[{"data":1,"prerenderedAt":85},["ShallowReactive",2],{"$febk9cE8I9oS2cRQSFkPTnIW8u_zfh-EMRGzoWszCnX4":3},{"title":4,"date":5,"dateModified":6,"datePublished":7,"dateModifiedISO":7,"image":8,"content":9,"faq":10,"metaTitle":30,"metaDescription":31,"author":32,"authorBio":6,"authorLinkedin":6,"authorTitle":6,"authorPhoto":33,"lastReviewed":6,"researchBasis":6,"category":34,"readingTime":35,"related":36,"prev":54,"next":57,"toc":58,"takeaways":84},"How to Bypass PerimeterX (HUMAN Security) When Web Scraping in 2026","24 Sep 2026",null,"2026-09-24","/img/news/bypass-perimeterx-human-web-scraping-2026.png","\u003Cp>\u003Cstrong>The verdict, up front: 67% is the ceiling, and more engineering will not raise it.\u003C/strong> In our April 2026 tests, the best DIY approach against PerimeterX — Camoufox with residential proxies — passed 67% of 500 requests. Patchright with residential proxies managed 58%. \u003Ccode>curl-cffi\u003C/code> with residential proxies, which tops our Akamai table at 87%, collapses to 41% here.\u003C/p>\n\u003Cp>That is not a tuning problem. Every other WAF we test has a configuration that gets you past 80%. PerimeterX does not, because of how its detection model is built. This post explains why, what the model actually checks, and what the three realistic responses are once you accept the ceiling.\u003C/p>\n\u003Ch2 id=\"confirm-you-are-actually-facing-perimeterx\">Confirm You Are Actually Facing PerimeterX\u003C/h2>\n\u003Cp>PerimeterX rebranded as HUMAN Security in 2023, but the cookies and endpoints still carry the old name, and so does most of the scraping community. Three signals identify it:\u003C/p>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Signal\u003C/th>\n\u003Cth>Where to look\u003C/th>\n\u003C/tr>\n\u003C/thead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>\u003Ccode>_pxhd\u003C/code> and \u003Ccode>_pxvid\u003C/code> cookies\u003C/td>\n\u003Ctd>Response cookies on first page load\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>\u003Ccode>/api/v2/collector\u003C/code> requests\u003C/td>\n\u003Ctd>Network tab, telemetry posting back during the session\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>PRESS & HOLD challenge\u003C/td>\n\u003Ctd>The distinctive hold-the-button interstitial, not a checkbox\u003C/td>\n\u003C/tr>\n\u003C/tbody>\u003C/table>\n\u003Cp>If you see \u003Ccode>_abck\u003C/code> and \u003Ccode>sensor_data\u003C/code> instead, that is Akamai — a different model with different answers, covered in \u003Ca href=\"https://scrapewise.ai/blogs/bypass-akamai-bot-manager-web-scraping-2026\">bypassing Akamai Bot Manager v4\u003C/a>. \u003Ccode>__ddg\u003C/code> cookies mean \u003Ca href=\"https://scrapewise.ai/blogs/bypass-datadome-web-scraping-2026\">DataDome\u003C/a>. \u003Ccode>cf-ray\u003C/code> means Cloudflare. Debugging a bypass against the wrong detection model is the most expensive mistake available.\u003C/p>\n\u003Cp>For a faster read on whether a target is protected at all, paste a category page into our \u003Ca href=\"https://scrapewise.ai/tools/free-product-url-extractor\">free product URL extractor\u003C/a>. It makes one plain, unrendered request and reports whether the page came back directly, whether it had to retry through a proxy, or whether the HTML contains almost no links.\u003C/p>\n\u003Caside class=\"article__usecase-card\">\u003Cdiv class=\"article__usecase-label\">Related use case\u003C/div>\u003Ch3 class=\"article__usecase-title\">Any-site data scraper\u003C/h3>\u003Cp class=\"article__usecase-blurb\">No-code extraction from any website. Managed infrastructure, no anti-bot headaches.\u003C/p>\u003Ca class=\"article__usecase-link\" href=\"/use-cases/data-scraper\">See how it works →\u003C/a>\u003C/aside>\u003Ch2 id=\"why-the-ceiling-is-architectural-not-technical\">Why the Ceiling Is Architectural, Not Technical\u003C/h2>\n\u003Cp>Most WAFs compare your traffic against a global model of what browsers and bots look like. Beat the global model and you are through on every site running that WAF.\u003C/p>\n\u003Cp>\u003Cstrong>PerimeterX trains per-domain.\u003C/strong> Each deployment is fitted to that specific website's historical traffic — click patterns, session durations, navigation flows, device distribution, time-of-day curves. The model is not asking "does this look like a browser?" It is asking "does this look like \u003Cem>this site's\u003C/em> visitors?"\u003C/p>\n\u003Cp>Two consequences follow, and both are uncomfortable:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>A bypass that works on one PerimeterX target may fail on the next.\u003C/strong> We have measured 30-point pass-rate swings between two sites running the same product, because their behavioural baselines are completely different. There is no single configuration to find.\u003C/li>\n\u003Cli>\u003Cstrong>Your fingerprint can be too clean.\u003C/strong> Camoufox's patched Firefox binary is a genuine advantage on Cloudflare, where Firefox TLS signatures are treated favourably. On a retail site where 80% of real visitors are on Chrome, a Firefox fingerprint is a statistical anomaly — even a perfect one.\u003C/li>\n\u003C/ol>\n\u003Cp>That second point is why the usual tool rankings scramble here. PerimeterX's Chromium-heavy training data means the browser-distribution question matters as much as the fingerprint-quality question, and no amount of patching resolves the tension.\u003C/p>\n\u003Ch2 id=\"what-perimeterx-checks\">What PerimeterX Checks\u003C/h2>\n\u003Cp>Four layers, evaluated continuously across the session rather than once at the door:\u003C/p>\n\u003Cp>\u003Cstrong>1. Browser fingerprint.\u003C/strong> Canvas, WebGL renderer, audio context, font enumeration. Standard, and the layer most stealth tooling is built to address.\u003C/p>\n\u003Cp>\u003Cstrong>2. Behavioural signals.\u003C/strong> Mouse trajectory, typing cadence, scroll velocity. Validated server-side against what real users on that domain do — not against a generic "is this a human" threshold.\u003C/p>\n\u003Cp>\u003Cstrong>3. Session graph.\u003C/strong> Which pages were visited, in what order, with what dwell times. A session that lands on three product pages and nothing else does not match a shopping pattern, regardless of how convincingly the browser is fingerprinted.\u003C/p>\n\u003Cp>\u003Cstrong>4. Network graph.\u003C/strong> Whether this IP's behaviour \u003Cem>across sessions\u003C/em> matches legitimate users. This is the layer that catches otherwise-clean scrapers over time: any individual session passes, and the aggregate pattern does not.\u003C/p>\n\u003Cp>Layer 4 is the reason \u003Ccode>curl-cffi\u003C/code> performs so badly here. Against Akamai, skipping the browser skips the JavaScript telemetry problem entirely and the trade is usually worth it. Against PerimeterX there is no sensor script to skip — the telemetry is continuous, and a client that never emits any is itself the anomaly.\u003C/p>\n\u003Caside class=\"article__inline-cta\">\u003Cp class=\"article__inline-cta-text\">Try ScrapeWise on your own URL — \u003Cstrong>extract in 24s\u003C/strong>, no credit card.\u003C/p>\u003Ca class=\"article__inline-cta-btn\" href=\"https://portal.scrapewise.ai/login\" target=\"_blank\" rel=\"noopener\">Start Free →\u003C/a>\u003C/aside>\u003Ch2 id=\"measured-pass-rates-against-perimeterx\">Measured Pass Rates Against PerimeterX\u003C/h2>\n\u003Cp>Methodology: 500 requests per approach, spread over 6 hours with randomised timing, against production e-commerce sites running PerimeterX — not sandboxes. "Pass" means 200 OK with full page content, no challenge redirect and no soft-block. Residential pool was 2M+ IPs rotating per request.\u003C/p>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Approach\u003C/th>\n\u003Cth>PerimeterX pass rate\u003C/th>\n\u003Cth>For contrast: Akamai v4\u003C/th>\n\u003C/tr>\n\u003C/thead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>Requests library + datacenter proxies\u003C/td>\n\u003Ctd>11%\u003C/td>\n\u003Ctd>22%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>curl-cffi + datacenter proxies\u003C/td>\n\u003Ctd>29%\u003C/td>\n\u003Ctd>71%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>curl-cffi + residential proxies\u003C/td>\n\u003Ctd>41%\u003C/td>\n\u003Ctd>87%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Camoufox + datacenter proxies\u003C/td>\n\u003Ctd>51%\u003C/td>\n\u003Ctd>68%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Patchright + residential proxies\u003C/td>\n\u003Ctd>58%\u003C/td>\n\u003Ctd>74%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Camoufox + residential proxies\u003C/strong>\u003C/td>\n\u003Ctd>\u003Cstrong>67%\u003C/strong>\u003C/td>\n\u003Ctd>83%\u003C/td>\n\u003C/tr>\n\u003C/tbody>\u003C/table>\n\u003Cp>The contrast column is the point. On Akamai, the cheapest approach wins outright. On PerimeterX, the most expensive approach wins and still leaves one request in three failing. Every row is lower than its Akamai equivalent, and the spread between best and worst is narrower — which is what a per-domain behavioural model looks like from the outside.\u003C/p>\n\u003Ch2 id=\"the-press-amp-hold-challenge\">The PRESS & HOLD Challenge\u003C/h2>\n\u003Cp>When PerimeterX escalates, it serves a press-and-hold interstitial rather than a checkbox or an image grid. This is deliberate: the challenge measures the \u003Cem>pressure curve and micro-tremor\u003C/em> of the hold, not whether a button was pressed.\u003C/p>\n\u003Cp>\u003Ccode>curl-cffi\u003C/code> cannot answer it at all — there is no DOM to hold a button in. A browser can, and the commercial solvers handle it: this is the one place where the captcha-solving layer materially moves PerimeterX numbers. Budget for it the same way you would budget for Turnstile solving, and treat a rising solve rate as a signal that something upstream in your fingerprint has degraded, not as a cost of doing business.\u003C/p>\n\u003Cp>If the escalation is firing on most sessions, the solver is treating a symptom. Fix the session graph first.\u003C/p>\n\u003Ch2 id=\"the-three-changes-worth-making\">The Three Changes Worth Making\u003C/h2>\n\u003Cp>Given the ceiling, only a few things actually move the number.\u003C/p>\n\u003Cp>\u003Cstrong>Use a Chromium-based browser, not Firefox — sometimes.\u003C/strong> This inverts the Cloudflare advice. Patchright's 58% sits below Camoufox's 67% in our aggregate, but the ordering flips on individual targets depending on that site's real browser mix. This is the one WAF where it is worth running both for a week and measuring, rather than picking on principle.\u003C/p>\n\u003Cp>\u003Cstrong>Build a session graph, not a request list.\u003C/strong> Scraping five product pages in sequence from a cold session is the single most detectable pattern on this WAF. Entering via a category page, dwelling, moving to a product, moving back — the navigation shape matters more here than anywhere else, because it is compared against that domain's real traffic.\u003C/p>\n\u003Cp>\u003Cstrong>Accept datacenter proxies are not an option.\u003C/strong> Camoufox drops from 67% to 51% on datacenter IPs, and \u003Ccode>curl-cffi\u003C/code> from 41% to 29%. The network-graph layer weights IP history heavily. Residential is not an optimisation here, it is a prerequisite.\u003C/p>\n\u003Cp>Randomised request intervals matter too — jitter in a 300–2,500ms band rather than a fixed sleep. A fixed \u003Ccode>time.sleep(1)\u003C/code> is itself a fingerprint.\u003C/p>\n\u003Ch2 id=\"what-a-67-ceiling-actually-costs\">What a 67% Ceiling Actually Costs\u003C/h2>\n\u003Cp>The number sounds survivable until you put volume behind it. At 10,000 pages/day, a 67% pass rate is \u003Cstrong>3,300 failures every day\u003C/strong>. You have two options and both cost money:\u003C/p>\n\u003Cp>\u003Cstrong>Retry them.\u003C/strong> Now you are running 15,000 requests to deliver 10,000 pages, on the most expensive tooling in the stack — Camoufox instances carry 200MB+ of memory each. Your effective cost per delivered page rises by half.\u003C/p>\n\u003Cp>\u003Cstrong>Skip them.\u003C/strong> Now your dataset has holes, and the holes are not random. Failures cluster on the targets whose behavioural baselines your sessions match worst, which means specific competitors go systematically under-sampled. A price comparison built on that is confidently wrong rather than obviously incomplete.\u003C/p>\n\u003Cp>The second failure mode is worse and gets noticed later. If PerimeterX-protected sites are in your competitive set for \u003Ca href=\"https://scrapewise.ai/use-cases/competitor-price-tracking\">competitor price tracking\u003C/a>, the gaps land exactly where the data matters.\u003C/p>\n\u003Ch2 id=\"when-to-stop-building-your-own\">When to Stop Building Your Own\u003C/h2>\n\u003Cp>PerimeterX is the clearest case on the web for not doing this in-house. The usual break-even arguments — maintenance hours, WAF update cadence — apply, but there is a stronger one specific to this WAF: \u003Cstrong>the per-domain training model means your engineering effort does not compound.\u003C/strong> Work spent beating one PerimeterX target teaches you very little about the next one. On Cloudflare or Akamai, it teaches you most of what you need.\u003C/p>\n\u003Cp>Stop building when any of these are true:\u003C/p>\n\u003Cul>\n\u003Cli>PerimeterX-protected sites are more than a handful of your targets, so the per-domain tuning becomes a standing project rather than a one-off.\u003C/li>\n\u003Cli>You need a reliability number you can put in front of a stakeholder. 67% is not that number, and it is the best DIY figure we have measured.\u003C/li>\n\u003Cli>Your targets are authenticated, so session state has to survive across a rotating proxy pool on top of everything above.\u003C/li>\n\u003C/ul>\n\u003Cp>ScrapeWise runs PerimeterX-protected targets as part of managed scraping infrastructure, with 36 ready endpoints and pass rates validated against production sites rather than sandboxes. Pricing is per delivered page and published: €0.15 per 1,000 for plain requests, €0.75 with rendering, €1.50 through the super/residential tier, and €3.75 for render plus super — the tier PerimeterX targets need. New accounts get 5 free requests and balance never expires.\u003C/p>\n\u003Cp>Related reading: \u003Ca href=\"https://scrapewise.ai/blogs/bypass-akamai-bot-manager-web-scraping-2026\">bypassing Akamai Bot Manager\u003C/a>, where the advice inverts completely and the cheapest approach wins, and the \u003Ca href=\"https://scrapewise.ai/blogs/bypass-cloudflare-akamai-perimeterx-web-scraping-2026\">full three-WAF comparison\u003C/a> covering Cloudflare alongside both.\u003C/p>\n\u003Cp>\u003Ca href=\"https://scrapewise.ai/contact\">Get a quote from ScrapeWise\u003C/a>\u003C/p>\n",{"title":11,"description":12,"badge":13,"benefits":14},"Frequently asked questions","bypass perimeterx human security 2026 - why PerimeterX has a hard DIY ceiling and what to do about it when scraping for price monitoring","FAQ",[15,18,21,24,27],{"title":16,"description":17},"Is PerimeterX the same thing as HUMAN Security?","Yes. PerimeterX rebranded as HUMAN Security in 2023 after merging with White Ops. The cookies (`_pxhd`, `_pxvid`) and the `/api/v2/collector` telemetry endpoint still carry the original naming, which is why the scraping community mostly still says PerimeterX. If you are searching for documentation or tooling, both names refer to the same detection product.",{"title":19,"description":20},"Why can't I get past 70% on PerimeterX no matter what I try?","Because the ceiling is architectural rather than technical. Every PerimeterX deployment is trained on that specific website's historical traffic — click patterns, session durations, navigation flows, device distribution. It is not asking whether you look like a browser, it is asking whether you look like that site's visitors. Our best measured DIY result across 500 requests per approach was Camoufox with residential proxies at 67%. More engineering effort does not move it, because the target moves per domain.",{"title":22,"description":23},"Does curl-cffi work against PerimeterX like it does against Akamai?","No, and the gap is the largest in our data. curl-cffi with residential proxies passes 87% against Akamai Bot Manager v4 and only 41% against PerimeterX. Against Akamai, skipping the browser skips the JavaScript sensor problem entirely and the trade pays off. PerimeterX runs continuous telemetry across the session, so there is nothing to skip — a client that never emits any behavioural data is itself the anomaly.",{"title":25,"description":26},"How do I handle the PerimeterX PRESS & HOLD challenge?","You need a full browser; a plain HTTP client has no DOM to hold a button in. The challenge measures the pressure curve and micro-tremor of the hold rather than simply whether the button was pressed, which is why it resists naive automation. Commercial captcha solvers handle it, but treat a rising solve rate as a warning sign — if the escalation fires on most sessions, the solver is masking a fingerprint or session-graph problem upstream rather than fixing it.",{"title":28,"description":29},"Should I use Camoufox or Patchright against PerimeterX?","Measure both on your actual targets — this is the one WAF where the answer changes per site. In our aggregate, Camoufox with residential proxies reached 67% and Patchright reached 58%, but the ordering flips on individual domains depending on that site's real browser mix. Camoufox's patched Firefox binary is a genuine advantage on Cloudflare; on a retail site where most real visitors run Chrome, a Firefox fingerprint is a statistical anomaly even when it is technically perfect.","PerimeterX Bypass 2026: 67% Is the DIY Ceiling","We tested 6 approaches against PerimeterX / HUMAN. Best DIY result: Camoufox + residential at 67%. Why the ceiling is architectural, and what to do about it.","Siim Brazier","/img/team/siim.jpg","Scraping",7,[37,42,48],{"slug":38,"title":39,"image":40,"date":5,"category":34,"excerpt":41},"bypass-akamai-bot-manager-web-scraping-2026","How to Bypass Akamai Bot Manager v4 When Web Scraping in 2026","/img/news/bypass-akamai-bot-manager-web-scraping-2026.png","Akamai bypass in 2026: curl-cffi with residential proxies hit 87% against Bot Manager v4 — beating both stealth browsers. The one WAF where skipping the browser wins.",{"slug":43,"title":44,"image":45,"date":46,"category":34,"excerpt":47},"real-time-web-scraping-api-comparison-2026","Real-Time Web Scraping APIs in 2026: 9 Options Compared by Cost per Usable Record","/img/news/real-time-web-scraping-api-comparison-2026.png","15 Sep 2026","We compared 9 real-time scraping APIs — ScraperAPI, Bright Data, Oxylabs, Apify, Zyte, ZenRows, ScrapeWise — by cost per usable record, not credits.",{"slug":49,"title":50,"image":51,"date":52,"category":34,"excerpt":53},"idealo-geizhals-vs-retailer-scraping-dach-2026","Idealo, Geizhals, or the Retailer Itself? Where DACH Pricing Teams Should Get Their Data","/img/news/idealo-geizhals-vs-retailer-scraping-dach-2026.png","12 Aug 2026","Idealo and Geizhals give breadth but lag. Retailer sites give the exact price but cost more to run. Where DACH pricing teams should source price data.",{"slug":55,"title":56},"camoufox-vs-patchright-2026","Camoufox vs Patchright: Firefox Fork or Patched Chromium? (2026)",{"slug":38,"title":39},[59,63,66,69,72,75,78,81],{"level":60,"text":61,"id":62},2,"Confirm You Are Actually Facing PerimeterX","confirm-you-are-actually-facing-perimeterx",{"level":60,"text":64,"id":65},"Why the Ceiling Is Architectural, Not Technical","why-the-ceiling-is-architectural-not-technical",{"level":60,"text":67,"id":68},"What PerimeterX Checks","what-perimeterx-checks",{"level":60,"text":70,"id":71},"Measured Pass Rates Against PerimeterX","measured-pass-rates-against-perimeterx",{"level":60,"text":73,"id":74},"The PRESS & HOLD Challenge","the-press-amp-hold-challenge",{"level":60,"text":76,"id":77},"The Three Changes Worth Making","the-three-changes-worth-making",{"level":60,"text":79,"id":80},"What a 67% Ceiling Actually Costs","what-a-67-ceiling-actually-costs",{"level":60,"text":82,"id":83},"When to Stop Building Your Own","when-to-stop-building-your-own",[],1790254753577]