How to Bypass Imperva (Incapsula) When Web Scraping

Imperva (now part of Thales) protects websites with a CDN, a web application firewall and bot detection, and is common on banks, airlines, government sites and large retailers. It is recognizable by its cookies: incap_ses and visid_incap from the classic Incapsula layer and reese84 from Imperva's Advanced Bot Protection, which blocks any request that doesn't carry a valid one. Its block page shows an "Incapsula incident ID".

Imperva is not in our benchmark yet. None of the targets we scrape every month sits behind it, so there is no success rate, speed or cost to rank here. Indeed and Instagram used to be listed as our Imperva targets, but neither shows an Imperva sign in the pages we save: Indeed is behind Cloudflare and Instagram runs Meta's own bot detection. When an Imperva-protected target joins the benchmark, this page will rank web scraping APIs against it the same way as our Akamai and Kasada pages.

What makes Imperva hard to scrape

Imperva has been in the anti-bot space longer than most. It started as a CDN and DDoS protection platform and built bot detection on top of a foundation that already had deep visibility into request traffic. That history matters because Imperva's detection does not rely on a single mechanism. It stacks multiple independent checks, and a scraper has to pass all of them.

IP and reputation layer. Imperva maintains its own threat-intelligence database built from years of traffic across thousands of protected sites. Datacenter IPs and known proxy ranges are flagged before the request is processed. Residential proxies are the entry requirement, not an advantage.

TLS fingerprinting. Imperva checks the TLS handshake for cipher-suite ordering, extension presence and ALPN values. A request from a plain HTTP client like requests produces a fingerprint that does not match any real browser, and Imperva flags it at the connection level.

JavaScript device checks. Imperva injects a JavaScript challenge early in the session to verify browser-environment details: user-agent consistency, screen properties, plugin presence and DOM-event timing. A headless browser that does not handle these correctly either fails the challenge outright or produces signals that trigger a block on the next request.

The reese84 cookie. On sites with Advanced Bot Protection, the challenge script posts its findings to Imperva and gets back a reese84 token, stored as a cookie. Every later request has to carry a valid, unexpired reese84; without one, or with a token from another session, the request is blocked. Because the token expires, a scraper has to keep solving the challenge during a long crawl, not just once.

Behavioral and session scoring. Imperva watches sessions over time, building a score from navigation patterns, request cadence and interaction timing. A session that passes the static checks but then scrapes at machine speed accumulates a poor behavioral score and gets blocked on subsequent requests.

The layered approach is why so many APIs that do well against simpler anti-bots fall apart against Imperva. Getting any single layer wrong is enough.

How to choose a web scraping API for Imperva

Until we can measure it, judge a provider on the anti-bots closest to Imperva in our benchmark. Akamai also layers IP reputation, fingerprinting, a JavaScript sensor and session scoring, so an API that holds a high success rate there is a better bet than one that only clears simpler protections. Whatever you choose, test it on your own target first and count a success only when the response has the content you need.

Frequently asked questions about Imperva

Which web scraping API is best for Imperva?

We don't know yet, because no target in our benchmark is protected by it. We only publish rankings we have measured. The Akamai ranking is the closest measured comparison.

How is Imperva different from Cloudflare?

Both are enterprise anti-bot platforms, but they weight detection differently. Cloudflare leans on JavaScript challenges (Managed Challenge, Turnstile) and HTTP/2 fingerprinting. Imperva puts more weight on session-level behavioral scoring and a deeper IP-reputation database built from its longer history. In practice, an API that clears Cloudflare reliably will not necessarily clear Imperva.

What is the reese84 cookie?

The token Imperva's Advanced Bot Protection sets after its JavaScript challenge. Every request has to carry a valid, unexpired reese84 cookie, or it is blocked, so a scraper has to run the challenge again whenever the token runs out.

Is Indeed protected by Imperva?

Not as we see it. None of the Indeed pages we save carries an Imperva cookie or script, and its challenge pages come from Cloudflare. Its ranking is on the Cloudflare page.

Benchmarked anti-bots: Cloudflare · Akamai · DataDome · PerimeterX · Kasada · AWS WAF CAPTCHA · Castle  ·  Hub: All anti-bot benchmarks