Imperva Incapsula Bypass API to Bypass Imperva WAF and Kasada Bot Detection
Send the URL that keeps returning Request unsuccessful and get the real page back. Every request leaves on a rotating residential address with a TLS handshake, header order and browser fingerprint that agree with each other, the Incapsula JavaScript challenge and the Kasada proof of work run in a real runtime, and you receive raw HTML or the fields you named as typed JSON. Refused attempts are never billed.
- Status
- ...
- Elapsed
- ... ms
- Exit country
- ...
- Browser used
- ...
This console sends a real request and shows you the real response. Five live fetches per session, and the sample targets run as often as you like.
What an Imperva Incapsula bypass API does for you
An Imperva Incapsula bypass API fetches public pages sitting behind Imperva's WAF and bot management and returns finished HTML or parsed JSON. It sends each request from a residential address, keeps the TLS fingerprint, HTTP/2 settings and header order consistent with the browser it claims to be, executes the challenge script so the visid_incap and incap_ses cookies are issued, and retries on a fresh identity when a request is refused. The same endpoint handles Kasada, which guards a different set of sites with a proof of work puzzle instead of a cookie challenge.
Imperva is not something a site turns off for you. It scores every request before the origin server is involved and serves whatever reads as an ordinary visitor, so getting past it means arriving as a request it has no reason to stop. Kasada works the same way at a different layer: it assumes nothing about you until your client has burned real CPU on a puzzle only a JavaScript engine can finish.
The people who buy this already have a working scraper. It pulled the target fine for months, the site moved behind Imperva or Kasada, and now there is a deadline and a hole in the data. Handing the fetch to an API turns an open ended reverse engineering problem back into a line item with a known price.
First work out which product is actually blocking you
Teams lose days tuning proxies for the wrong wall. Every one of these products leaves fingerprints of its own in the headers, cookies and body of the refusal, and reading them takes about thirty seconds with curl. This is the identification table we use.
| Product | Tells in the response | Typical refusal |
|---|---|---|
| Imperva Incapsula | X-Iinfo header, X-CDN naming Incapsula or Imperva, cookies visid_incap and incap_ses and nlbi, body strings Powered By Incapsula, Incapsula incident ID or _Incapsula_Resource | 403 with Request unsuccessful and an incident ID, sometimes the same body with a 200 |
| Kasada | x-kpsdk response and request headers, a KPSDK script loaded from a long opaque path, a token refreshed on a timer rather than a cookie you can copy | Clean 4xx or 5xx with an empty or minimal body and no visible challenge at all |
| Cloudflare | cf-ray and server cloudflare headers, cookies cf_clearance and __cf_bm, Turnstile widget, error codes 1010, 1015 or 1020 | 403 or a 503 interstitial. Covered on our Cloudflare scraping API page |
| DataDome | datadome cookie, x-datadome-cid header, a slider puzzle served from a captcha subdomain | 403 with a JSON body or the slider. Covered on our DataDome bypass API page |
| Akamai Bot Manager | _abck and ak_bmsc cookies, an obfuscated sensor script posting back to a validation endpoint | 403 or 429 with Access Denied or Pardon Our Interruption. Covered on our Akamai bypass API page |
One warning that applies to all five: never decide you were blocked on the status code alone. Imperva in particular will hand you its refusal page with HTTP 200, and a crawler that only checks for a 403 will log thousands of clean successes while writing empty rows into your database. Match on body content.
How Imperva scores you before the site sees the request
Imperva builds a trust score out of five layers and weighs them together. No single one bans you outright, but two that contradict each other usually will. Knowing which layer you failed tells you what to change before you change anything.
| Layer | What Imperva reads | What usually gives a scraper away |
|---|---|---|
| IP address | Network type, ASN and reputation history for the address and the range around it | Datacenter ranges start with a penalty, and a cheap shared residential pool hands you an address somebody else burned on the same target last week |
| TLS handshake | A JA3 or JA4 fingerprint of cipher suites, extensions and curve order | Python requests, Go and Node each produce a handshake no shipping browser has ever sent, which is why the very first call returns an incident ID |
| HTTP layer | Protocol version, HTTP/2 frame settings, and the order and casing of request headers | HTTP/1.1 from a user agent that would have negotiated HTTP/2, or headers sorted alphabetically by a library instead of in browser order |
| JavaScript challenge | A script that reads canvas, WebGL, audio context, hardware, screen and navigator fields, then sets the clearance cookies | No JavaScript executed at all, or an automated browser that still answers the automation probes honestly |
| Behavior | Request cadence, navigation order, resource loading and dwell time across the session | Perfectly even intervals, deep URLs hit with no referring page, and never loading a single image or stylesheet |
Why Kasada is a different problem
Imperva decides whether to trust you. Kasada starts from the position that it does not, and makes you pay for the privilege of being served. Every first time visitor gets a hidden proof of work puzzle that a browser solves in a moment and a scraper has to solve the hard way, on every fresh session, in a real JavaScript engine.
That changes the economics rather than the technique. There is usually no CAPTCHA to look at and no cookie you can copy between machines. What comes back instead is a short lived token carried in x-kpsdk headers, tied to the client that earned it and refreshed on a timer. Restart a session and you pay the CPU cost again.
Kasada shows up on ticketing, retail, travel and property portals, exactly the targets where the data is worth money and the operator knows it. If your requests come back as a bare 4xx with nothing in the body and no challenge page to inspect, that silence is the signature.
How a protected page comes back in four steps
01
Send the URL
One GET against our endpoint with the target URL, an optional country, and the field names you want back. No browser to keep alive, no proxy list to rotate yourself.
02
One coherent identity
The request leaves on a residential address with a TLS fingerprint, HTTP/2 settings, header order and user agent that all describe the same real browser build.
03
The challenge runs
Incapsula's script executes and issues the clearance cookies, or Kasada's proof of work is solved and the token is held. The session is reused rather than restarted cold on every page.
04
HTML or JSON back
You get the rendered page, or just the fields you named as typed JSON. Refusals are retried on a fresh identity and never appear on your invoice.
Ways past Imperva and Kasada, compared honestly
Four routes get taken in practice. Three of them work. Which one is right depends on how much engineering time the data is worth to you, and on whether you are fighting a cookie challenge or a proof of work.
| Approach | Works when | What it costs you |
|---|---|---|
| TLS impersonation library | The Imperva deployment only checks the handshake and headers. Tools in the curl-impersonate family send a genuine Chrome or Safari TLS signature from plain Python or Go. | Cheap, fast and worth trying first on Imperva. Useless against Kasada, which needs a JavaScript engine no HTTP client has. |
| Patched headless browser plus residential proxies | You need the challenge script or the proof of work to run and you are willing to own the fingerprint problem. | The most common in-house answer, and it works. Budget continuous engineering: every Chromium release shifts the fingerprint, and both vendors retrain against the popular stealth patches. |
| Standalone solver services | You want a token or a cookie pair handed back to inject into a pipeline you already run. | You still operate the proxies, the browser and the session logic, and you now have two vendors to debug when a target changes. |
| Managed fetch API | You want the page rather than the puzzle, and you would rather the upkeep were somebody else's job. | A per request fee. You give up low level control of the browser in exchange for never maintaining a fingerprint again. |
There is a fifth route people try, which is running more concurrency until something gets through. It does not work on either product and it makes things worse: both score cadence, and a burst of parallel requests from one subnet is the clearest bot signal there is. If you want the background on why the address alone is never enough, our note on datacenter proxies versus residential covers it.
What getting past Imperva and Kasada costs here
One rate per thousand successful requests, whatever is standing in front of the page. An Imperva or Kasada target costs the same as a plain static site, which is the whole point of flat pricing: your invoice is a function of how many pages you pulled, not how hard each one fought back.
| Plan | Per month | Successful requests | Per 1,000 pages |
|---|---|---|---|
| Starter | 49 USD | 50,000 | 0.98 USD |
| Growth | 149 USD | 250,000 | 0.60 USD |
| Scale | 499 USD | 1,500,000 | 0.33 USD |
Compare that with credit based billing, where a page behind Imperva, Kasada, DataDome or Cloudflare typically costs five to ten times a normal page once the protected target and JavaScript rendering multipliers stack up. If your crawl is mostly hard targets, that multiplier is your bill. The arithmetic is laid out in our breakdown of ScraperAPI pricing per 1,000 pages, the same conversion for Bright Data pricing per 1,000 pages, and for Oxylabs pricing per 1,000 pages.
Refused requests are not billed. On Kasada that matters more than anywhere else, because the first pass at a newly protected target is where the retries pile up, and a proof of work that fails still consumed real compute somewhere.
What this does not do
This endpoint fetches pages any visitor can open. It does not log into accounts, does not touch anything behind a paywall or a member area, and does not defeat authentication. If a page needs your credentials to be seen, it is out of scope here.
It is also not a way to overwhelm a site. Requests are paced and concurrency is capped per plan, because a target that falls over stops returning data for everybody, including you. Imperva is a web application firewall before it is bot management, and hammering one is a different conversation than collecting public data. Check the terms of the site you are collecting from and stay inside what your legal team signed off on.
And no vendor clears every Imperva or Kasada deployment on every attempt. Anybody quoting a perfect success rate against products that retrain weekly is selling you something. What we commit to is that the attempts that fail do not reach your invoice.
Imperva and Kasada bypass questions
How do I bypass Imperva Incapsula?
You pass Imperva by arriving as a request its trust score reads as human: a residential address, a TLS and HTTP/2 fingerprint that matches the browser in your user agent, headers in browser order, and the page JavaScript executed so the visid_incap and incap_ses cookies are issued properly. Plain HTTP libraries fail on the first call because the handshake alone gives them away.
What does Request unsuccessful Incapsula incident ID mean?
It is Imperva Incapsula's block page. The incident ID is a reference the site owner can look up in their Imperva console to see why you were refused. Seeing it means the WAF answered, not the site. It usually arrives with HTTP 403, but Imperva also serves the same body with HTTP 200, which is what silently fills a database with empty rows.
Why is Incapsula blocking me?
Because two signals disagree. A Chrome user agent sent over a Python or Go TLS handshake, HTTP/1.1 from a browser that would have negotiated HTTP/2, headers in library order, a datacenter IP address, or no JavaScript executed so the clearance cookies never get set. Imperva scores all of those together rather than banning on any single one.
What is the visid_incap cookie?
visid_incap is Imperva Incapsula's visitor identifier, paired with incap_ses for the session. Together they carry the clearance your browser earned after passing the JavaScript challenge. They are bound to the fingerprint that earned them, so pasting a working pair into a request with a different TLS signature does not get you through.
How do I know if a site uses Imperva?
Check the response headers for X-Iinfo or an X-CDN value naming Incapsula or Imperva, and the body for the strings Powered By Incapsula, Incapsula incident ID or _Incapsula_Resource. Cookies named visid_incap and incap_ses confirm it. Those markers appear on the block page and on normal pages alike.
How do I bypass Kasada?
Kasada makes every new visitor solve a hidden proof of work puzzle in JavaScript before it will serve anything, and it reads the x-kpsdk headers that come back with the answer. You need a real JavaScript runtime, a matched TLS fingerprint, a residential address, and the resulting session reused rather than re-solved on every request.
What is Kasada proof of work?
A computational puzzle Kasada's script asks the client to solve before the site responds. A real browser finishes it in a moment and the visitor never notices. A scraper has to run the same JavaScript and burn the same CPU on every fresh session, which is why Kasada costs more to scrape in compute than almost any other anti-bot product.
Does Imperva block web scraping?
Yes. Imperva sells bot management as part of its Advanced Bot Protection and FlexProtect lines, and sites running it block automated traffic by default. It protects large consumer sites in retail, travel, education, recruitment and real estate, which is why teams collecting public listing or review data run into it so often.
Can Kasada be bypassed with Playwright?
Not with a stock build. Playwright and Puppeteer leak automation markers and present a TLS and HTTP/2 signature that no shipping browser sends, and Kasada checks both before the proof of work even starts. Patched builds with residential proxies get through more often, but each Chromium release moves the fingerprint and the patches need reworking.
Why do I still get blocked with residential proxies?
Because the address is one check out of five. A residential IP paired with a Python TLS handshake still fails the fingerprint test, and a shared pool can hand you an address another customer already burned on the same target. Residential proxies raise your floor. They do not clear Imperva or Kasada by themselves.
How much does an Imperva bypass API cost?
With WebScrap it is 49 USD a month for 50,000 successful requests, which is 0.98 USD per 1,000 pages, falling to 0.60 on Growth and 0.33 on Scale. An Imperva or Kasada protected page costs exactly the same as a plain static one, and refused attempts never reach your invoice.
Send the URL that keeps returning an incident ID
Paste a target sitting behind Imperva Incapsula or Kasada and see the page come back as HTML or typed JSON. Flat 0.98 USD per 1,000 pages, refusals never billed.