---
title: Using advanced client-side detections
summary: null
url: >-
  https://www.fastly.com/documentation/guides/security/bot-management/using-advanced-client-side-detections
---

The advanced client-side detections feature allows you to detect sophisticated bots that leverage headless browsers such as headless Chrome. You can enable this feature by adding a lightweight JavaScript snippet to your website's HTML.

## Prerequisites

Before setting up advanced client-side detections, you must:

- purchase the required products for your Bot Management deployment option. Pre-cache inspection requires [Bot Management](https://docs.fastly.com/products/bot-management). Post-cache inspection requires Bot Management and [Next-Gen WAF](https://docs.fastly.com/products/fastly-next-gen-waf) (Edge WAF deployment only). The [Essential platform](https://docs.fastly.com/products/fastly-next-gen-waf#feature-availability) for the Next-Gen WAF does not support Bot Management.
- [deploy Bot Management](https://www.fastly.com/documentation/guides/security/bot-management/about-bot-management/#deploying-bot-management) on every Fastly service where you intend to use advanced client-side detection.

## Setting up advanced client-side detections

To set up advanced client-side detections for your web application, place the below script above all other scripts in the `<head>` section of your HTML so the browser loads it as quickly as possible. You can change the name of the script from `script.js` to another name of your choosing. The script name must end in `.js`.

```html
<script src="/_fs-ch-1T1wmsGaOgGaSxcX/assets/script.js"></script>
```

> **NOTE:** If you've deployed Bot Management with post-cache inspection, the initial HTTP request for the HTML page will not be tagged with the `CLIENTSIDE-COOKIE-VALID` [system signal](https://www.fastly.com/documentation/guides/next-gen-waf/signals/using-system-signals#bots) because the script must execute before it can evaluate requests for automated or headless indicators. Only subsequent requests made after the browser ran the script will carry this signal.

## Managing detections

### Pre-cache inspection

Once advanced client-side detections is enabled, the feature feeds detections into the `fastly.bot.category.is_headless` VCL parameter. You can customize how Fastly handles these requests by creating [VCL snippets](https://www.fastly.com/documentation/guides/security/bot-management/contentguard/managing-bot-traffic/#using-vcl-to-manage-bot-traffic).

### Post-cache inspection

Once advanced client-side detections is enabled, the feature feeds detections into the `SUSPECTED-BOT.HEADLESS`, `SUSPECTED-BAD-BOT.HEADLESS`, and `CLIENTSIDE-COOKIE-VALID` [system signals](https://www.fastly.com/documentation/guides/next-gen-waf/signals/using-system-signals#bots). You can customize how to handle requests tagged with these system signals by creating [Next-Gen WAF rules](https://www.fastly.com/documentation/guides/next-gen-waf/rules/about-rules).

## Related content

- [Using system signals](https://www.fastly.com/documentation/guides/next-gen-waf/signals/using-system-signals)
- [Using an API with the Next-Gen WAF](https://www.fastly.com/documentation/guides/next-gen-waf/reference/api/using-an-api-with-the-next-gen-waf)