User-Agent spoofing involves modifying the User-Agent string that browsers send to identify themselves to servers. While sometimes used legitimately for compatibility, it can also be used maliciously to bypass security controls or impersonate different browsers. Applications should not rely solely on User-Agent strings for security decisions.
Every HTTP request from a browser includes a User-Agent header, a string that names the browser, its version, the rendering engine, and the operating system. User-agent spoofing means changing that string so the client claims to be something it is not, for example a phone reporting itself as a desktop, or a script reporting itself as Chrome. It is trivial to do: browser developer settings, extensions, command-line flags, and HTTP libraries all let you set an arbitrary value, and the server has no built-in way to verify it. The same freedom exists in the JavaScript navigator.userAgent property and in the newer User-Agent Client Hints, which report similar information in a structured form.
Because the User-Agent is self-reported and unverified, treating it as trustworthy is a recurring source of weakness. Malicious bots, scrapers, and credential-stuffing tools routinely spoof a common browser string to slip past filters that block by user-agent, or to impersonate search-engine crawlers. Attackers also spoof to probe for version-specific behaviour or to receive content meant for a different platform. On the defensive side, spoofing breaks any control that assumes the string is accurate: analytics get skewed, and security rules keyed to the User-Agent can be bypassed outright. The core lesson is that a client can claim to be anything, so the header should inform behaviour, never authorise it.
Never make a security decision on the User-Agent alone. Instead, corroborate it against evidence that is harder to forge: verify search-crawler claims by reverse DNS, check TLS and header ordering, and compare the stated browser against the capabilities and rendering behaviour it actually exhibits. This is where cside's device intelligence and bot detection help: they cross-check the declared user-agent against many independent signals, so a request claiming to be desktop Chrome while presenting a headless or inconsistent fingerprint is flagged as spoofed. Detection rests on the mismatch between what a client says and what it demonstrably is, not on trusting the string, which any client can rewrite in seconds.
Changing your own user-agent is legal and common; developers do it to test sites and privacy tools do it to reduce tracking. It becomes a problem when combined with abuse, such as evading rate limits, impersonating Googlebot, or bypassing access controls, which typically violates a site's terms of service and, depending on intent, other laws.
Not from the string itself, but often from context. If a request claims to be Safari on iOS yet negotiates a TLS handshake or supports JavaScript APIs that real Safari would not, the mismatch reveals the spoof. Reliable detection compares the declared identity against many independent, harder-to-fake signals.
We answer client-side security questions every day. Bring yours.