The verdict, up front: on Akamai, the browser is the wrong tool. In our April 2026 tests, curl-cffi with residential proxies passed 87% of 500 requests against Akamai Bot Manager v4 — beating Camoufox (83%) and Patchright (74%), both of which cost roughly four times as much to run at scale.
That result is specific to Akamai. The same curl-cffi setup gets 79% on standard Cloudflare and 41% on PerimeterX. If you carry a Cloudflare playbook over to an Akamai target, you will spend money on browser instances that are actively making your fingerprint worse.
This post covers what Akamai Bot Manager v4 checks, in the order it checks it, and the three changes that moved our pass rates most.
Why Akamai Inverts the Usual Advice
Most WAF guides tell you to reach for a stealth browser. That advice comes from Cloudflare, where a JavaScript challenge sits in the middle of the detection stack and you cannot answer it without a JS runtime.
Akamai's priority ordering is reversed. TLS fingerprinting is Akamai's primary signal, not a secondary one. Get the TLS handshake right and a large share of Akamai traffic never reaches a JavaScript challenge at all. Get it wrong and no amount of browser realism saves you, because you were classified before the first byte of HTML was sent.
This is why a headless library with a correct TLS signature outperforms a full stealth browser here, and why the gap runs the other way on Cloudflare.
Confirm You Are Actually Facing Akamai
Debugging a bypass against the wrong detection model is the most expensive mistake available. Three signals identify Akamai before you write any code:
| Signal | Where to look |
|---|---|
_abck cookie |
Response cookies on first page load |
sensor_data POST payload |
Network tab, usually to a path on the site's own domain |
AkamaiGHost in the Server header |
Response headers, often on an error or challenge response |
A bm_sz cookie alongside _abck confirms Bot Manager specifically rather than generic Akamai CDN delivery. If you see cf-ray or __cf_bm instead, you are on Cloudflare and this post's conclusions do not transfer — see the full three-WAF comparison for that split.
If you want a faster read on whether a target is protected at all, paste a category page into our free product URL extractor. It makes one plain, unrendered request and reports whether the page came back directly, whether it had to retry through a proxy, or whether the HTML contains almost no links — the signature of a grid that only exists after JavaScript runs.
What Bot Manager v4 Checks, in Priority Order
Akamai blocks across five layers simultaneously, but they do not carry equal weight.
1. TLS fingerprinting (JA3/JA4). The handshake signature is compared against known-good browser profiles before your request is routed. A raw Python requests call emits a Python TLS fingerprint that Akamai has flagged globally — that is most of why the plain-requests approach lands at 22%.
2. IP reputation. Datacenter ASNs are pre-flagged. This caps your ceiling regardless of how clean everything above it is: the same curl-cffi setup moves from 71% on datacenter proxies to 87% on residential.
3. JavaScript telemetry. Akamai's sensor script collects device and interaction data and posts it back as an encrypted sensor_data payload. This is what generates a valid _abck cookie.
4. Behavioural biometrics. Mouse trajectory, keystroke timing, scroll events — validated server-side against the sensor payload, not in the browser.
5. Session continuity. Whether this session's navigation path looks like a real visit or like a cold jump straight to a high-value page.
The important structural point: layers 3 and 4 only bite if you are running a browser. A well-formed curl-cffi request never executes the sensor script, so there is no telemetry to get wrong. You trade the sensor-data problem for a session-continuity problem, which is usually the cheaper of the two.
Measured Pass Rates Against Akamai v4
Methodology: 500 requests per approach, spread over 6 hours with randomised timing, against production e-commerce sites running Bot Manager v4 — not sandboxes. "Pass" means 200 OK with full page content, no challenge redirect and no soft-block. Residential pool was 2M+ IPs rotating per request.
| Approach | Akamai v4 pass rate | Relative compute cost |
|---|---|---|
| Requests library + datacenter proxies | 22% | Lowest |
| Camoufox + datacenter proxies | 68% | High |
| curl-cffi + datacenter proxies | 71% | Low |
| Patchright + residential proxies | 74% | High |
| Camoufox + residential proxies | 83% | Highest |
| curl-cffi + residential proxies | 87% | Low |
Two things stand out. The best result is also among the cheapest to operate — unusual, and specific to this WAF. And Patchright underperforms Camoufox here by 9 points, reversing their Cloudflare Enterprise ordering, because Camoufox patches its fingerprint at the Firefox C++ level rather than in JavaScript.
The Three Changes That Moved Our Numbers Most
Impersonate at the socket, not in headers. Setting a Chrome User-Agent on a Python requests call changes nothing — Akamai reads the TLS handshake, which still says Python. curl-cffi impersonates Chrome or Safari TLS signatures at the socket level. This single change accounts for the jump from 22% to 71% on the same datacenter proxies.
Warm up the session. Akamai's continuity tracking flags sessions that navigate straight to high-value pages. Two or three page loads with random dwell time before hitting the target URL moved pass rates from 61% to 83% on authenticated targets in our tests. This is the highest-yield single change available on Akamai and it costs you three cheap requests.
If you must run a browser, curve the mouse. Where a browser is unavoidable, Akamai's behavioural layer fails any session whose cursor moves in perfectly straight lines. Simulating trajectories with cubic bezier curves improved our Akamai pass rates by roughly 11 percentage points over linear movement.
Randomised request intervals matter too — jitter in a 300–2,500ms band rather than a fixed sleep. A fixed time.sleep(1) is itself a fingerprint.
Where Akamai Still Wins
Two target classes resist the cheap approach.
Authenticated and checkout flows. Session state has to survive across a rotating proxy pool, which means pinning sessions to IPs and managing their lifecycle. This is real engineering, and it is where most in-house Akamai scrapers stall.
Sites that render the data client-side. If the prices only exist after JavaScript runs, no TLS trick retrieves them. You are back to a browser and back to the sensor-data problem — accept the cost and budget for Camoufox at 83%.
Akamai is common on large fashion and electronics retailers — Zara, H&M, MediaMarkt and Fnac all run it — which makes it a recurring obstacle for product data extraction and SKU-level competitor price tracking in European retail.
The Cost Nobody Budgets For
Pass rate is one input. Maintenance is the other, and Akamai pushes sensor script changes roughly monthly. Each change can drop your pass rate by 15–30 points overnight.
The honest pattern we see: the first six months of a DIY Akamai stack are manageable. Months 7 through 12 are where engineering time quietly exceeds the cost of managed infrastructure, because the failures are intermittent and each one costs a debugging session to attribute.
At 10,000 pages/day, the compute gap between curl-cffi and browser-based approaches runs about 4:1 — which is the strongest practical argument for getting the TLS layer right before reaching for a browser.
When to Stop Building Your Own
Managed infrastructure is the cheaper answer when any of these are true:
- A scraping engineer spends more than 8 hours a month on Akamai maintenance.
- Your targets are authenticated, so session management across a proxy pool becomes a standing project.
- You need reliability you can put in front of a stakeholder, rather than a pass rate that moves with each sensor update.
ScrapeWise runs Akamai-protected targets as part of managed scraping infrastructure, with 36 ready endpoints and pass rates validated against production sites rather than sandboxes. Pricing is per delivered page and published: €0.15 per 1,000 for plain requests, €0.75 with rendering, €1.50 through the super/residential tier, and €3.75 for render plus super — the tier Akamai targets typically need. New accounts get 5 free requests and balance never expires.
Related reading: bypassing DataDome, which inverts this advice again — there the browser is mandatory — and bypassing PerimeterX / HUMAN, where every approach hits a hard ceiling.
Paste any URL — ScrapeWise handles the anti-bot
Managed infrastructure that adapts when sites change. No proxies, no code, no per-request fees.
97% accuracy on Amazon benchmarks · no credit card · book a 15-min call →