Blocked HappyDOM, but requests still marked as Allowed

Help
1

Hi everyone,

Over the past few days, I’ve been noticing a consistent number of requests (40–60 per day) coming from a user agent like:

Mozilla/5.0 (X11; Linux x64) AppleWebKit/537.36 (KHTML, like Gecko) HappyDOM/0.0.0

Screenshot_1
Screenshot_11668×379 64.1 KB

Screenshot_2
Screenshot_21669×656 73.3 KB

From what I understand, this is likely a headless DOM emulator (HappyDOM), used for scraping or automated testing.

Here’s what I’ve tried so far:

  1. Created a Firewall rule that matches the User-Agent containing “HappyDOM” and set it to Deny – but I kept seeing new requests marked as Allowed.
  2. Tried again with a different rule using a partial User-Agent match and Deny – no effect.
  3. Most recently, I added a rule using JA4 Digest, matching the fingerprint of these requests and also set it to Deny – but I’m still seeing requests from the same User-Agent in my logs, with status “Allowed”.

So far, nothing seems to stop these requests from going through.

My questions:

  • Is there a reason why these requests still appear as Allowed even after being matched by Deny rules?
  • How can I ensure that these requests are fully denied and do not hit my site at all?

For context, my site is a mostly static Next.js project using SSG (static site generation). The only dynamic part is a single API route that handles search queries. I’m hosting it on Vercel (Hobby plan) with a custom domain. The site hasn’t been submitted to Google or any search engines, so I wasn’t expecting any crawler or bot activity at this stage. That’s why these repeated HappyDOM requests are concerning.

Thanks in advance for any help!

4

Hi,

Mozilla/5.0 (X11; Linux x64) AppleWebKit/537.36 (KHTML, like Gecko) HappyDOM/0.0.0 is an User-Agent not JA4 digest, so you need to set the Rule accordingly

5

Thanks for the reply!

Just to clarify — I did create a User-Agent rule containing “HappyDOM” and set it to Deny, but the requests still appeared as Allowed in the logs.

That’s why I also tried a JA4 Digest rule afterward, but the result was the same.

Is there something I might be missing in the User-Agent rule setup?

Screenshot_3
Screenshot_31522×794 75.2 KB

6

Can you share the project link? Ja4 digest is a different value so it won’t work with User Agent:

image
image2298×746 52.9 KB

7

Sure, here’s the link: https://www.phrase-explorer.com/

8

I cannot see any rule set for HappyDOM UA? https://vercel.com/viacheslavs-projects-b8ed749d/phrase-explorer/firewall/configure

9

I had a JA4 Digest rule earlier but removed it after your clarification.

I haven’t re-added the User-Agent rule yet, because when I previously tried blocking by HappyDOM in the User-Agent string, the requests were still marked as Allowed.

10

It should work, let me know if it doesn’t

11

Thanks! I’ll create a User-Agent blocking rule for HappyDOM now and will check the logs tomorrow or in the next couple of days.

I’ll follow up once I see whether the requests are still coming through.

12

Sure thing! :slight_smile: Let us know how it oes.

1 Like