HTTP/2 Header Impersonation

Spoof HTTP/2 SETTINGS frames, pseudo-header ordering, and browser-specific HTTP headers to match real browsers at the protocol level. Targets the detection gap between TLS fingerprinting (ClientHello) and JavaScript fingerprinting — the HTTP/2 connection setup and header structure that anti-bot systems analyze. Matches Chrome, Firefox, Safari iOS, and OkHttp (Android) profiles with exact window sizes, header list limits, and header ordering.

When to Use

• TLS fingerprint is correct but target still detects non-browser HTTP behavior.
• Target uses HTTP/2-specific detection (SETTINGS frame analysis, pseudo-header order).
• Need browser-accurate sec-ch-ua, Accept, Accept-Encoding, Priority, and sec-fetch-* headers.
• Mobile API endpoints require Android OkHttp header profiles.
• Combining with TLS impersonation for a complete network-level browser profile.

Prerequisites

• terminal with python3.
• pip install impit (includes HTTP/2 impersonation via patched h2 library).
• Or standalone: use the header lists below to configure curl/httpx manually.

Quick Detection