How Akamai scores a session
Akamai checks you in two layers. The first is JA4+ at the EdgeWorker — code running on Akamai's edge servers. This fires before any HTML is sent, so a suspicious TLS handshake alone can get you blocked. Clear that layer and the page loads with sensor.js built right into it (inlined or nearly so). That script runs the deeper tests: a canvas hash (a fingerprint from drawing an image), the WebGL renderer (your GPU's name), AudioContext, navigator properties, the Battery API, and a probe that tries to fetch 60 known chrome-extension:// URLs. Real Chrome users almost always have a few extensions installed (uBlock Origin, 1Password, LastPass), so some of those fetches succeed; a headless browser has none, so all 60 fail at once — something that essentially never happens for a real person.
The script then POSTs everything it collected to /_bm/data. Only after that POST succeeds does _abck flip from ~-1~ to ~0~. Protected data endpoints (the XHR calls a page makes for content) check this cookie first — if it still says ~-1~, you get a 412 "Pardon Our Interruption" no matter what else looks right.
Which signals tend to flag a client
Signals that commonly draw a flag: headless Chrome (no real GPU, so the WebGL context is null), SwiftShader (its software-GPU device ID 0x0000C0DE is widely recognised), JavaScript patches whose Function.toString() output reveals they have been rewritten, Page.addScriptToEvaluateOnNewDocument injection (the CDP automation protocol leaves visible timing artifacts), datacenter proxies of any kind, and rotating residential IPs mid-session (this wipes out the trust accumulated so far).
Signals more consistent with a real client: a TLS handshake and HTTP/2 frame order that match a mainstream browser, a session that keeps one stable IP and one set of cookies, and a browser profile that actually has the extensions and GPU a real machine would have, so the 60-probe check sees the same mix a person's browser would. These are the same coherence properties that any legitimate browser session naturally exhibits.
Session hygiene that matters
Because Akamai scores you across many requests, it penalizes inconsistency harder than most vendors do:
- Use one ISP static residential IP for the whole session — never switch in the middle.
- Warm up first: visit the homepage, wait 2–3 seconds, scroll, then go to the data URL.
- Set
Accept-Languageto match the country your proxy is in. - Reuse cookies across requests — trust grows from keeping the same
_abckcookie going.