domains / families / security / http2-header-impersonation

http2-header-impersonation

separate

Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.

When to use

• TLS fingerprint is correct but target still detects non-browser HTTP behavior.
• Target uses HTTP/2-specific detection (SETTINGS frame analysis, pseudo-header order).
• Need browser-accurate `sec-ch-ua`, `Accept`, `Accept-Encoding`, `Priority`, and `sec-fetch-*` headers.
• Mobile API endpoints require Android OkHttp header profiles.
• Combining with TLS impersonation for a complete network-level browser profile.

When not to use

• TLS fingerprinting (ClientHello)
• JavaScript fingerprinting

Skill page

Source