Best Web Scraping APIs to Bypass Castle: September 2026 Benchmark
Scrapfly is the best web scraping API for bypassing Castle, with a 98% success rate across 5 web scraping APIs benchmarked against live Castle-protected sites in September 2026. 1 of the 5 cleared above 90%. The benchmark is refreshed once a month, with no sponsors and no affiliate links.
Castle protects accounts rather than pages. Sites load its JavaScript SDK to fingerprint the browser and send every login, sign-up and other account event to Castle's risk API, which answers allow, challenge or deny. It is built to stop credential stuffing, fake accounts and automated abuse, and it scores the session behind each request rather than looking at one request on its own.
Ranked by live Castle success rate, best first:
- 🥇 Scrapfly: 98% success on Castle
- 🥈 Firecrawl: 74% success on Castle
- 🥉 Scrapingdog: 74% success on Castle
Top 5 web scraping APIs for Castle, ranked
Castle protects one benchmark target, X (Twitter), whose web client carries Castle's public key and settings in every page we save. X also has its own rate limits and login wall, so the ranking measures getting X's public pages through all of it. Its per-target ranking is on the X page.
Ranking history: web scraping APIs vs Castle over time
The 5 web scraping APIs for Castle, reviewed
1. Scrapfly: 98% success on Castle
| Success | Speed | Cost/1k | Overall | From |
|---|---|---|---|---|
| 98% | 11.3s | $0.67 | #1 of 5 | $30/mo |
Scrapfly cleared 98% of requests to Castle-protected pages at $0.67 per 1,000 successful requests and averaged 11.3s per request this run. It gets the page content on nearly every request, so its sessions look trustworthy enough not to be challenged or cut off.
Pros:
- Highest success rate in the benchmark at 98%
- Cheapest cost per successful request among reliable providers at $0.67/1k
- Fastest reliable provider at 11.3s
2. Firecrawl: 74% success on Castle
| Success | Speed | Cost/1k | Overall | From |
|---|---|---|---|---|
| 74% | 8.2s | $24.90 | #2 of 5 | $16/mo |
Firecrawl cleared 74% of requests to Castle-protected pages at $24.90 per 1,000 successful requests and averaged 8.2s per request this run. It gets through on part of the traffic, so plan for retries and check the content of every response.
Pros:
- Reasonable speed at 8.2s
Cons:
- Clears only 74.4%, below the 90% bar and too inconsistent for production
3. Scrapingdog: 74% success on Castle
| Success | Speed | Cost/1k | Overall | From |
|---|---|---|---|---|
| 74% | 1.3s | $1.00 | #3 of 5 | $40/mo |
Scrapingdog cleared 74% of requests to Castle-protected pages at $1.00 per 1,000 successful requests and averaged 1.3s per request this run. It gets through on part of the traffic, so plan for retries and check the content of every response.
Pros:
- Fastest API in the test at 1.3s
Cons:
- Clears only 74%, below the 90% bar and too inconsistent for production
4. WebScrapingAPI: 68% success on Castle
| Success | Speed | Cost/1k | Overall | From |
|---|---|---|---|---|
| 68% | 19.3s | $2.45 | #4 of 5 | $19/mo |
WebScrapingAPI cleared 68% of requests to Castle-protected pages at $2.45 per 1,000 successful requests and averaged 19.3s per request this run. It gets through on part of the traffic, so plan for retries and check the content of every response.
Cons:
- Slow at 19.3s, better suited to batch than real-time work
- Clears only 67.6%, below the 90% bar and too inconsistent for production
5. ZenRows: 17% success on Castle
| Success | Speed | Cost/1k | Overall | From |
|---|---|---|---|---|
| 17% | 10.7s | $6.90 | #5 of 5 | $69/mo |
ZenRows cleared 17% of requests to Castle-protected pages at $6.90 per 1,000 successful requests and averaged 10.7s per request this run. Most of its requests come back without the content, so it is not a fit for this target right now.
How Castle detects bots
A browser fingerprint with every event. Castle's JavaScript SDK collects device and browser signals in the page and turns them into a request token that the site sends along with a login, a sign-up or another account event.
A risk decision on the server. The site's backend passes the token, the IP address and the request headers to Castle's API, which returns a risk score and a recommended action: allow, challenge (for example with a one-time code or a CAPTCHA) or deny. A request without a valid token is itself a strong signal.
Context across attempts. Castle looks at a user's history and at patterns across many accounts: the same device trying many accounts, many sign-ups from one network, or an account suddenly used from a new device and country.
How to choose a web scraping API for Castle
Start with the providers still clearing the Castle target this run (the top of the ranked table), then choose within that set.
- Reliability first. Scrapfly leads on Castle this run. Castle scores sessions over time, so a provider that keeps its success rate across a whole run matters more than one good request.
- Cost or speed. Among the providers still clearing it this run, sort the table by cost per successful request or by speed and pick accordingly.
Judge on cost per successful request measured on the content, not on the headline price per request: a blocked or empty response costs the same on most plans.
How we benchmark web scraping APIs against Castle
Every API is tested against the same live Castle-protected URLs at the same time, 1,000+ requests per provider, once a month. We pay for the plans ourselves. No affiliate links, no sponsors, no providers with early access to results. A request only counts as a success when the response contains the expected page content. Latest data: Sep 11 – Sep 25, 2026.
Frequently asked questions about Castle
Can web scraping APIs get past Castle in 2026?
Several can on public pages. In this benchmark, 1 cleared above 90% and 4 cleared above 50% of requests to the Castle-protected target.
Does Castle block web scrapers on public pages?
Castle is built around account events such as logins, sign-ups and payments. On a site like X it runs inside the web client next to the site's own rate limits and login wall, so a scraper of public pages meets all of it at once.
How often is this benchmark updated?
Once a month against the same live targets, 1,000+ requests per API each run.
Conclusion
Castle scores sessions rather than single requests, and decides on every account event whether to let it through. If the target is Castle-protected, start with Scrapfly for the highest reliability, and for cost or speed, choose among the providers still clearing it this run. The benchmark refreshes once a month, so check it before committing.
Other anti-bots: Cloudflare · Akamai · DataDome · PerimeterX · Kasada · Imperva · AWS WAF CAPTCHA · Castle targets: X (Twitter) · Hub: All anti-bot benchmarks