Shape Security: How It Blocks Web Scrapers
Shape Security is one of the hardest anti-bots to get through, and also one of the least visible. F5 bought it in 2020 and sells it today as F5 Distributed Cloud Bot Defense. Large airlines, banks and retailers put it in front of the requests that matter most to them: logins, account sign-ups, gift card and loyalty pages, checkouts.
Shape Security is not in our benchmark yet. None of the targets we scrape every month sits behind it, so there is no success rate, speed or cost to rank here. When a Shape-protected target joins the benchmark, this page will rank web scraping APIs against it the same way as our Kasada and Akamai pages.
Why Shape Security isn't benchmarked yet
Our benchmark measures public pages: product listings, search results, profiles. Shape is usually deployed on the endpoints behind those pages, where a request changes something (a login, a booking, a purchase) rather than on the pages a scraper reads. A benchmark of Shape would mean scraping logged-in or transactional flows, which we don't do.
What makes Shape Security hard to scrape
Polymorphic JavaScript. Shape's client script is rewritten on every page load: variable names, structure and the order of its checks change each time. A scraper can't study the script once and reproduce its output, because the next request runs a different one.
A virtual machine inside the page. The script runs its checks as bytecode inside its own interpreter, which makes reading what it collects slow and fragile work that breaks with the next version.
Signals sent with every protected request. The collected browser and behavior signals travel as a set of extra request headers with random-looking names. The server checks them before the request is allowed, and a request without valid headers is refused even if everything else about it looks right.
Behavior, not just fingerprints. Keystroke timing, mouse movement and the pace of a session are part of the signals, which is why Shape is so effective against credential stuffing and automated checkouts.
How to choose a web scraping API for Shape Security
Until we can measure it, judge a provider on the anti-bots closest to Shape in our benchmark. Akamai and Kasada also rely on obfuscated client scripts and sensor data, so an API that holds a high success rate on both is a better bet than one that only clears Cloudflare. Whatever you choose, test it on your own target first and count a success only when the response has the content you need.
Frequently asked questions about Shape Security
Is Shape Security the same as F5 Bot Defense?
Yes. F5 acquired Shape Security in 2020, and the product is now sold as F5 Distributed Cloud Bot Defense.
Which web scraping API is best for Shape Security?
We don't know yet, because no target in our benchmark is protected by it. We only publish rankings we have measured. The Kasada and Akamai rankings are the closest measured comparison.
Why is Shape Security harder than most anti-bots?
Because its script changes on every request and its checks run inside its own virtual machine, there is no stable target to reverse-engineer. A client has to run the script the way a real browser does.
Benchmarked anti-bots: Cloudflare · Akamai · DataDome · PerimeterX · Kasada · AWS WAF CAPTCHA · Castle · Hub: All anti-bot benchmarks