
- Count the traffic. Block images, fonts and media in the browser; we did, and it was still seven to ten times the plain run.
Method notes
- Both runs on 10 September 2026 from the same server; plain requests in the morning (06:13–07:31 UTC), browser run in the evening (17:03–17:40 UTC). Sites change their defences by the hour, so some of the difference may be time of day. That is another reason for the monthly rerun.
- Browser: Chromium bundled with Playwright, headless,
--disable-blink-features=AutomationControlled, a desktop Chrome user agent, US locale and New York time zone. Nothing else. - Exit addresses were checked per request via api.ipify.org and looked up at ipinfo. All residential exits were US cable and mobile carriers: Charter, Comcast, Cablevision, T-Mobile.
- The raw results for both runs are in the repository linked from the methodology section of the front page.