Getting started
unmask is a bot challenge built on JA4 TLS fingerprints and other signals. Start with install (pick OS × HTTP server to get the exact commands).
Whether JA4 is available depends on where TLS terminates and how unmask is deployed (nginx native module / gateway container). Find your setup and the topics here:
- JA4 acquisition — table of JA4 availability per setup pattern (the old “deployment topologies” live here)
- LB / CDN setup — getting JA4 from a front LB / CDN (GCP / Cloudflare / AWS etc.)
- Verified crawlers — stopping UA-spoofed crawlers: why the address decides, not the name
- Advisor — mechanically extracted ban candidates with their evidence, an optional model layer, and a scheduled digest
- Supported distros — the OS × HTTP server matrix
- Backup & restore — back up config / DB / bans, restore on a new host
- Containers — the one image (nginx with the module, plus the daemon), docker compose / docker run quick start, and the gateway mode that puts unmask in front of any HTTP server
- FAQ — common operational questions, including monitoring (Prometheus / healthz) and keeping the crawler ranges current on a host without outbound HTTPS