Playwright
Playwright is a headless browser operated by Playwright. It runs full JavaScript and renders pages exactly like a real user, which makes it harder to detect and capable of every interaction a human can perform.
Use cases range from legitimate (test automation, AI agents, browser-based scraping) to abusive (credential stuffing, fake account creation, scalping). Treat each case on the merits of what it actually does on your site.
Blocking by user-agent rarely works for long, since headless browsers can spoof any string. Behavioral signals (rate, sequence of requests, IP reputation) are more reliable.
See Playwright on your own site
Match the User-Agent header on incoming requests against the pattern below.
regex
For higher confidence, also verify the source IP against the operator's published ranges. UA strings can be spoofed; IP ownership is harder to fake.
Renders JavaScript
Yes
IP verification
User-Agent only
Crawl frequency
Variable
Honors robots.txt
Often ignored
Honors Crawl-delay
No
Should I let Playwright through?
Watch your logs for a week first. Behavior varies wildly. Observe the request pattern before allow/block decisions.
Does blocking Playwright affect my Google rankings?
No. Playwright acts on behalf of one specific user at a time, not on behalf of a search index. Classical SEO is unaffected. The trade is whether you want users delegating tasks to Playwright to be able to reach your site.
How do I confirm a request is really from Playwright?
Look at the User-Agent header in your access logs and match it against the strings listed above. Worth knowing that the User-Agent is easy to fake, so this check tells you "the traffic claims to be Playwright", not "the traffic is genuinely Playwright". If you need stronger guarantees, look for a reverse-DNS check or wait for Playwright to publish IP ranges.
Can Playwright take actions on my site, like buying or signing up?
In principle yes. Agentic browsers can fill forms, click buttons, and complete transactions. That is the entire point. If your site leans on automation detection to prevent bots from acting, Playwright is a different threat model from a passive crawler and you should think about it separately.
What's the cleanest way to control Playwright?
Two layers. Robots.txt for the polite crawlers that read it, and rules at your CDN or edge for the ones that don't. Rankly's Agent Experience handles both from a single config, so you can allow, block, rate-limit, or serve a stripped-down version per bot. Agent Analytics handles the observation half so you know which bots are actually worth a rule.