User-Agent Spoofing.

Forging the User-Agent header or related client hints so that a request appears to come from a different browser, device, or operating system than it actually does. It belongs to the Application Security category of cybersecurity.

Forging the User-Agent header or related client hints so that a request appears to come from a different browser, device, or operating system than it actually does.

User-Agent spoofing is the practice of changing the HTTP User-Agent string (and related Client Hints such as Sec-CH-UA) sent by a client to misrepresent the underlying browser, version, or platform. Legitimate uses include testing responsive layouts, debugging compatibility issues, and accessing content gated by deprecated browser checks. Attackers use the same technique to bypass weak bot detection, impersonate Googlebot to obtain different content, fingerprint defense bypass, and exploit server-side conditional logic. Because the header is fully controlled by the client, security teams treat User-Agent as untrusted input and combine it with TLS fingerprinting, JavaScript challenges, and behavioral analytics to detect automation.

Defences for User-Agent Spoofing typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: UA spoofing, User-Agent override.