How to Scrape Past Akamai Bot Manager With Residential Proxies

Akamai Bot Manager gives every request a score from 0 (human) to 100 (bot). In Akamai's words it does so "looking at all anomalies, starting with the very first request". A residential proxy fixes one input to that score: the reputation of the address. On October 22, 2026, we sent a plain request with a Chrome user agent from a home internet connection to three stores Akamai guards. Home Depot and Kohl's answered 403 with a page titled "Access Denied". Lowe's answered 200, with a page titled "Access Denied".

This guide covers what Akamai checks, how to read its refusals and what our tests at 15 Akamai stores showed. Then it covers where Akamai runs, which exit country to pick, and the two ways to satisfy its sensor. Last comes what a browser job costs in residential traffic. We sell residential proxies, so we have a stake in the address part of the problem. The rest of the problem is most of this page.

Can residential proxies get past Akamai?

Not on their own. Akamai's documentation lists its detection methods, and only one family of signals is about the address. Transparent detection "looks for dozens of request anomalies like out-of-order headers and browser version mismatches". Active detection uses "an interaction to confirm the request is coming from a web browser typically used only by a person". Behavioral detection, in the Premier tier, watches movement and interaction on endpoints such as login and checkout. A residential address answers none of those three.

What it does answer is the reputation of the address, which is where datacenter ranges lose before anything else is read. That makes the residential address necessary for most Akamai targets and never sufficient.

How do you know Akamai refused you?

The status code can mislead, so read the page as well. Our three plain requests from a home connection, with Akamai's location and reference headers left out:

The signs to look for:

• Server: AkamaiGHost on a short page. The body reads "You don't have permission to access ... on this server" with a "Reference #18..." number. Our guide to Access Denied, Reference #18 decodes the number.
• A 200 that is a refusal. Lowe's sent a 5,036-byte page titled "Access Denied" with a success status. A scraper that checks only for 200 records it as data.
• Akamai's cookies, _abck, bm_sz and ak_bmsc, and headers such as X-Akamai-Transformed, which Lowe's response carried.
• Other codes. In our August test Dick's Sporting Goods answered a plain client with 451, and Zara served a JavaScript proof-of-work page to a home connection.

The 403 page is common enough to fill one of the most viewed Stack Overflow questions on the subject. "On many websites: 'Access Denied You don't have permission to access ... on this server'" has 10,147 views.

What Akamai checks

Akamai folds four kinds of evidence into the score. It publishes the score and the method families, and keeps the details to itself.

Address reputation

Akamai knows which networks an address belongs to and what it has done before. Hosting ranges start with a penalty because almost nobody shops from a server farm. This is the part a residential proxy moves. The Stack Overflow question "Scraping with Python getting blocked only on AWS instances" (4,145 views) is the classic symptom.

Handshake and headers

Before any script runs, your TLS handshake produces a fingerprint (JA3, or the newer JA4) from the cipher suites and extensions your client offers. Your HTTP/2 frames produce a second one: the SETTINGS values and pseudo-header order that Akamai's own researchers mapped in 2017. Akamai's transparent detection adds header order and version mismatches. A Python or Go client that claims to be Chrome contradicts itself here, on the first request. Our JA3 and JA4 explainer covers the formats.

The injected sensor and the _abck cookie

Akamai's product page describes the mechanism in one line: "Behavior anomaly detection is configured automatically by injecting a simple script into each monitored page." The script measures the browser and device and reports back, and the _abck cookie carries the resulting trust state. Akamai publishes neither what the script reads nor the cookie's format. Solver vendors fill some of the gap: Hyper Solutions says "Akamai needs around three sensor posts before the _abck cookie is trusted". The most viewed Stack Overflow question on Akamai asks exactly this, "What is the purpose of _abck and bm_sz?" (19,603 views), and our guide to how the _abck cookie works answers it.

Behavior

A customer can mark endpoints as transactional, such as login, signup and checkout. There the Premier tier evaluates "movement patterns and other interaction details unique to humans". Elsewhere, timing and navigation still feed the score.

A customer then maps score ranges to responses: monitor the low scores, challenge the middle, deny the top. Akamai also describes "serving cached content to bots instead of live site content". For a price scraper that is the dangerous one: a 200 with yesterday's prices.

What our tests at Akamai stores showed

On August 24, 2026, we sent one plain request to 52 US retail storefronts from a home line and from a datacenter server. It carried a desktop Chrome user agent and no JavaScript. Akamai was the main defense on 23 of them, more than any other vendor. Fifteen of those store pages report both results:

Three lessons sit in those numbers. The address alone decided almost nothing: ten stores refused the home connection too. A homepage that loads proves little. The four stores that served one also set Akamai's sensor cookies on the way in, and the score keeps running after the first page. The one split result, Zara, answered the datacenter request with a Service Unavailable page and the home request with a puzzle. The two requests also came from two separate clients, and our controlled test at Cloudflare stores shows the client alone can change an answer, so Zara does not prove the address decided. The retail bot-defense study lists every store and vendor.

Where Akamai runs, and which exit country to pick

Wappalyzer, which detects the technology behind websites, tracks 200,000 live websites running Akamai Bot Manager. Among the most visited are Hotstar, Flipkart, Rakuten, Uniqlo, QuickBooks, Funda, Airbnb, Naukri and Disney+. Two thirds of the sites are in the United States:

For most Akamai targets that means a US residential exit, and for US retailers often more than that. Lowe's assigns you a store from your address on the first response. The price you see follows the store, as our Lowe's guide shows. Every one of our residential pools targets by country, and Residential Premium adds state, city and ISP targeting for stores that price by location. Match the browser's language and time zone to the exit, too. A US address with a German-language browser is a mismatch the score can read.

Sticky sessions, not blind rotation

The sensor builds trust over several posts, and on many sites a session token rides beside _abck. Hyper Solutions calls it State-Based Scraping Detection, a "session-bound token that Akamai tracks across requests". It warns that "A missing or stale token triggers 429 rate-limit blocks even when _abck looks valid". Changing the exit address halfway through that session throws the work away. The pattern that follows:

• One sticky exit per session. Hold one residential address for the length of a browsing flow, so the cookies, the address and the browser stay together. Our sticky and rotating sessions guide shows how sessions are set.
• A static ISP address for logged-in work. An account that logs in from one place every day is better served by an ISP proxy, whose exit does not change at all.
• Rotate between sessions. A new session gets a new address, a new browser context and an empty cookie jar.

Two ways to satisfy the sensor

The sensor is the part that most separates Akamai from a plain firewall, and there are two ways to answer it.

Run a real browser

A patched Playwright, Puppeteer or anti-detect browser runs Akamai's script the way the script expects, and a genuine browser fingerprint comes with it. It works on targets nobody has reverse-engineered, and it renders the page you probably need anyway. The cost is a cold start per session, hundreds of megabytes of memory per worker, and full page weight on every fetch. Behind a residential proxy billed per GB, that is a real line item. The cost section below prices it. Stack Overflow's "Headless Puppeteer - Avoid being detected by Akamai" (5,190 views) is the usual first wall. A stock headless build carries tells the sensor reads.

Generate the sensor payload with a solver

The alternative skips the browser. You fetch the page with your own client and hand the challenge context to a solver API. You get back the payload the sensor would have produced, and post it to the target yourself. Hyper Solutions is the specialist here. Its product page lists sensor data for v2 and v3, SBSD and SEC-CPT, where Akamai "serves a SEC-CPT page with a crypto puzzle plus a mandatory wait duration". That puzzle is the proof-of-work page Zara served our home connection in August.

Two details of that route matter for anyone running proxies:

• You still make every request. A solver hands back a payload. Your proxies, your session, your cookie jar and your bandwidth carry the traffic, and that sets it apart from a scraping API.
• The payload belongs to one exit address. Hyper Solutions' documentation describes the IP parameter as "The egress IP the payload is generated for. Must match your request exit IP." Sticky sessions stop being a preference and become a requirement. Our guide to proxy setup for antibot solver APIs covers the pairing.

Neither route removes the other signals. A solver produces sensor data; your handshake, your header order, your pacing and your address stay your problem.

What an Akamai job costs in residential traffic

Residential proxies bill per GB, and the browser route moves whole pages. At the HTTP Archive's October 2024 medians, a desktop page weighs 2,652 KB. Of that, 1,054 KB is images and 18 KB is the HTML. One GB carries about 377 full desktop page loads. At our one-GB residential price of $0.50 per GB, 1,000 desktop pages come to about 2.65 GB, or $1.33, before caching.

Blocking images would cut that bill by the largest share, and Akamai has an opinion about it. Its docs say bots "may skip fluff like images and style sheets, which human requests include". The line sits in a list of what its reports show customers. A browser that never asks for an image saves traffic and looks less like a person. Test the trade on your target before you rely on it. Solver APIs move request-sized traffic instead, which our headless browser bandwidth cost page compares with the browser route.

The half proxies cannot touch

A proxy forwards your bytes untouched. If those bytes carry a Python handshake, no executed sensor and machine-even timing, a residential address means Akamai refuses a residential address.

A setup that gets through

None of this is a single trick. Getting past a real Akamai deployment means lining up every signal:

1. Exit from a residential or mobile address in the site's country. Pick the right state or city when the store prices by location, with one sticky session per flow.
2. Answer the sensor with a real browser that runs Akamai's script, or with a solver payload generated for your exit address.
3. Make everything agree. The user agent, the TLS and HTTP/2 fingerprint and the header order should describe one plausible person. So should the language, the time zone and the exit country.
4. Pace like a person. Randomized delays, real time on each page, no even intervals, and extra care on login and checkout, where the behavioral models watch most closely.
5. Keep the session's cookies, _abck and its companions, with its address, and start clean for the next session.
6. Check what you received. Read the title and size of every response: a 200 can be a refusal, and Akamai can serve cached content to bots.

Test before you scale

Before you point a real job at an Akamai site, confirm your exits are alive and residential with our IP lookup and proxy checker. Then run one full session against one page and read what came back. Check the status, the page title, the size, and whether _abck was set. One identity tested end to end tells you which signal is failing. That is the only way to fix the right one before you buy more proxies you did not need.

When the wall is not your problem to solve

Everything above assumes you have to get through Akamai yourself. If we already run endpoints for the platform, our scraper APIs return the data as JSON from one call. The Akamai layer is then our problem instead of yours. Building a bypass is worth the engineering time for targets nobody has solved yet.

Limits of this guide

We ran no bypass tool, stealth browser or solver against Akamai, and we tested no proxy's success rate on it, ours included. Our requests were plain clients, so they show what fails, never what passes. The October captures cover three stores on one day, and the August results the 15 of 23 Akamai stores whose pages report both addresses. Akamai does not publish what its sensor reads, the cookie format or how the score is weighted. Wappalyzer's counts are its detections on the sites it crawls. Akamai's product page refused our plain reader, so its quotes were read with a browser-grade fetcher the same day. We will re-read the sources by January 22, 2027.

Sources

• Akamai, Bot Manager product page, read October 22, 2026. It covers the 0 to 100 score from the first request, the injected script, "visibility into more than 40 billion bots a day", and cached content served to bots.
• Akamai TechDocs, read October 22, 2026: Detection methods (updated March 1, 2026), Handle adversarial bots (September 30, 2026) and About bots (March 1, 2026).
• Our requests: a plain curl request with a Chrome 141 user agent from a home line to homedepot.com, kohls.com and lowes.com, October 22, 2026, 12:10 UTC. The retail bot-defense study of August 24, 2026, with the results published on each store's page.
• Wappalyzer, Akamai Bot Manager technology page, read October 22, 2026: live website count, most visited sites and country split.
• HTTP Archive, Web Almanac 2024, Page Weight, medians of the October 2024 crawl.
• Stack Overflow questions about _abck and Akamai scraping, read through the Stack Exchange API on October 22, 2026: views and dates as quoted.
• Hyper Solutions, Akamai solver product page, read October 22, 2026. It names around three sensor posts before _abck is trusted, SBSD and its 429 blocks, SEC-CPT, sensor v2 and v3, and the exit IP the payload must match. Provenance: they sell Akamai bypass tooling, so they have a commercial interest in the system reading as both formidable and beatable. The technical detail is specific and nobody else publishes it, which is why those claims stay on this page. Weigh the framing with that interest in mind. Not linked here.
• Akamai: Passive Fingerprinting of HTTP/2 Clients: the HTTP/2 fingerprint, from Akamai's own research.
• JA3 (Salesforce) and JA4 (FoxIO): the TLS ClientHello fingerprints your client has to match.