Anti-Bot

What Is Imperva Incapsula?

What Is Imperva Incapsula? — conceptual illustration
On this page

Imperva Incapsula is the enterprise WAF and bot-protection product from Imperva (acquired by Thales in 2023). It is heavily deployed across banking, healthcare, government, and B2B SaaS — sectors that adopted WAFs before the modern bot-management category existed. Detection is dominated by Layer 1 (TLS + IP reputation) and a lightweight Layer 2 JS challenge, making it one of the easier enterprise vendors to bypass with curl_cffi alone.

Quick facts

Detection cookiesincap_ses_*, visid_incap_*, nlbi_*
Response headerX-Iinfo (4-segment debug info), X-CDN: Incapsula
Common sectorsBanking, healthcare, government, enterprise SaaS
Challenge styleiframe-loaded "Request unsuccessful" page with reload script
Bypass difficultyLow–medium — JA4-correct + residential IP usually enough

How Incapsula scores a request

Incapsula scores at two layers. Layer 1 inspects TLS fingerprint, IP/ASN reputation, request rate, and the static User-Agent against a known-bot blocklist. A datacenter IP or an obviously-scraper UA gets blocked before any JS runs. Layer 2 is a lightweight JavaScript challenge served as an iframe with the message "Request unsuccessful. Incapsula incident ID: …" — the script sets the incap_ses_* cookie after running and reloads. Subsequent requests with the cookie pass.

The X-Iinfo response header carries a 4-segment debug code (e.g. 8-12345678-12345678 NNNN RT(...)) that exposes the policy that fired. This is useful for debugging but also a clear vendor tell — no other CDN emits this header.

What works and what doesn't

Doesn't work: datacenter IPs (blocked at Layer 1 regardless of fingerprint), Python requests with default TLS (JA3 mismatch), reusing an incap_ses_* cookie across different IPs.

Works: curl_cffi with impersonate="chrome131" + residential proxy passes most Incapsula deployments without ever loading the JS challenge. For deployments that force the challenge, a real browser session is enough — there is no behavioural ML to defeat.

Incapsula is the friendliest "real WAF" target on this list. The infrastructure is older than DataDome or Akamai's and the detection model hasn't kept pace. The risk is rate-limit — Incapsula deployments often pair the WAF with an aggressive request-rate rule, so successful scraping needs slow pacing rather than fingerprint perfection.

Telling Incapsula apart from generic WAFs

The X-Iinfo header alone identifies Incapsula. Even when not visible, incap_ses_* or visid_incap_* on a Set-Cookie are diagnostic — these names are unique to Incapsula and have been stable for years. The "Request unsuccessful. Incapsula incident ID" block page is the third tell. Older deployments also expose X-CDN: Incapsula.

Code example

python
# Incapsula is one of the easier enterprise vendors — curl_cffi + residential usually works
from curl_cffi import requests

s = requests.Session(impersonate="chrome131")
proxies = {"https": "http://user:pass@residential:port"}

r = s.get("https://target.com/api/data", proxies=proxies)

# X-Iinfo is the giveaway header
if "x-iinfo" in r.headers:
    print(f"Incapsula confirmed: {r.headers['x-iinfo']}")
print(f"status: {r.status_code}, bytes: {len(r.text)}")

Related terms

Anti-Bot Vendor Detection Cheatsheet
The first step of any scrape against a protected site is identifying which anti-bot vendor is in front of it. The vendor determines almost e…
What Is Anti-Bot Detection?
Anti-bot detection is the set of techniques websites use to distinguish automated traffic from human users — and to block, challenge, or thr…
What Is TLS Fingerprinting (JA3/JA4)?
TLS fingerprinting is a technique that identifies an HTTP client from its TLS handshake — before the server reads a single request byte. The…
What Is curl_cffi?
curl_cffi is a Python HTTP client that produces TLS fingerprints identical to real Chrome, Firefox, or Safari. It wraps curl-impersonate — a…
What Is a Residential Proxy?
A residential proxy routes your HTTP traffic through a real residential internet connection — a home broadband or fiber line — instead of th…
What Is F5 Shape Security?
F5 Shape Security is the most sophisticated anti-bot product on the market — F5 paid $1 billion to acquire Shape in 2020 and the price refle…

Concept map

How Imperva Incapsula connects

The terms most directly tied to this one. Hover a node to see its neighbours, click to preview, drag to rearrange.

0 terms · 0 connections
You are here · Anti-Bot
Building map…

Tools & solutions for this topic

Frequently asked questions

Is Incapsula the same as Imperva WAF?

Incapsula is the cloud-hosted product; Imperva WAF historically referred to the on-prem appliance. Since Imperva consolidated branding around 2020 the names are used interchangeably, and the cookie signatures are identical.

Why is Incapsula easier to bypass than Akamai or DataDome?

It predates the modern bot-management category. There is no behavioural ML, no WASM challenge, no multi-request trust accumulation. Layer 1 (TLS + IP) is the bulk of the detection, which curl_cffi handles by design.

What does the X-Iinfo header tell me?

It is a 4-segment debug code with the request type, account ID, policy that fired, and round-trip metrics. Customers use it to debug false positives. For scrapers it is mainly useful as a vendor identifier and to confirm whether the policy is rate-limit (RT) or fingerprint (NNNN).

Last updated: 2026-05-27