The state of the art is to remote-control a real browser now. Defeats all not-a-real-browser checks. You can even click on the cloudflare captchas.