← back home · # glossary
The vocabulary of getting past bot walls.
recurl assumes you already know what a JA3 hash or a Cloudflare challenge looks like — but here are the exact definitions the rest of the site uses. See how they chain in the architecture.
- / JA3
- A hash that fingerprints a TLS client from the ordered fields of its ClientHello (cipher suites, extensions, curves). Bot-management systems use it to tell a real browser from a plain HTTP client, even when the URL and User-Agent match.
- / JA4
- The successor to JA3: a more robust, structured TLS client fingerprint that resists trivial evasion. recurl’s impersonation layer aims to reproduce the JA4 signature of a real browser, not just its headers.
- / TLS fingerprint
- The observable shape of a client’s TLS handshake — cipher order, extensions, HTTP/2 SETTINGS, pseudo-header order. A WAF can block on this alone, which is why setting a User-Agent does not fix a fingerprint-based 403.
- / Impersonation
- recurl’s second layer: retrying a blocked request through curl-impersonate with a TLS handshake that matches a specific browser profile (Chrome, Firefox, Safari, Edge). It runs only after plain curl is blocked, and only on Linux and macOS.
- / Headless preflight
- recurl’s third layer (js_preflight): headless Chromium, driven by the recurld daemon, that loads the page, solves a JavaScript challenge, captures cookies, and lets recurl replay the original request through curl.
- / Challenge response
- The interstitial a bot-management system returns instead of the real content — often an HTTP 403/429 with a JavaScript or CAPTCHA challenge body. recurl recognises these as a block signal and escalates.
- / Bot wall
- Informal term for the layered anti-automation defences (TLS fingerprinting, JS challenges, CAPTCHAs) that sit between a client and content. recurl is built to walk past a bot wall only on requests where you already have legitimate access.
- / Exit code
- The numeric status curl returns to the shell. recurl preserves curl’s exit codes so existing scripts, CI checks, and error handling keep working unchanged when curl is aliased to recurl.
- / curl-impersonate
- The established open-source project that patches curl to emit real browser TLS handshakes via a set of profile binaries (curl_chrome, curl_ff, …). recurl uses it as its impersonation layer and adds detection, JS preflight, and fallback on top.
- / Escalation ladder
- recurl’s core control flow: plain curl → TLS impersonation → headless-browser preflight, where each rung runs only if the previous one was blocked. The successful path is always the cheapest available.
- / recurld
- The background daemon that keeps a warm headless Chromium instance for the js_preflight layer, so repeated challenges are fast to solve. It shuts down after a configurable idle timeout.
- / Strict mode
- The --recurl-strict flag, which disables every fallback layer and gives pure plain-curl behaviour — same exit code, body, and headers as upstream curl. Useful for diagnostics and for asserting raw-signal behaviour.