--- title: Using advanced client-side detections summary: null url: >- https://www.fastly.com/documentation/guides/security/bot-management/using-advanced-client-side-detections --- The advanced client-side detections feature allows you to detect sophisticated bots that leverage headless browsers such as headless Chrome. You can enable this feature by adding a lightweight JavaScript snippet to your website's HTML. ## Prerequisites Before setting up advanced client-side detections, you must: - purchase [Bot Management](https://docs.fastly.com/products/bot-management) and [Fastly Next-Gen WAF](https://docs.fastly.com/products/fastly-next-gen-waf) for deployment on Fastly's Edge Cloud. The [Essential platform](https://docs.fastly.com/products/fastly-next-gen-waf#feature-availability) for the Next-Gen WAF does not support Bot Management. - [deploy Bot Management](https://www.fastly.com/documentation/guides/security/bot-management/about-bot-management/#deploying-bot-management) on every Fastly service where you intend to use advanced client-side detection. ## Setting up advanced client-side detections To set up advanced client-side detections for your web application, add the following line within the `` section of your HTML: ```html ``` When adding the script, keep in mind the following: - It is best to place the script above all other scripts in your HTML. - You can change the name of the script from `script.js` to another name of your choosing. The script name must end in `.js`. - To identify whether a browser has run the script, check for the `_fs_cd_cp_` cookie, which is issued from the customer domain. ## Managing detections ### Pre-cache inspection Once advanced client-side detections is enabled, the feature feeds detections into the `fastly.bot.category.is_headless` VCL parameter. You can customize how Fastly handles these requests by creating [VCL snippets](https://www.fastly.com/documentation/guides/security/bot-management/about-contentguard/#managing-bot-interactions). ### Post-cache inspection Once advanced client-side detections is enabled, the feature feeds detections into the `SUSPECTED-BOT.HEADLESS`, `SUSPECTED-BAD-BOT.HEADLESS`, and `CLIENTSIDE-COOKIE-VALID` [system signals](https://www.fastly.com/documentation/guides/next-gen-waf/signals/using-system-signals#bots). You can customize how to handle requests tagged with these system signals by creating [Next-Gen WAF rules](https://www.fastly.com/documentation/guides/next-gen-waf/rules/about-rules). ## Related content - [Using system signals](https://www.fastly.com/documentation/guides/next-gen-waf/signals/using-system-signals) - [Using an API with the Next-Gen WAF](https://www.fastly.com/documentation/guides/next-gen-waf/developer/using-an-api-with-the-next-gen-waf)