scrapy-stealth

Stealthy Crawling. Maximum Results.

A pluggable anti-bot and stealth framework for Scrapy.

scrapy-stealth extends Scrapy with browser impersonation, Smart Proxy Management, fingerprint cycling, and intelligent retry strategies — designed for large-scale, production-grade crawling.

💜 Sponsors

NodeMaven — the most efficient proxy provider for web scrapping and automation with the highest-quality IP on the market. Why NodeMaven? 99.9% uptime ZIP Targeting IP filtering: all proxies have fraud score <97% No KYC required Unique free tools: Proxy Bandwidth Checker, Meta Tag Checker, IP Lookup, and others Special codes for scrapy-stealth users: SCRAPYSTEALTH35 — 35% off Mobile and Residential Proxies; SCRAPYSTEALTH40 — 40% off ISP (Static) Proxies.
	Proxy-Seller — residential, ISP, mobile, IPv4, and IPv6 proxies across 220+ locations. HTTP(S) and SOCKS5, flexible rotation, and 24/7 support — built for scraping, SEO, and automation at scale. Use code FAWAD15 at proxy-seller.com.

🧠 Why scrapy-stealth?

Scrapy is fast and powerful, but modern websites use advanced anti-bot protections such as:

• TLS fingerprinting
• Browser behavior detection (mouse, scroll, timing)
• Rate limiting and IP blocking

scrapy-stealth helps by adding:

• 🧬 Browser-level impersonation (TLS + HTTP/2 fingerprints)
• 🖭 Behavioral fingerprinting (CDP mouse/scroll on browser; timing jitter on HTTP drivers)
• 🔁 Smarter retry strategies
• 🌐 Smart Proxy Management — health scoring, per-domain cooldown, automatic failover, and stats telemetry
• 🛡️ Anti-bot detection

Result

• Higher success rate
• Lower proxy cost
• More stable crawls

📊 Comparison

⚠️ scrapy-playwright passes real browser TLS but does not spoof fingerprint profiles like scrapy-stealth does. scrapy-impersonate provides TLS/HTTP2 impersonation but lacks built-in rotation, detection, or per-request engine switching. JavaScript rendering is available via the optional browser driver — use it selectively for pages that require a full browser.

✨ Features

• 🔌 Pluggable engine system (scrapy, stealth)
• 🧠 Per-request engine selection via request.meta
• 🌐 Smart Proxy Management — per-domain health scoring, cooldown on dead or blocked proxies, automatic rotation across STEALTH_PROXIES, and telemetry in crawler.stats
• 🧬 Browser fingerprint rotation
• 🔁 Smart retry logic
• 🛡️ Anti-bot detection (status + content-based, Cloudflare, Akamai)
• 🧠 Smart browser selection — driver="auto" runs fast basic / turbo first, then retries once with visible Chrome on JS challenge or ban (enabled automatically when STEALTH_ENABLED = True)
• ⚡ Thread-safe async integration
• 🖥️ Real-browser engine (CDP) for JS-heavy pages
• 🖭 Behavioral fingerprinting — auto-enabled on every driver: CDP mouse/scroll/viewport on browser; profile-seeded request timing on basic/turbo (no config flags)
• ⏱️ Adaptive rate limiting — auto-enabled per-domain throttle: backs off on HTTP 429 / Retry-After, eases after success streaks (no config flags)
• 🔄 Intelligent session recycle — after consecutive bans, browser restarts Chrome; basic/turbo clear HTTP sessions
• 🚫 Static asset blocking — skip images, fonts, CSS, and media for faster, lighter browser fetches
• 🎯 Proxy bypass list — send chosen domains straight to the origin instead of through the proxy (--proxy-bypass-list)
• 🧭 Custom DNS overrides — pin hosts to fixed IPs (connect via IP, keep hostname for TLS/SNI/Host) to dodge poisoned or geo-shifted public DNS
• 📤 Full request fidelity — POST/PUT/PATCH/DELETE, custom headers, and Cookie work the same on basic, turbo, and browser
• 🍪 Browser cookie handoff — after browser login/navigation, session cookies export to response meta and merge into Scrapy's cookie jar for follow-up basic/turbo requests
• ☁️ Cloudflare challenge handling — browser driver waits through 403/503 interstitials and Turnstile-style pages (up to BROWSER_CHALLENGE_TIMEOUT_S); returns raw bytes for CDN images (.jpg, .png, …) instead of Chrome’s HTML viewer shell
• 📸 Built-in snapshot decorator (scrapy_stealth.decorators.snapshot)

📦 Installation

pip install scrapy-stealth

Requires Python 3.11+ and Scrapy 2.12–2.x

⚙️ Setup

Recommended — two settings, smart by default:

DOWNLOADER_MIDDLEWARES = {
    "scrapy_stealth.middlewares.StealthDownloaderMiddleware": 950,
}
STEALTH_ENABLED = True  # injects driver="auto" on every request

That runs fast HTTP impersonation with turbo first (deeper TLS fingerprinting), then retries once with visible Chrome when a JS challenge or session ban is detected. No extra fallback flags — driver="auto" is the only switch.

Option 1 — Global (settings.py)

# 1. Enable the middleware
DOWNLOADER_MIDDLEWARES = {
    "scrapy_stealth.middlewares.StealthDownloaderMiddleware": 950,
}

# 2. Route ALL requests through stealth — injects driver="auto" automatically (turbo first)
STEALTH_ENABLED = True
# STEALTH_DRIVER = "basic"  # optional: lighter HTTP driver instead of default turbo

# 3. (Optional) Proxy list — seeded as engine default; rotated on ban-streak session recycle
#    Supported schemes: http, https, socks4, socks5
STEALTH_PROXIES = [
    "http://proxy1:8080",
    "http://proxy2:8080",
    "http://user:pass@proxy3:8080",  # with authentication
    "socks5://proxy4:1080",
]

# 4. (Optional) Pin hosts to fixed origin IPs (bypass public DNS)
#    Connects to the IP while keeping the hostname for TLS SNI / Host / certs
STEALTH_DNS_OVERRIDES = {
    "example.com": "203.0.113.10",
    "www.example.com": "203.0.113.10",
}

# 5. (Optional) Recycle HTTP/browser sessions after N consecutive bans (default 5)
STEALTH_RECYCLE_AFTER_BANS = 2

Option 2 — Per-spider (custom_settings)

Configure the middleware and all stealth settings directly on the spider — no changes to settings.py required.

class MySpider(scrapy.Spider):
    name = "example"

    custom_settings = {
        "DOWNLOADER_MIDDLEWARES": {
            "scrapy_stealth.middlewares.StealthDownloaderMiddleware": 950,
        },
        "STEALTH_ENABLED": True,
        "STEALTH_PROXIES": [
            "http://proxy1:8080",
            "http://user:pass@proxy2:8080",
            "socks5://proxy3:1080",
        ],
        "STEALTH_DNS_OVERRIDES": {
            "example.com": "203.0.113.10",
        },
        "STEALTH_RECYCLE_AFTER_BANS": 2,  # rotate profile + proxy after 2 consecutive bans
    }

Proxies are validated at startup — invalid format or unsupported scheme raises ValueError immediately. DNS overrides are validated the same way — invalid IPs raise ValueError immediately.

🚀 Quick Start

Option A — Per-request (stealth on specific URLs only):

# Smart path — HTTP first, browser on challenge/ban
yield scrapy.Request(
    url="https://example.com",
    meta={"stealth": {"driver": "auto"}},
)

# HTTP-only — no browser fallback
yield scrapy.Request(
    url="https://example.com",
    meta={"stealth": {"driver": "basic"}},
)

Option B — Global mode (recommended — stealth on every request):

# settings.py or custom_settings
STEALTH_ENABLED = True
# STEALTH_DRIVER = "basic"  # optional: lighter HTTP driver instead of default turbo

# No meta needed — middleware injects driver="auto"
yield scrapy.Request(url="https://example.com")

# Opt out for a specific request
yield scrapy.Request(url="https://api.internal/health", meta={"stealth": False})

# Force HTTP-only for one request (no browser fallback)
yield scrapy.Request(url="https://example.com", meta={"stealth": {"driver": "basic"}})

See Smart browser selection for how driver="auto" works.

🔧 Global Configuration

Customise package-wide defaults via the shared config instance. All settings must be applied at module level, before the spider class — the engine client is created at middleware initialisation, so changes inside start_requests or parse will have no effect.

# myspider.py
import scrapy
from scrapy_stealth.config import config

config.DEFAULT_ENGINE = "stealth"  # "scrapy" (native) or "stealth" (browser impersonation)
config.DEFAULT_TIMEOUT = 30  # stealth request timeout in seconds
config.STEALTH_DRIVER = "turbo"  # "turbo" (default), "basic", "browser", or "auto"
config.HTTP2 = True  # False for servers that only support HTTP/1.1
config.HTTP3 = False  # turbo: True for HTTP/3 (QUIC); needs UDP-capable proxy
config.BLOCK_CODES |= {407}  # extend blocked status codes (|= keeps defaults)
config.BLOCK_KEYWORDS.append("banned")  # extend blocked body-text patterns
config.BROWSER_HEADLESS = False  # browser driver: False = visible window (default)
config.BROWSER_SETTLE_S = 4.0  # browser driver: seconds to wait after navigation for JS to finish
config.BROWSER_CHALLENGE_TIMEOUT_S = 30.0  # max wait on Cloudflare / JS challenge pages (403/503)
config.BROWSER_EXECUTABLE_PATH = "/usr/bin/brave-browser"  # custom browser binary (default: auto-detect Chrome)
config.STEALTH_RECYCLE_AFTER_BANS = 5  # recycle Chrome / HTTP sessions after 5 consecutive bans
config.BROWSER_STATIC_ASSETS_BLOCK = True  # block images/fonts/CSS/media (skipped when snapshot=True)
config.BROWSER_PROXY_BYPASS_LIST = ["example.com", "*.internal"]  # these bypass the proxy
config.STEALTH_DNS_OVERRIDES = {"example.com": "203.0.113.10"}  # pin host → origin IP


class MySpider(scrapy.Spider):
    name = "example"
    ...

# ❌ wrong — too late, the engine client is already created
class MySpider(scrapy.Spider):
    def start_requests(self):
        config.HTTP2 = False  # has no effect
        ...

You can also read any value programmatically:

config.get("DEFAULT_ENGINE")  # "scrapy"
config.get("MISSING_KEY", "default")  # "default"

For one-off overrides on a single request, set meta["stealth"]["driver"] or meta["stealth"]["http2"] (see Per-Request Configuration below).

⚙️ Per-Request Configuration

All options are passed via request.meta["stealth"].

The presence of meta["stealth"] (a dict) activates the stealth engine. Omit the key to use the default Scrapy engine. When STEALTH_ENABLED = True, all requests are stealth by default with driver="auto" — pass meta={"stealth": False} to opt out, or set an explicit driver to override.

yield scrapy.Request(
    url,
    meta={
        "stealth": {
            "driver": "turbo",
            # optional — omit profile/proxy for random fingerprint + STEALTH_PROXIES default
            "proxy": "http://user:pass@proxy:8080",
            "stealth_timeout": 60,
            "http2": True,
            "dns": "203.0.113.10",  # or {"example.com": "203.0.113.10"}
        }
    },
)

Response meta (browser driver): after each browser fetch, the response includes:

📤 POST, headers, and cookies

All stealth drivers (basic, turbo, browser, and driver="auto") honor the same Scrapy Request fields — HTTP method, body, Cookie, and custom headers. Use normal Scrapy syntax; no extra stealth meta keys are required for POST or auth headers.

Internally, every driver calls build_stealth_request() to normalize and validate the request once (method, URL, body, cookies, headers). Fingerprint headers (User-Agent, Accept, sec-ch-ua, etc.) are managed by the engine impersonation layer — set Authorization, Content-Type, Cookie, and other app-specific headers on the Scrapy request as usual.

JSON POST (API login, search, etc.)

Works on basic, turbo, and browser.
Use postman-echo.com/post — it echoes JSON back and stays up reliably (avoid httpbin.org; it often returns 503):

import json

yield scrapy.Request(
    "https://postman-echo.com/post",
    method="POST",
    body=json.dumps({"search": "laptop", "page": 1}).encode(),
    headers={"Content-Type": "application/json"},
    meta={"stealth": {"driver": "turbo"}},  # or basic / browser / auto
)

With global stealth enabled, omit meta — the same request shape applies:

STEALTH_ENABLED = True  # settings.py

yield scrapy.Request(
    "https://postman-echo.com/post",
    method="POST",
    body=json.dumps({"search": "laptop"}).encode(),
    headers={"Content-Type": "application/json"},
)

Connection failed on turbo? If you use STEALTH_PROXIES or meta["stealth"]["proxy"], the proxy must allow HTTPS POST to the test host. Try without a proxy first, or switch to driver="basic", or set meta={"stealth": {"http2": False}}.

Form POST (login, filters)

quotes.toscrape.com/login is a public Scrapy tutorial site with a real login form:

from urllib.parse import urlencode

yield scrapy.Request(
    "https://quotes.toscrape.com/login",
    method="POST",
    body=urlencode({"username": "admin", "password": "admin"}).encode(),
    headers={"Content-Type": "application/x-www-form-urlencoded"},
    meta={"stealth": {"driver": "browser"}},  # browser merges hidden csrf_token from the form
)

Browser form POST: the engine loads the login page first, then merges hidden <form> fields (e.g. csrf_token) into urlencoded bodies before in-page fetch(). You only need to send the visible fields (username, password, …).

Browser cookie handoff

After a browser request (login POST, JS navigation, etc.), scrapy-stealth reads cookies from the Chrome tab and exposes them on the response. When COOKIES_ENABLED = True (Scrapy default) and BROWSER_EXPORT_COOKIES = True (default), those cookies are merged into Scrapy's cookie jar so the next basic or turbo request reuses the session automatically.

Typical flow: login with browser → scrape with turbo

from urllib.parse import urlencode

class LoginSpider(scrapy.Spider):
    custom_settings = {
        "DOWNLOADER_MIDDLEWARES": {
            "scrapy_stealth.middlewares.StealthDownloaderMiddleware": 950,
        },
        "COOKIES_ENABLED": True,
    }

    async def start(self):
        yield scrapy.Request(
            "https://quotes.toscrape.com/login",
            method="POST",
            body=urlencode({"username": "admin", "password": "admin"}).encode(),
            headers={"Content-Type": "application/x-www-form-urlencoded"},
            meta={"stealth": {"driver": "browser"}},
            callback=self.after_login,
        )

    def after_login(self, response):
        # Optional: inspect exported cookies
        stealth = response.meta.get("stealth") or {}
        self.logger.info("cookie header: %s", stealth.get("browser_cookie_header"))

        # Jar merge is automatic — turbo/basic pick up the session
        yield scrapy.Request(
            "https://quotes.toscrape.com/",
            meta={"stealth": {"driver": "turbo"}},
            callback=self.parse_home,
        )

    def parse_home(self, response):
        assert "Logout" in response.text  # still logged in via turbo

Or pass cookies explicitly on the next request:

cookie_header = response.meta["stealth"]["browser_cookie_header"]
yield scrapy.Request(
    url,
    headers={"Cookie": cookie_header},
    meta={"stealth": {"driver": "turbo"}},
)

Opt out of jar merge per request (meta is still populated):

meta={"stealth": {"driver": "browser", "export_cookies": False}}

Stats: stealth/browser_cookies_exported counts cookies merged into the jar.

Cookies and Authorization

Pass session cookies or bearer tokens on the Scrapy request — all drivers forward them.
postman-echo.com/get echoes request headers back:

yield scrapy.Request(
    "https://postman-echo.com/get",
    headers={
        "Cookie": "session_id=abc123; cart_token=xyz",
        "Authorization": "Bearer test-token-123",
    },
    meta={"stealth": {"driver": "turbo"}},
)

Tip: With COOKIES_ENABLED = True, browser-exported session cookies flow into Scrapy's jar automatically (BROWSER_EXPORT_COOKIES = True by default). You can also set the Cookie header manually on any driver — all engines forward it.

PUT / PATCH / DELETE

Same pattern — set method and optional body.
jsonplaceholder.typicode.com/posts/1 accepts PATCH:

yield scrapy.Request(
    "https://jsonplaceholder.typicode.com/posts/1",
    method="PATCH",
    body=b'{"title": "patched"}',
    headers={"Content-Type": "application/json"},
    meta={"stealth": {"driver": "basic"}},
)

Driver behaviour summary

Human-like behavior (automatic — no settings or meta flags):

For driver="auto", phase 1 uses basic/turbo (including POST). If the response is a JS challenge or session ban, phase 2 retries once with browser using the same method, body, and headers. Fallback counters include the HTTP method (stealth/fallbacks/method/post, etc.).

What not to set manually

Do not override fingerprint headers on the Scrapy request — they are stripped and replaced by the active profile:

• User-Agent, Accept, Accept-Language, Accept-Encoding
• sec-ch-ua*, sec-fetch-*, Upgrade-Insecure-Requests, etc.

Set application headers only (Content-Type, Cookie, Authorization, X-*, …).

JS-protected POST flows

When a site requires a real browser for login or API calls behind Cloudflare, point at a live endpoint — here postman-echo.com/post via the browser driver (swap in your target URL for production):

yield scrapy.Request(
    "https://postman-echo.com/post",
    method="POST",
    body=b'{"items": [{"sku": "A1", "qty": 2}]}',
    headers={"Content-Type": "application/json"},
    meta={"stealth": {"driver": "browser", "headless": False, "settle": 6}},
)

For a JS-rendered GET smoke test, try quotes.toscrape.com with driver="browser".

Or let driver="auto" try fast HTTP first and escalate to browser only when needed.

🧭 Custom DNS Overrides

Pin a hostname to a fixed origin IP so the package dials that address directly instead of trusting public DNS. The request URL stays as https://example.com/... — TLS SNI, the Host header, and certificate verification still use the hostname.

Global (settings.py / custom_settings / config):

STEALTH_DNS_OVERRIDES = {
    "shop.example.com": "203.0.113.10",
    "cdn.example.com": "203.0.113.11",
}

Per-request (overrides or extends the global map):

yield scrapy.Request(
    "https://shop.example.com/item/1",
    meta={"stealth": {"driver": "turbo", "dns": "203.0.113.10"}},
)

# Or a full mapping:
meta = {"stealth": {"dns": {"shop.example.com": "203.0.113.10"}}}

Supported on basic and turbo per-request. The browser driver applies the effective map (config + meta["stealth"]["dns"]) via a local CONNECT relay that dials the pinned IP (Chrome's --host-resolver-rules is not used — it is unreliable). Chrome is pointed at the relay with --proxy-server; when the DNS map changes, the browser restarts so the relay is rebuilt. Do not put DNS-pinned hosts on BROWSER_PROXY_BYPASS_LIST or they will skip the relay. With an HTTP proxy on basic/turbo, DNS is often resolved by the proxy — prefer direct connections or SOCKS when using overrides.

🧠 Smart browser selection

Use driver="auto" to pick the right engine automatically: stay on fast HTTP impersonation (basic / turbo) for normal pages, and escalate to real Chrome only when the response looks like a JS challenge or session ban (403/429/503, Cloudflare “Just a moment”, Akamai, DataDome, and similar signals). When STEALTH_ENABLED = True, the middleware injects driver="auto" for you.

The fallback always opens a visible Chrome window (headless=False) for better evasion — regardless of BROWSER_HEADLESS or any prior meta["stealth"]["headless"] value.

Global — simplest setup:

STEALTH_ENABLED = True
# STEALTH_DRIVER = "basic"  # optional — lighter HTTP driver instead of default turbo

Per-request (without STEALTH_ENABLED):

yield scrapy.Request(
    url,
    meta={"stealth": {"driver": "auto"}},
)

Always use browser (skip phase 1):

meta={"stealth": {"driver": "browser"}}

HTTP-only (no browser retry):

meta={"stealth": {"driver": "basic"}}  # or "turbo"

Disable browser retry but keep auto HTTP driver (rare):

meta={"stealth": {"driver": "auto", "fallback": False}}

Each request is retried at most once. If the browser fetch fails, the original basic / turbo response is returned. Console output and stats (stealth/fallbacks, stealth/fallbacks/method/post, stealth/requests/browser) show when escalation happened.

🌐 Smart Proxy Management

When you run with a proxy pool (STEALTH_PROXIES or per-request meta["stealth"]["proxy"]), scrapy-stealth tracks health per proxy and per target domain. Dead credentials, tunnel errors (407, CONNECT aborted), and repeated blocks automatically cool down the bad entry, skip it during rotation, and fail over to the next proxy in the pool.

Settings:

# settings.py
STEALTH_PROXIES = [
    "http://user-a:pass@dc.oxylabs.io:8000",  # primary
    "http://user-b:pass@dc.oxylabs.io:8000",  # fallback
]
STEALTH_PROXY_HEALTH = True          # default — disable to use random rotation only
STEALTH_PROXY_CIRCUIT_AFTER = 3      # failures before cooldown
STEALTH_PROXY_COOLDOWN_S = 300.0     # seconds off-pool for that domain
STEALTH_PROXY_CIRCUIT_CODES = {403}  # status codes that trip the circuit

Per-request override — pin or bypass a proxy for one URL:

yield scrapy.Request(url, meta={"stealth": {"proxy": "http://user:pass@proxy:8080"}})
yield scrapy.Request(cdn_url, meta={"stealth": {"proxy": None}})  # direct, no proxy

Proxy telemetry (stealth/proxy/connection_failures, cooldowns, rotations, …) is in crawler.stats after the crawl.

🖥️ Browser Engine

For sites protected by Cloudflare JS challenges or heavy JavaScript rendering, use the browser driver. It runs a real Chrome instance via the DevTools Protocol (no WebDriver), keeping one persistent browser and opening a new tab per request. Behavioral fingerprinting is always on for the browser driver — CDP mouse movement, scroll, and viewport emulation run automatically after each GET navigation.

Per-request (most common):

yield scrapy.Request(
    url,
    meta={
        "stealth": {
            "driver": "browser",
            "headless": False,  # visible window — default for browser driver
            "settle": 4.0,  # seconds to wait for JS after page load
        }
    },
)

Heavy Cloudflare sites — increase settle and challenge timeout:

meta = {
    "stealth": {
        "driver": "browser",
        "headless": False,
        "settle": 12,
    }
}

# Or globally:
# BROWSER_CHALLENGE_TIMEOUT_S = 45

On 403/503 challenge pages (“Just a moment”, “Performing security verification”, Turnstile), the browser driver waits up to BROWSER_CHALLENGE_TIMEOUT_S (default 30s) for the challenge to clear before capturing the response — not only on HTTP 2xx.

Behavioral fingerprinting (auto-enabled)

No BROWSER_BEHAVIOR_ENABLED setting and no meta["stealth"]["behavior"] flag — interaction replay is built into the drivers:

Adaptive rate limiting (auto-enabled)

Every stealth driver paces requests per domain automatically — no STEALTH_ADAPTIVE_THROTTLE setting and no per-request meta flag.

• 429 / Retry-After — doubles inter-request spacing (minimum 1s) and honors Retry-After.
• Success streaks — after several clean responses, spacing eases back down (AIMD).
• Slow responses — high latency EMA nudges spacing up slightly.
• Stats — stealth/throttle/waits, stealth/throttle/wait_ms, stealth/throttle/rate_limited, stealth/throttle/retry_after (with {driver} breakdowns).

403/503 blocks still go through ban detection, proxy health, and session recycle — throttle only learns from rate limits, not generic bans.

Mouse paths use quadratic Bézier curves with Gaussian jitter so consecutive requests from the same profile stay in a plausible band without identical coordinates every time.

Verify on an HTML page (not a bare .jpg CDN URL) with a visible window:

yield scrapy.Request(
    "https://example.com",
    meta={"stealth": {"driver": "browser", "headless": False, "settle": 8}},
)

Watch the Chrome tab during settle — you should see scroll/wheel activity. CDP input affects the browser tab, not your OS desktop cursor.

CDN / static assets: Behavioral replay does not bypass IP or proxy blocks. For plain CDN images (e.g. scdn.autodoc.de/*.jpg) without a JS challenge, prefer driver="turbo" and a clean proxy — browser mode is slower and still returns 403 when the CDN rejects the IP.

Advanced: scrapy_stealth.behaviors.simulate_hover(page, x1, y1, x2, y2) is exported for custom CDP mouse paths in browser automation scripts.

CDN images / binary assets behind Cloudflare:

Direct GET to .jpg, .png, and other asset URLs returns raw file bytes in response.body (not Chrome’s HTML image-viewer wrapper) when the origin serves the file. Useful when a CDN sits behind Cloudflare JS — otherwise try turbo first:

# Fast path — no Chrome, no mouse replay
yield scrapy.Request(
    "https://scdn.autodoc.de/vehicles/800x287/8145.jpg",
    meta={"stealth": {"driver": "turbo"}},
    callback=self.save_image,
)

# Browser — when the CDN requires JS/challenge clearance first
yield scrapy.Request(
    "https://scdn.autodoc.de/vehicles/800x287/8145.jpg",
    meta={"stealth": {"driver": "browser", "headless": False, "settle": 8}},
    callback=self.save_image,
)

def save_image(self, response):
    assert response.body[:3] == b"\xff\xd8\xff"  # JPEG magic bytes

Global default (all stealth requests use browser engine):

from scrapy_stealth.config import config

config.STEALTH_DRIVER = "browser"
config.BROWSER_HEADLESS = False  # more stealthy
config.BROWSER_SETTLE_S = 6.0  # longer wait for JS

Custom browser binary (Brave, Chromium, or a non-default Chrome install):

from scrapy_stealth.config import config

config.BROWSER_EXECUTABLE_PATH = "/usr/bin/brave-browser"  # Linux
# config.BROWSER_EXECUTABLE_PATH = r"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"  # Windows

Or via settings.py / custom_settings:

BROWSER_EXECUTABLE_PATH = "/usr/bin/brave-browser"

When BROWSER_EXECUTABLE_PATH is None (the default), scrapy-stealth auto-detects Google Chrome or Chromium from standard system paths. Set it explicitly when using Brave or a non-standard Chrome installation — a clear error is raised if the path does not exist.

Intelligent restart / session recycle:

After STEALTH_RECYCLE_AFTER_BANS consecutive banned/challenged responses (as classified by Anti-Bot Detection), scrapy-stealth recycles the driver session:

• browser — restarts Chrome (fresh fingerprint, cookies, CDP session)
• basic / turbo — clears cached HTTP clients/sessions and rotates default fingerprint profile + proxy from STEALTH_PROXIES

A single clean response resets the streak, so a healthy crawl is never recycled just because it has served a lot of requests.

# settings.py or spider custom_settings (recommended)
STEALTH_RECYCLE_AFTER_BANS = 2

# or via config before the spider class
from scrapy_stealth.config import config

config.STEALTH_RECYCLE_AFTER_BANS = 2

Note: Recycle rotates the engine default profile and proxy from STEALTH_PROXIES. Per-request meta["stealth"]["profile"] or meta["stealth"]["proxy"] stay pinned and are not replaced on recycle — omit those keys to let rotation apply.

Static asset blocking:

scrapy-stealth can block static assets (images, fonts, CSS, and media) in the browser to speed up page loads and cut bandwidth, via the CDP Fetch domain. It's off by default — enable it globally with BROWSER_STATIC_ASSETS_BLOCK = True in settings.py, or per-request via meta["stealth"]["static_assets_block"]. Blocking is always skipped when snapshot=True, since a snapshot needs the fully rendered page.

# settings.py
BROWSER_STATIC_ASSETS_BLOCK = True

# per-request
meta = {"stealth": {"driver": "browser", "static_assets_block": True}}

# snapshot always wins — assets are never blocked here, even with the global default on
meta = {"stealth": {"driver": "browser", "snapshot": True}}

Proxy bypass list:

When a proxy is configured, you can send specific domains straight to the origin instead of through the proxy. The list is passed to Chrome's --proxy-bypass-list launch flag, so it supports the full Chrome bypass syntax — bare hostnames, wildcards (*.example.com), IP/CIDR ranges, ports, and the special <local> token.

# settings.py
STEALTH_DRIVER = "browser"
STEALTH_PROXIES = ["http://user:pass@proxy:8080"]
BROWSER_PROXY_BYPASS_LIST = [
    "example.com",  # exact host
    "*.internal.net",  # wildcard subdomains
    "127.0.0.1",  # IP
    "<local>",  # any plain hostname without dots
]

# or via config
from scrapy_stealth.config import config

config.BROWSER_PROXY_BYPASS_LIST = ["example.com", "*.internal.net"]

The bypass list is a Chrome launch flag, so it's read once when the browser starts and applies to the whole browser lifetime — it's configured globally (config/settings), not per-request. It has no effect unless a proxy is in use.

Docker (running as root):

Chrome requires --no-sandbox when the process runs as root. scrapy-stealth detects this automatically, but you can also set it explicitly in settings.py:

BROWSER_NO_SANDBOX = True  # force no-sandbox (Docker, any root environment)
BROWSER_EXECUTABLE_PATH = "/usr/bin/chromium"  # use Chromium instead of Chrome in Docker

Or via config:

config.BROWSER_NO_SANDBOX = True
config.BROWSER_EXECUTABLE_PATH = "/usr/bin/chromium"

Performance note: the browser engine is slower than basic/turbo (~5-15s per page vs <2s). With driver="auto" (or STEALTH_ENABLED = True), only challenged URLs hit the browser — everything else stays on fast HTTP.

📸 Screenshots

Capture a PNG screenshot of any page rendered by the browser driver and save it to disk.

Enable on the request

yield scrapy.Request(
    url,
    meta={
        "stealth": {
            "driver": "browser",
            "snapshot": True,
        }
    },
    callback=self.parse,
)

The raw PNG bytes are available at response.meta["snapshot_content"] inside your callback.

Auto-save with snapshot decorator

from scrapy_stealth.decorators import snapshot


class MySpider(scrapy.Spider):

    @snapshot
    def parse(self, response): ...

    @snapshot(path="stealth_shots/page.png")
    def parse(self, response): ...

    @snapshot(path=lambda r: r.url.split("/")[-1] + ".png")
    def parse(self, response): ...

Note: Requires driver="browser" and snapshot=True in the request meta. Logs an error if no snapshot data is found in the response.

Custom handling (without the built-in helper)

The screenshot is just bytes in response.meta["snapshot_content"] — do anything you like with it:

def parse(self, response):
    shot: bytes | None = response.meta.get("snapshot_content")
    if shot is None:
        return  # screenshot was not requested or capture failed

    # Save manually
    with open("page.png", "wb") as f:
        f.write(shot)

    # Pass to a pipeline via item
    yield {"url": response.url, "screenshot": shot}

🔁 Session recycle & Scrapy stats

Profile + proxy stay stable for speed (session reuse). After STEALTH_RECYCLE_AFTER_BANS consecutive bans, the session recycles and a new default profile + proxy (from STEALTH_PROXIES) are chosen automatically. Between recycles, Smart Proxy Management handles transport failures and per-domain blocks without waiting for a full session recycle.

# settings.py or spider custom_settings
STEALTH_RECYCLE_AFTER_BANS = 5  # default

When recycle fires you will see a console line like: Recycling turbo sessions after N consecutive bans (profile=… proxy=…). Check stealth/recycles and stealth/profile in Scrapy stats to confirm rotation.

Scrapy stats

After the crawl (or mid-run via crawler.stats):

# e.g. in spider_closed
stats = spider.crawler.stats.get_stats()
print(
    stats.get("stealth/bans"),
    stats.get("stealth/recycles"),
    stats.get("stealth/proxy/connection_failures"),
    stats.get("stealth/proxy/cooldowns"),
    stats.get("stealth/proxy/rotations"),
    stats.get("stealth/proxy/last_connection_failure"),
)

🧩 Strategies

Fingerprint Rotation

Profiles are chosen randomly from the pool by default — you usually do not need to set profile on every request. Pin one only when debugging or when a site requires a specific fingerprint:

yield scrapy.Request(url, meta={"stealth": {"profile": "chrome150"}})

For manual rotation outside session recycle:

from scrapy_stealth.strategies.fingerprint import ProfileRotator

yield scrapy.Request(url, meta={"stealth": {"profile": ProfileRotator().get()}})

Intelligent Retry

from scrapy_stealth.strategies.retry import RetryHandler

retry = RetryHandler()


def parse(self, response):
    if retry.should_retry(response):
        yield retry.build(response.request)
        return

🛡️ Anti-Bot Detection

from scrapy_stealth.detectors.antibot import AntiBotDetector

detector = AntiBotDetector()

if detector.is_blocked(response):
    print("Blocked!")

📊 Full spider example

Keep the README short — the complete working spider lives in examples/full_spider.py.

It shows:

• middleware + STEALTH_ENABLED via custom_settings (auto-injects driver="auto", turbo first)
• per-request basic / browser overrides
• POST requests with JSON body and custom headers (see POST, headers, and cookies)
• optional snapshot with @snapshot
• ban detection, Smart Proxy Management telemetry, and stealth stats on close

# from a Scrapy project
scrapy crawl stealth_demo

# or one-off
scrapy runspider examples/full_spider.py

Minimal version:

import scrapy


class ExampleSpider(scrapy.Spider):
    name = "example"
    custom_settings = {
        "DOWNLOADER_MIDDLEWARES": {
            "scrapy_stealth.middlewares.StealthDownloaderMiddleware": 950,
        },
        "STEALTH_ENABLED": True,
    }

    def start_requests(self):
        yield scrapy.Request("https://example.com")

    def parse(self, response):
        yield {"title": response.css("title::text").get(), "url": response.url}

⚡ Performance Insight

Using stealth selectively:

• ⚡ Faster crawling (Scrapy for simple pages)
• 💰 Lower proxy cost
• 🛡️ Better success rate on protected pages

📜 Changelog

See CHANGELOG.md for a full history of changes, or browse GitHub Releases.

🤝 Contributing

See CONTRIBUTING.md for guidelines on how to contribute.

📄 License

This project is licensed under the MIT License — free to use, modify, and distribute. See LICENSE for the full text.