The six vendors at a glance
The table below maps the six dominant anti-bot vendors to their product category, how strongly each was observed to challenge default automated clients in independent 2026 benchmarking by Scrapeway, and the kinds of sites where each is commonly deployed. "Challenge strength" reflects how often unconfigured, default clients were challenged in that testing - not a judgement about security quality.
| Vendor | Product category | Challenge strength (observed) | Commonly seen on |
|---|---|---|---|
| Cloudflare | CDN with an optional web application firewall (WAF), Bot Management and Turnstile layers | High | ~20% of all websites; large e-commerce and jobs marketplaces (e.g. StockX, Indeed) |
| DataDome | Dedicated, EU-origin bot-management with DDoS protection; per-site ML scoring | High | E-commerce and marketplaces (e.g. Etsy) |
| PerimeterX (HUMAN) | Cloud security with DDoS and bot protection; leans heavily on AI behavioural analysis | High | E-commerce and real-estate marketplaces (e.g. StockX, Zillow) |
| Kasada | Dedicated bot-mitigation with DDoS protection; client-side code interrogation | High | Real-estate and ticketing sites (e.g. Realtor.com) |
| Akamai | Global CDN with a broad security suite, including Bot Manager | Moderate | Large enterprise e-commerce and media sites (e.g. StockX) |
| Imperva (Incapsula) | Cloud security with DDoS protection and a WAF/bot layer | Moderate | Enterprise sites and jobs marketplaces |
Category descriptions and the observed strength and deployment data come from Scrapeway (2026). The benchmark runs the same automated clients against 11 live targets at 1,000+ requests per service, refreshed twice a month per Scrapeway's published methodology; strength is grouped High/Moderate from those public results.
What the independent benchmarks show
Scrapeway, an independent benchmark that is not affiliated with any of these vendors, runs the same automated clients against live protected targets across 11 sites and republishes the results twice a month. Two patterns hold up across runs.
The strongest products separate sharply from the rest. Against Cloudflare-protected targets, only a small minority of default, unconfigured clients returned page content reliably; most were challenged on the majority of requests. DataDome, PerimeterX and Kasada landed in the same high-strength tier, while Akamai and Imperva were observed challenging default clients less often. This is why a tool that works against one vendor frequently stalls against another.
Strength is about coherence, not any single trick. The clients that scored well were the ones whose signals all agreed - TLS fingerprint, HTTP/2 framing, IP reputation, timezone and headers describing one consistent, real machine. A pile of individually-plausible edits that do not agree with each other is exactly what these systems are tuned to catch. Because the right configuration (TLS profile, proxy type, and whether a real browser is even needed) differs per vendor, teams working at volume with sites they are authorized to access often consolidate on a managed web-data API rather than maintaining six separate in-house integrations.
Why your approach has to change per vendor
Identifying the vendor tells you more about how to integrate with a permitted site than the site's own design does, because each product is built differently:
- Cloudflare runs at the CDN edge with one global ML model trained on roughly 20% of all internet traffic; the same hostname can range from no bot product at all to full Bot Management scoring.
- DataDome scores every request independently at the application layer with tens of thousands of per-site models, so IP reputation weighs heavily and behaviour varies from one customer site to the next.
- PerimeterX shares reputation across all of its customer sites, so a signal evaluated as suspect is evaluated network-wide rather than per-site.
- Kasada inspects client code with
Function.prototype.toString(), which is why runtime JavaScript patching behaves differently from source-level approaches. - Akamai often protects the web front-end while a brand's mobile API uses a lighter architecture, leaning on TLS-handshake and behavioural signals.
- Imperva (Incapsula) typically defaults to IP/WAF screening with a lighter behavioural layer than the dedicated bot-management products.
To tell which one sits in front of a given site, the fastest signal is the response cookie names and headers - see the anti-bot vendor detection cheatsheet for the one-response lookup table.