The layered model
Real anti-scraping is not a single product but a stack. At the edge: WAF rules, rate limits, ASN blocklists. One layer in: TLS fingerprint validation, header consistency checks, HTTP/2 frame analysis. Inside the page: JavaScript challenges (proof-of-work, fingerprint collection), CAPTCHAs. After the page loads: behavioral analysis on mouse, scroll, and timing. A request that passes all five layers is treated as human. A request that fails any one is scored down — and persistent failures escalate the next request to a harder challenge.
How vendors compose
Cloudflare and Akamai handle the edge layers and JS challenges as a managed product. DataDome and Kasada specialize in the JS-VM and behavioral layers. Shape Security (F5) builds custom JS virtual machines that re-obfuscate on every deployment. Many sites stack two vendors — Cloudflare edge plus DataDome bot management is a common pairing. Bypassing one does not bypass the other; each vendor scores independently.
Matching response to the stack
The first question for a scraper is not "how do I bypass this?" but "is the data worth the bypass cost?" A simple rate limit costs hours of work to handle correctly. A stacked Cloudflare + DataDome + behavioral ML system can cost weeks of engineering and a recurring proxy bill measured in thousands per month. Managed scraping APIs amortize that cost across all their customers — usually cheaper than running an in-house stack above a certain volume.