How to Scrape Past Imperva (Incapsula) With Residential Proxies

Imperva handles a doubtful request in steps. It names the client first, then can ask for a cookie, a JavaScript token or a CAPTCHA, in that order. A residential proxy changes one input to those steps: the address. On October 22, 2026, we sent a plain request with a Chrome user agent from a home internet connection to three sites behind Imperva. All three answered 200 OK. Only one of them sent a real page.

This guide covers how to read Imperva's answers, what it checks and what our requests got. It also covers where Imperva runs, the two ways to answer its scripts, and what a browser job costs in residential traffic. We sell residential proxies, so we have a stake in the address part of the problem. The rest is most of this page.

Can residential proxies get past Imperva?

Not on their own. Imperva's product page describes a "multi-layered approach to detect malicious bots". It combines "direct client interrogation, behavior analysis, machine learning (ML), connection characteristics, and threat intelligence feeds". An address can move the connection and threat intelligence parts. Client interrogation and behavior read the program you run and how it acts.

Its own docs name two places where the address counts. A site can block sources by country and IP. And the CAPTCHA a client meets, hCaptcha, reCAPTCHA or GeeTest, depends on the site's setup and "the client IP geolocation". Our requests show the limit. The home address did not stop Pokemon Center's challenge, and a datacenter server got 7-Eleven's real homepage in August.

How do you know Imperva answered you?

Imperva rarely sends a plain client a clean 403. Our three requests, with cookie values, site ids and anything that could carry our address cut:

The signs to look for:

• Imperva's cookies. visid_incap_ and incap_ses_ followed by a site number, sometimes nlbi_ too. Imperva documents the first: it uses visid_incap "To correlate HTTP sessions to specific visitors to your sites".
• Its headers. X-CDN: Imperva, and X-Iinfo, which Imperva's documentation describes as a header "used by Imperva to track and troubleshoot caching of resources".
• A script or frame from /_Incapsula_Resource. All three of our pages loaded one. On Coles it was the whole page.
• A 200 that is a challenge. Pokemon Center's 1,048 bytes held a frame reading "Request unsuccessful. Incapsula incident ID" and a number. A scraper that checks only the status saves that as data.
• "Pardon Our Interruption". The title of the bot check page Pokemon Center showed our server in September 2026. It named disabled JavaScript or cookies and browsing "with super-human speed" as the usual causes.

The 200 trap is old. "POST request works in Postman, but not in Python Requests (200 response with robot detection)" has 22,861 views on Stack Overflow.

What do Imperva's error codes mean?

An Imperva error page carries a code, and the vendor's own table explains each one. The page also shows the visitor's IP address and an incident ID the site owner can look up. The docs add that the code travels in a field named edet: Pokemon Center's frame address carried edet=12.

Codes 14 to 17 are blocks. The table adds that once a user or IP is blocked, the later requests of that session fail too. Code 12 is a question your client can still answer.

What does Imperva check?

Imperva publishes much of its first layer and almost nothing of its bot product. The public pages cover the client list, the challenges and the error codes. The docs of its Advanced Bot Protection are "available to authorized users upon login".

The client you send

Imperva classifies every client first. In its words, the classification "can tell whether your website visitors are humans or bots". The result decides whether to challenge, alert or block. Its public list names 965 clients in 15 types. Common scraping tools land here:

The vendor describes the HackingTool type broadly: "All tools that can be programmed for any purpose, malicious or not". A client it cannot name becomes a "Suspected Bot", which a site can send to a CAPTCHA or other challenges. Setting a Chrome user agent on a Python client does not settle it either. Hyper Solutions, which sells an Imperva solver, says the TLS handshake and header order are checked too, and that "HTTP libraries betray automation here". Our JA3 and JA4 explainer covers the handshake fingerprint.

The challenges

For a client it doubts, Imperva climbs a ladder. Its docs list three steps: a cookie to store and send back, a script to run, and a CAPTCHA. The script is a test "that the browser must execute to generate a validation token". A client that fails one step gets the next.

Two details matter for scrapers. A client that passed a challenge "can still receive a stricter one later", for example when its request rate trips a rule. And once a client passes a CAPTCHA, Imperva issues no further progressive challenges in that session, though a custom rule can still ask again. Imperva also says legitimate users "are not served a CAPTCHA on 99.999% of requests" where customers choose it as a response. A scraper that meets one on most pages has already been sorted out of that group.

The bot product's scripts

Past the public challenges, the docs stop. The names in circulation come from responses and solver vendors. A reese84 cookie is set through a sensor script, and a ___utmvc cookie by a second script. Hyper Solutions' account of both is in the solver section below.

Behavior

Imperva lists behavior analysis and machine learning among its detection layers. The Pokemon Center check page named one behavioral cause outright: moving through the site "with super-human speed".

What did our requests at Imperva sites get?

Three answers with the same status told three different stories:

• Pokemon Center sent the challenge page with error code 12. Its script stores a value named distil_referrer, after Distil Networks, the bot company Imperva bought in 2019. In September the store showed our server a "Pardon Our Interruption" page or a 403 instead, as our Pokemon Center guide records.
• Coles, an Australian supermarket, sent an empty page with one script. No content reaches a client until a browser runs it.
• 7-Eleven sent its real homepage, with the vendor's cookies and script on the page. In August a datacenter server in Germany got the same homepage, with PerimeterX scripts beside Imperva's, as our 7-Eleven guide shows.

A homepage that loads proves little, because the script on it keeps working on the pages after. In our retail bot-defense study of August 24, 2026, Imperva was the main defense at 1 of 52 US stores. Its home ground is elsewhere.

Where does Imperva run, and which exit country should you pick?

Wappalyzer, which detects the technology behind websites, tracks 99,000 live websites using Imperva. Its most visited are rarely shops: French government services, Chilean and Colombian banks, and the Spanish newspaper El Confidencial. By industry, insurance agents hold 23% of the sites Wappalyzer classifies, hotels 9% and banks 8%.

A US exit fits most targets, but four in ten sites are elsewhere. The country matters twice at Imperva: a site can block whole countries, and Imperva picks the CAPTCHA provider by the client IP's location. Every one of our residential pools targets by country, and Residential Premium adds state, city and ISP targeting. Match the browser's language and time zone to the exit, too.

Why keep one exit per session?

Imperva follows a visitor through cookies: visid_incap exists "To correlate HTTP sessions to specific visitors". Keep the address steady while a session runs, because a solver's payload is made for one address. Hyper Solutions defines its ip field as "The egress IP the payload is generated for. It must match the IP your target request exits from". Its FAQ names "an IP mismatch, a rotated user-agent" as usual reasons valid sensor data still gets blocked.

The pattern that follows:

• One sticky exit per session. Hold one residential address for a whole browsing flow, so the cookies, the address and the browser stay together. Our sticky and rotating sessions guide shows how sessions are set.
• A static ISP address for logged-in work. An account that signs in from one place every day is better served by an ISP proxy, whose exit does not change.
• Rotate between sessions. A new session gets a new address, a new browser context and an empty cookie jar.

What are the two ways to answer Imperva's scripts?

The cookie and JavaScript steps are where most scrapers stall, and there are two ways through them.

Run a real browser

A real browser runs Imperva's JavaScript the way the script expects and keeps its cookies. A hardened Playwright or Puppeteer, or an anti-detect browser, also renders the page you probably need anyway. A stock headless build starts behind, since the client list files Headless Chrome as a HackingTool. Stack Overflow's "How do I avoid imperva bot detection?" (5,058 views) is the Selenium version of that wall. The cost is memory per worker and full page weight per fetch, which the cost section prices.

Generate the payloads with a solver

The alternative skips the browser. Hyper Solutions sells an API for it, and its product page describes the scripts in more detail than Imperva does in public:

• The reese84 sensor. "A hidden JavaScript sensor collects device, canvas and timing entropy, then expects a signed reese84 payload posted back". It fires "On virtually every Incapsula-protected endpoint".
• The ___utmvc gate. "The ___utmvc cookie is only issued after a rotating, obfuscated challenge script is executed correctly". Hyper adds that "Re-implementing the sensor by hand breaks on every Imperva update". "Some sites use one, some use both".
• A CAPTCHA on top. "When trust is low, Incapsula can fall back to a third-party captcha such as hCaptcha or GeeTest inside an iframe instead of the page", "typically after repeated automated-looking requests or from a flagged IP range". Hyper does not solve those. Our guides to solving hCaptcha when scraping and solving GeeTest cover that half.

Two details of that route matter for anyone running proxies:

• You still make every request. The solver returns a payload; your proxy, your session, your cookie jar and your bandwidth carry the traffic.
• The payload belongs to one exit address, as the ip field above says. Sticky sessions become a requirement. Our guide to proxy setup for antibot solver APIs covers the pairing.

What does an Imperva job cost in residential traffic?

Residential proxies bill per GB, and the two routes move very different amounts. A challenge page is tiny: Coles sent 212 bytes, Pokemon Center 1,048. A browser that passes the challenge then loads the whole page. At the HTTP Archive's October 2024 medians, a desktop page weighs 2,652 KB. Of that, 1,054 KB is images and 18 KB is the HTML. One GB carries about 377 full desktop page loads. At our one-GB residential price of $0.50 per GB, 1,000 desktop pages come to about 2.65 GB, or $1.33, before caching.

The solver route moves request-sized traffic instead. Hyper Solutions puts a browser session at 200 to 500 MB of memory, against under 1 MB per API call. The figures come from its own tests on airline award searches. Those are a vendor's figures, so test on your target before you budget. Our headless browser bandwidth cost page compares the two routes at more volumes.

What can a proxy not fix at Imperva?

A proxy forwards your bytes untouched. Say those bytes come from a client on the HackingTool list, return no cookie and never run the script. A residential address then only means Imperva challenges a residential address.

The same split runs through DataDome, PerimeterX and Kasada. It sits behind all web scraping with proxies: the proxy makes the address believable, and the rest is yours.

What setup gets through?

None of this is a single trick. Getting past a real Imperva deployment means lining up every signal:

1. Exit from a residential or mobile address in the site's country, with one sticky session per flow.
2. Send a client Imperva files as a browser. A real browser, or a client whose TLS handshake and header order match the browser it claims to be.
3. Answer the ladder. Keep the cookie, run the JavaScript, and plan for a CAPTCHA, or send a solver payload made for your exit address.
4. Make everything agree. The user agent, the handshake, the language, the time zone and the exit country should describe one plausible person.
5. Pace like a person. Randomized delays, real time on each page, no even intervals and no "super-human speed".
6. Check what you received. Read the title and size of every response, and look for /_Incapsula_Resource and an incident ID: a 200 can be a challenge.

How do you test before you scale?

Confirm your exits are alive and residential with our IP lookup and proxy checker. Then run one full session against one page and read the answer: the status, the title and the size. Check whether visid_incap and incap_ses were set, and whether an incident ID or error code came back. One identity tested end to end shows which layer failed, so you fix that one instead of buying addresses you did not need.

When is the wall not your problem to solve?

Everything above assumes you have to get through Imperva yourself. If we already run endpoints for the site's platform, our scraper APIs return the data as JSON from one call. The Imperva layer is then our problem instead of yours. Building a bypass is worth the engineering time for targets nobody has solved yet.

What this page could not check

We ran no bypass tool, stealth browser or solver against Imperva, and we tested no proxy's success rate on it, ours included. Our requests were plain clients, so they show what fails, never what passes. The October captures cover three sites on one day from one home connection; the August and September results come from our own earlier pages. Imperva's bot product documents itself only behind a login, so the reese84 and ___utmvc details rest on Hyper Solutions' account. Wappalyzer's counts are its detections on the sites it crawls. We will re-read the sources by January 22, 2027.

Sources

• Imperva docs, read October 22, 2026: CAPTCHA and challenge behavior, Cloud WAF Error Pages and Codes and Client Classification, all updated October 21, 2026. Also DDoS Settings (August 20, 2026), Security Settings (October 26, 2025), Caching (April 19, 2026), the April 25, 2021 release note on visid_incap, and the Advanced Bot Protection overview (June 16, 2026).
• Imperva, Advanced Bot Protection product page, read October 22, 2026: the five detection layers, "over 700 dimensions", and legitimate users spared a CAPTCHA on 99.999% of requests.
• Our requests: a plain curl request with a Chrome 141 user agent from a home internet connection to pokemoncenter.com, coles.com.au and 7-eleven.com, October 22, 2026, 12:45 UTC; our Pokemon Center reads of September 27 and 28, 2026; our 7-Eleven request of August 24, 2026; the retail bot-defense study of August 24, 2026.
• Wappalyzer, Imperva technology page, read October 22, 2026: live website count, top sites, industries and country split.
• HTTP Archive, Web Almanac 2024, Page Weight, medians of the October 2024 crawl.
• Stack Overflow questions about Incapsula and Imperva, read through the Stack Exchange API on October 22, 2026: views and dates as quoted.
• Imperva (Wikipedia), read October 22, 2026: full ownership of Incapsula in 2014, Distil Networks in July 2019, Thales on December 4, 2023.
• Hyper Solutions, Incapsula solver product page, read October 22, 2026: the reese84 sensor, the rotating ___utmvc script, the hCaptcha or GeeTest fallback it does not solve, the ip field the payload must match, and its browser comparison. Provenance: they sell Imperva and Incapsula bypass tooling, so they have a commercial interest in the system reading as both formidable and beatable. The technical detail is specific and nobody else publishes it, which is why those claims stay on this page, but weigh the framing with that interest in mind. Not linked here.
• JA3 (Salesforce) and JA4 (FoxIO): the TLS ClientHello fingerprints your client has to match.