Best Web Scraping APIs to Bypass AWS WAF CAPTCHA: September 2026 Benchmark

Scrapfly is the best web scraping API for bypassing AWS WAF, with a 98% success rate across 7 web scraping APIs benchmarked against live AWS WAF-protected sites in September 2026. 2 of the 7 cleared above 90%. The benchmark is refreshed once a month, with no sponsors and no affiliate links.

AWS WAF is the web application firewall built into Amazon CloudFront, Application Load Balancer and API Gateway, so any site hosted on AWS can switch it on in a few clicks. Its Bot Control rules sort traffic by IP reputation, request headers and a browser fingerprint, then answer a suspicious client with one of two actions: a silent JavaScript challenge that a real browser passes without the visitor noticing, or a CAPTCHA puzzle that needs a person. Either way the page is only served once the client holds a valid aws-waf-token cookie.

Ranked by live AWS WAF success rate, best first:

1. 🥇 Scrapfly: 98% success on AWS WAF
2. 🥈 Firecrawl: 92% success on AWS WAF
3. 🥉 WebScrapingAPI: 87% success on AWS WAF

Top 7 web scraping APIs for AWS WAF, ranked

AWS WAF protects two benchmark targets: Amazon and Booking.com, whose blocked responses in our runs are AWS WAF challenge pages. The ranking below combines both; each target's own ranking is on its page.

#	Service	Success	Speed	Cost/1k		Code
1 🥇	Scrapfly	98%	14.7s	$1.46	(237) ★ 4.9	code
2 🥈	Firecrawl	92%	6.4s	$0.83	—	code
3 🥉	WebScrapingAPI	87%	18.6s	$2.45	—	code
4	Scrapingdog	50%	5.0s	$2.6	—	code
5	ScraperAPI	46%	16.7s	$3.68	(62) ★ 4.6	code
6	ScrapingBee	23%	5.0s	$1.79	(137) ★ 4.9	code
7	ZenRows	13%	7.5s	$3.45	(103) ★ 4.8	code

Data range Sep 11 – Sep 25

Ranking history: web scraping APIs vs AWS WAF over time

The 7 web scraping APIs for AWS WAF, reviewed

1. Scrapfly: 98% success on AWS WAF

Scrapfly cleared 98% of requests to AWS WAF-protected pages at $1.46 per 1,000 successful requests and averaged 14.7s per request this run. That means it gets a valid aws-waf-token on nearly every session, either by running the challenge in a real browser or by coming from IPs and fingerprints that Bot Control lets through without one.

Pros:

• Highest success rate in the benchmark at 98%
• Competitive cost per successful request at $1.46/1k

Cons:

• Slowest reliable provider at 14.7s

2. Firecrawl: 92% success on AWS WAF

Firecrawl cleared 92% of requests to AWS WAF-protected pages at $0.83 per 1,000 successful requests and averaged 6.4s per request this run. That means it gets a valid aws-waf-token on nearly every session, either by running the challenge in a real browser or by coming from IPs and fingerprints that Bot Control lets through without one.

Pros:

• Reliably clears AWS WAF CAPTCHA at 92%
• Cheapest cost per successful request among reliable providers at $0.83/1k
• Fastest reliable provider at 6.4s

Cons:

• 8% of requests still fail, so expect some retries

3. WebScrapingAPI: 87% success on AWS WAF

WebScrapingAPI cleared 87% of requests to AWS WAF-protected pages at $2.45 per 1,000 successful requests and averaged 18.6s per request this run. It gets through on part of the traffic: some sessions pass the silent challenge, others are handed a challenge or CAPTCHA page they don't clear, so plan for retries and check the content of every response.

Cons:

• Slow at 18.6s, better suited to batch than real-time work
• Clears only 86.8%, below the 90% bar and too inconsistent for production

4. Scrapingdog: 50% success on AWS WAF

Scrapingdog cleared 50% of requests to AWS WAF-protected pages at $2.60 per 1,000 successful requests and averaged 5.0s per request this run. Most of its requests end on an AWS WAF challenge or CAPTCHA page instead of the content, so it is not a fit for AWS WAF-protected targets right now.

5. ScraperAPI: 46% success on AWS WAF

ScraperAPI cleared 46% of requests to AWS WAF-protected pages at $3.68 per 1,000 successful requests and averaged 16.7s per request this run. Most of its requests end on an AWS WAF challenge or CAPTCHA page instead of the content, so it is not a fit for AWS WAF-protected targets right now.

6. ScrapingBee: 23% success on AWS WAF

ScrapingBee cleared 23% of requests to AWS WAF-protected pages at $1.79 per 1,000 successful requests and averaged 5.0s per request this run. Most of its requests end on an AWS WAF challenge or CAPTCHA page instead of the content, so it is not a fit for AWS WAF-protected targets right now.

7. ZenRows: 13% success on AWS WAF

ZenRows cleared 13% of requests to AWS WAF-protected pages at $3.45 per 1,000 successful requests and averaged 7.5s per request this run. Most of its requests end on an AWS WAF challenge or CAPTCHA page instead of the content, so it is not a fit for AWS WAF-protected targets right now.

What makes AWS WAF hard to scrape

AWS WAF is less a single anti-bot than a set of rules each site owner tunes. The same site can let a request through on one page and challenge it on the next, so results depend on which rules are switched on.

IP reputation. AWS ships managed rule groups that flag addresses from Amazon's own threat intelligence and from hosting providers, VPNs and proxies. Requests from datacenter IP ranges are the first to be challenged or blocked, before any fingerprinting happens.

The silent JavaScript challenge. The Challenge action returns a small interstitial page that loads AWS's challenge.js, collects a browser fingerprint and solves a small computation, then sets the aws-waf-token cookie and reloads the page. A real browser does this in about a second. A plain HTTP client never runs the script, so it never gets the token.

CAPTCHA puzzles. The CAPTCHA action asks for an image puzzle (or an audio one) to be solved before the token is issued. Sites usually reserve it for traffic Bot Control already finds suspicious, so a scraper that reaches the CAPTCHA has typically failed the quieter checks first.

Bot Control and token lifetime. The Bot Control rule group recognises common automation libraries and headless browsers, and in its targeted mode adds per-session rate limits and behavior checks. A token is only valid for a limited time set by the site, so a scraper has to keep passing the challenge rather than solve it once.

How to choose a web scraping API for AWS WAF

Start with the providers still clearing AWS WAF this run (the top of the ranked table), then choose within that set.

• Reliability first. Scrapfly leads on AWS WAF this run. On a target that switches between a silent challenge and a CAPTCHA, a provider that keeps its token valid across sessions saves the retries that eat up both time and credits.
• Cost or speed. Among the providers still clearing AWS WAF this run, sort the table by cost per successful request or by speed and pick accordingly.

AWS WAF challenge and CAPTCHA pages can come back with a 202 or 405 status, but a site can also serve them differently, so judge on cost per successful request measured on the content, not on the headline price per request.

How we benchmark web scraping APIs against AWS WAF

Every API is tested against the same live AWS WAF-protected URLs at the same time, 1,000+ requests per provider, once a month. We pay for the plans ourselves. No affiliate links, no sponsors, no providers with early access to results. A request only counts as a success when the response contains the expected page content; a challenge or CAPTCHA page counts as a failure whatever its status code. Latest data: Sep 11 – Sep 25, 2026.

Frequently asked questions about scraping AWS WAF

Can web scraping APIs bypass AWS WAF CAPTCHA in 2026?

Several can. In this benchmark, 2 cleared above 90% and 3 cleared above 50% of AWS WAF-protected requests. The rest failed most requests or all of them.

What is the aws-waf-token cookie?

It is the proof that a client passed AWS WAF's challenge or CAPTCHA. AWS's challenge.js sets it after the browser solves the challenge, and every following request has to carry it until it expires. Without a valid token, a protected page answers with the challenge again.

Do I need a headless browser to get past AWS WAF?

Usually yes. The token comes from running AWS's JavaScript, which a plain HTTP request cannot do. Some requests from clean residential IPs are let through without a challenge, but a scraper that depends on that breaks as soon as the site tightens its rules.

What's the cheapest web scraping API that works on AWS WAF?

Sort the ranked table by cost per successful request and read down to the first provider still clearing AWS WAF this run; that's the cheapest option that actually delivers.

How often is this benchmark updated?

Once a month against the same live targets, 1,000+ requests per API each run.

Conclusion

AWS WAF puts a JavaScript challenge, and for the most suspicious traffic a CAPTCHA, in front of any site hosted on AWS that turns it on. If the target is AWS WAF-protected, start with Scrapfly for the highest reliability, and for cost or speed, choose among the providers still clearing AWS WAF this run. Verify results on response content rather than status codes. The benchmark refreshes once a month, so check it before committing.

Other anti-bots: Cloudflare · Akamai · DataDome · PerimeterX · Kasada · Imperva · Castle  ·  AWS WAF targets: Amazon · Booking.com  ·  Hub: All anti-bot benchmarks