How to Set Up Windows Fonts on Linux for Anti-Bot Font Checks in CloakBrowser

To pass anti-bot font checks with CloakBrowser on Linux, install base emoji fonts like fonts-noto-color-emoji, copy authentic Windows TrueType fonts to a local directory, and launch the browser with the --fingerprint-fonts-dir flag pointing to that directory.

CloakBrowser from CloakHQ/CloakBrowser spoofs complete browser fingerprints to evade detection, but Linux environments often fail anti-bot checks when they cannot replicate Windows font rendering. When runtimes like Kasada or Akamai hash rendered emoji pixels, or when CreepJS enumerates system fonts, missing Windows typefaces reveal automation. Learning how to set up Windows fonts on Linux for anti-bot font checks ensures your CloakBrowser instance presents the same typographic signature as a genuine Windows machine.

Why Anti-Bot Systems Detect Missing Windows Fonts

Anti-bot services render hidden emojis or Unicode characters on an HTML5 canvas and hash the resulting pixel data. If the Linux environment lacks the specific fonts that a genuine Windows installation provides—such as Segoe UI, Calibri, or Bahnschrift—the resulting hash differs from expected values, flagging the session as automated.

According to the CloakHQ/CloakBrowser source, the ttf-mscorefonts-installer package is insufficient for modern detection scripts because it only supplies legacy XP-era fonts. Real-world Windows installations contain many additional TrueType fonts that advanced fingerprinting tools check for to verify a genuine environment.

Install Base Fonts for Canvas and Emoji Checks

CloakBrowser requires a base layer of open-source fonts that provide emoji and extended Unicode characters for canvas-based anti-bot detections. These packages are documented in the README at ¶ 638-642.

Run the following to install the required base fonts:

# 1️⃣ Install the base emoji/extended‑font packages (required for most anti‑bot sites)

#    – these packages are listed in the README [¶ 638‑642](https://github.com/CloakHQ/CloakBrowser/blob/main/README.md#L638-L642)

sudo apt install -y \
    fonts-noto-color-emoji \
    fonts-freefont-ttf \
    fonts-unifont \
    fonts-ipafont-gothic \
    fonts-wqy-zenhei \
    fonts-tlwg-loma-otf

These fonts satisfy the majority of anti-bot canvas checks by ensuring emoji characters render identically to Windows systems.

Add Authentic Windows Fonts for Font Enumeration

For sites using CreepJS or similar tools that enumerate available system fonts, you must provide native Windows TrueType files. These fonts remove the "missing-Windows-fonts" fingerprint mismatch that sophisticated checks detect.

Create a directory for the Windows fonts and copy the .ttf files from a legitimate Windows installation, as outlined in the README at ¶ 647-653:

# 2️⃣ (Optional) Copy real Windows fonts into a directory that Cloak Browser can read

#    – see the README [¶ 647‑653](https://github.com/CloakHQ/CloakBrowser/blob/main/README.md#L647-L653)

mkdir -p ~/.local/share/fonts/windows
cp /path/to/windows/fonts/*.ttf  ~/.local/share/fonts/windows/
cp /path/to/windows/fonts/*.TTF  ~/.local/share/fonts/windows/

# Refresh the font cache so the system recognises the new fonts

fc-cache -f

The fc-cache -f command refreshes the system font cache so CloakBrowser can access the new typefaces.

Launch CloakBrowser with the Font Directory Flag

CloakBrowser loads custom fonts via the --fingerprint-fonts-dir command-line argument, documented at ¶ 629. In cloakbrowser/config.py, this flag is passed through the default stealth argument generation when launching the binary.

Use the following Python pattern to point the browser at your Windows font collection:

# 3️⃣ Launch Cloak Browser and point it at the Windows‑font directory

#    – the binary flag is documented in the README [¶ 628‑630](https://github.com/CloakHQ/CloakBrowser/blob/main/README.md#L628-L630)

from cloakbrowser import launch

browser = launch(
    args=[
        "--fingerprint-fonts-dir=/home/$(whoami)/.local/share/fonts/windows"
    ]
)

# Use the browser as usual

page = browser.new_page()
page.goto("https://example.com")
print(page.title())
browser.close()

For Node.js/TypeScript implementations, the same flag is passed through the configuration layer in js/src/index.ts.

Summary

• Install base emoji fonts (fonts-noto-color-emoji, fonts-freefont-ttf, etc.) to pass canvas hashing checks from services like Kasada and Akamai.
• Copy authentic Windows TrueType fonts (Segoe UI, Calibri, Bahnschrift) to a local directory to defeat CreepJS font enumeration.
• Use the --fingerprint-fonts-dir flag when launching CloakBrowser to load the custom font directory.
• Avoid relying solely on ttf-mscorefonts-installer, as it only provides legacy XP-era fonts insufficient for modern anti-bot detection.

Frequently Asked Questions

Why is ttf-mscorefonts-installer not sufficient for anti-bot detection?

The ttf-mscorefonts-installer package only provides legacy fonts from the Windows XP era. Modern anti-bot scripts check for contemporary Windows fonts like Segoe UI and Calibri that are not included in that package, causing a fingerprint mismatch that reveals the Linux environment.

Can I use any .ttf files, or do they need to be from a specific Windows version?

You should use .ttf files from a genuine Windows 10 or Windows 11 installation to ensure the font metrics and glyph renderings match what anti-bot systems expect. Files must be copied to the directory specified in the --fingerprint-fonts-dir argument, and the system font cache must be refreshed with fc-cache -f.

Where is the --fingerprint-fonts-dir flag processed in the CloakBrowser source?

The flag is defined in the README at ¶ 629 and processed through cloakbrowser/config.py, which handles default stealth argument generation. When using the JavaScript wrapper, the flag is passed via js/src/index.ts when launching the underlying binary.

Do I need both base emoji fonts and Windows fonts?

Yes. The base fonts are required for canvas-based emoji rendering checks used by most anti-bot systems. The Windows fonts are optional but recommended for sites that perform aggressive font enumeration via JavaScript libraries like CreepJS. Providing both layers ensures comprehensive fingerprint coverage.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}