--- title: Block DDoS attacks with JA4 fingerprints | daily.dev description: The JA4 fingerprint, calculated from the TLS ClientHello handshake, can identify types of clients accessing a server without relying on spoofable headers like... canonical: https://daily.dev/posts/block-ddos-attacks-with-ja4-fingerprints-busfe6mca twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Block DDoS attacks with JA4 fingerprints | daily.dev og:description: The JA4 fingerprint, calculated from the TLS ClientHello handshake, can identify types of clients accessing a server without relying on spoofable headers like... og:url: https://daily.dev/posts/block-ddos-attacks-with-ja4-fingerprints-busfe6mca og:image: https://api.daily.dev/og/posts/BuSfe6MCA.png og:image:alt: Block DDoS attacks with JA4 fingerprints og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Block DDoS attacks with JA4 fingerprints **[ngrok Blog](https://daily.dev/sources/ngrok)** · 6 min read · 0 upvotes · 0 comments ## Summary The JA4 fingerprint, calculated from the TLS ClientHello handshake, can identify types of clients accessing a server without relying on spoofable headers like user-agent. It works for both HTTPS and secure TCP connections and can be used to mitigate DDoS attacks (via blocking or rate limiting by fingerprint) and to build allowlists for known device types, such as embedded devices with dynamic IPs. Using ngrok's Traffic Inspector and Traffic Policy, teams can identify fingerprints and apply deny or rate-limit actions upstream of the application. JA4 is not PII, is not a substitute for authentication, and was created by FoxIO as a more spoof-resistant successor to JA3 after Chrome's TLS handshake changes broke JA3's effectiveness. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between JA4 and JA3 TLS fingerprinting? JA4, developed by FoxIO as a successor to JA3, uses broader categories with less specificity but greater resistance to spoofing. JA3 became ineffective after Chrome introduced significant changes to how it presents the TLS handshake (TLS extension randomization), which crushed JA3's ability to differentiate between individual browser versions. JA4 was designed specifically to cope with those changes. _daily.dev surfaces security deep dives like TLS fingerprinting for teams building anti-abuse defenses._ ### Can a JA4 TLS fingerprint be used to authenticate a user? No, a JA4 TLS fingerprint is not a standalone security solution and should not be used as authentication. It identifies a pool of traffic sharing similar client characteristics rather than a specific user or device, so it's recommended to pair it with real authentication methods like OAuth, OpenID, or Basic Auth for actual identity verification. _Developers weighing traffic-filtering versus authentication layers can track these tradeoffs on daily.dev._ ### Why would a JA4 fingerprint show up as None for a connecting client? A JA4 fingerprint is set to None when the connection isn't made over TLS, since there's no security protocol negotiation to fingerprint. This happens with TCP-powered applications that prioritize speed and low latency over encryption, or that already fully encrypt their data before connecting, making an additional TLS layer unnecessary. _Engineers debugging traffic inspection gaps can find practical networking breakdowns on daily.dev._ ## Similar posts on daily.dev - [Strengthening Bot Detection with JA4 Signals](https://daily.dev/posts/strengthening-bot-detection-with-ja4-signals-qdkfvhbol) · Auth0 · 0 upvotes · 0 comments - [Smarter DDoS security at scale](https://daily.dev/posts/smarter-ddos-security-at-scale-ujbkyiixv) · CSO Online · 0 upvotes · 0 comments - [Your Python Scraper Has a Tell. curl-cffi Is How You Hide It.](https://daily.dev/posts/your-python-scraper-has-a-tell-curl-cffi-is-how-you-hide-it--kvgbda2le) · ITNEXT · 0 upvotes · 0 comments - [Credential Stuffing: A Defender’s Guide to Detecting Automated Login Attacks](https://daily.dev/posts/credential-stuffing-a-defender-s-guide-to-detecting-automated-login-attacks-wqhb4uiu9) · Latest Hacking News · 0 upvotes · 0 comments - [Detecting forged browser fingerprints for bot detection, lessons from LinkedIn](https://daily.dev/posts/detecting-forged-browser-fingerprints-for-bot-detection-lessons-from-linkedin-aexf1f1ca) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#devtools](https://daily.dev/tags/devtools) [View this post on daily.dev](https://daily.dev/posts/block-ddos-attacks-with-ja4-fingerprints-busfe6mca) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Block DDoS attacks with JA4 fingerprints","url":"https://daily.dev/posts/block-ddos-attacks-with-ja4-fingerprints-busfe6mca","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/block-ddos-attacks-with-ja4-fingerprints-busfe6mca"},"datePublished":"2026-08-23T07:20:33.501Z","dateModified":"2026-08-23T07:24:39.237Z","description":"The JA4 fingerprint, calculated from the TLS ClientHello handshake, can identify types of clients accessing a server without relying on spoofable headers like...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b043f9f97662874afdbc4e8e26de8f1a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b043f9f97662874afdbc4e8e26de8f1a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/block-ddos-attacks-with-ja4-fingerprints-busfe6mca","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devtools","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Block DDoS attacks with JA4 fingerprints"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/block-ddos-attacks-with-ja4-fingerprints-busfe6mca#faq","mainEntity":[{"@type":"Question","name":"What is the difference between JA4 and JA3 TLS fingerprinting?","acceptedAnswer":{"@type":"Answer","text":"JA4, developed by FoxIO as a successor to JA3, uses broader categories with less specificity but greater resistance to spoofing. JA3 became ineffective after Chrome introduced significant changes to how it presents the TLS handshake (TLS extension randomization), which crushed JA3's ability to differentiate between individual browser versions. JA4 was designed specifically to cope with those changes. daily.dev surfaces security deep dives like TLS fingerprinting for teams building anti-abuse defenses."}},{"@type":"Question","name":"Can a JA4 TLS fingerprint be used to authenticate a user?","acceptedAnswer":{"@type":"Answer","text":"No, a JA4 TLS fingerprint is not a standalone security solution and should not be used as authentication. It identifies a pool of traffic sharing similar client characteristics rather than a specific user or device, so it's recommended to pair it with real authentication methods like OAuth, OpenID, or Basic Auth for actual identity verification. Developers weighing traffic-filtering versus authentication layers can track these tradeoffs on daily.dev."}},{"@type":"Question","name":"Why would a JA4 fingerprint show up as None for a connecting client?","acceptedAnswer":{"@type":"Answer","text":"A JA4 fingerprint is set to None when the connection isn't made over TLS, since there's no security protocol negotiation to fingerprint. This happens with TCP-powered applications that prioritize speed and low latency over encryption, or that already fully encrypt their data before connecting, making an additional TLS layer unnecessary. Engineers debugging traffic inspection gaps can find practical networking breakdowns on daily.dev."}}]} ```