Bot Detection: 9 Anti-Bot Vendors Benchmarked
We ran two benchmarks against live websites, then identified the anti-bot company in front of every domain and measured how often each company’s domains returned the content we requested. That covers over 3,800 labeled domains and over 50,000 requests. The first benchmark fetched product and search pages on 100 e-commerce domains, 50 URLs each. The second fetched 10,000 general web URLs, one per domain.
Anti-bot market share and block rate
Cloudflare defends 73.3% of the 3,859 domains and recorded a 6.7% block rate. Imperva defends 3.7% and recorded 46.6%. The two measures rank the nine companies in close to opposite orders.
Metrics explained: Block rate is the share of requests that did not return the expected content on the domains a company defends, averaged over Bright Data, Zyte and Nimble at 5 and 100 concurrent requests, with every domain weighted equally rather than every request.
Both source benchmarks are published in full, the e-commerce scraper benchmark across 100 e-commerce domains and the website unblocker benchmark across the Tranco top 10,000.
Anti-bot vendors on the domains we tested
Nine companies defend at least 20 of the tested domains. Together they account for 3,829 of the 3,859 we could label.
Cloudflare’s free tier ships bot detection enabled by default. An independent measurement of the Tranco ranking found Cloudflare on 14.5% of the top 1,000 domains and 37.6% across the full million, a spread the authors attribute to the accessible free and low-cost tiers.1 Our general web sample sits in that long tail, so it carries the same concentration.
Ten more companies appeared below the 20-domain line and are not charted. They are Radware (9 domains), Sucuri (6), Queue-it (4), Kasada (3), Azion (2), Cequence Security (2), and single domains running Google Cloud Armor, Naver, MercadoLibre and Instacart in-house defences. Three domains resisted labelling and were excluded rather than pooled into an “other” bucket.
Block rate by anti-bot vendor
Imperva returned the highest block rate at 46.6%, with a 95% confidence interval of 40.6% to 52.6% that overlaps no other company in the set. Anubis follows at 35.7%, on a 28-domain sample whose interval runs from 22.6% to 49.4%.
Block rate and 95% confidence intervals
The four companies at the top of this table hold 7.8% of the deployed base between them. Cloudflare and Akamai, which hold 87.6% between them, recorded 6.7% and 10.7%.
The two groups reached their sites by different routes. Cloudflare’s bot detection arrives switched on with a free CDN plan, and Akamai’s with an enterprise delivery contract. Imperva, DataDome, HUMAN and Anubis sit on a site because someone installed them there. The table therefore separates deployment routes as well as products, and this benchmark does not hold that variable fixed.
Metrics explained: The horizontal axis is block rate as defined above. The vertical axis is the share of the 3,859 labelled domains each company defends, on a logarithmic scale because the range runs from 0.6% to 73.3%. The shaded bands mark the higher-blocking and lower-blocking ends of the measured range, which is where each company landed on this data rather than a recommendation.
Anubis is the one entry with no vendor behind it. It is an open-source reverse proxy that puts a proof-of-work challenge in front of a site, adopted largely by open-source infrastructure under AI crawler load.2 Published analysis argues the approach should be weak against determined scrapers, because the challenge computes in under two seconds and stays valid for a week.3 Against the three commercial unblockers in this benchmark it recorded 35.7%.
The interval widths track sample size rather than performance. Cloudflare’s runs 1.1 points wide on 2,829 domains. Alibaba’s runs 18.3 points wide on 23. Separations inside the middle of the table are not established.
Block rate on e-commerce and general web domains
Akamai blocked 33.1% of requests on the 42 e-commerce domains it defends and 8.9% on the 503 general web domains, a factor of 3.7. Cloudflare recorded 30.0% and 6.6% across 16 and 2,779 domains.
HUMAN’s two figures sit 2.9 points apart. Other company in this table moved by at least 8 points between the two sets. Imperva runs the other way, at 47.1% on the general web against 13.5% on two e-commerce domains, a sample too small to compare against.
The e-commerce and general web columns come from different page types. The e-commerce benchmark requested product and search pages on retail sites. The general web benchmark requested one page per domain across a broad URL pool.
Review of the anti-bot vendors
1. Cloudflare
Cloudflare scores every request on a 1 to 99 scale, with scores below 30 documented as the bot threshold, and exposes that score as a field customers write firewall rules against.4 The full scoring, JA3 and JA4 fingerprints and detection IDs sit in the Enterprise Bot Management add-on. Lower plans get Bot Fight Mode, which Cloudflare’s own documentation describes as having limited control and no path to skip it through firewall custom rules.5
Measured:
- 6.7% block rate across 2,829 domains
- 73.3% of tested domains, the largest deployed base in the set
2. Akamai
Akamai sells Bot Manager in Standard and Premier tiers and bundles Premier into Account Protector, its account-abuse product.6 Its block pages carry no vendor signature, which is why signature-based surveys undercount it and why our own labelling placed Akamai in a weaker evidence tier than vendors that name themselves. Reviewers on two sites report the same tuning burden in near-identical words, describing many false positives without careful calibration and a long list of exceptions across teams.7
Measured:
- 10.7% block rate across 552 domains
- 33.1% on e-commerce against 8.9% on general web pages
3. Imperva
Imperva sells Advanced Bot Protection as a module of its application security platform, built on the Distil Networks technology it acquired in June 2019.8 Thales completed its acquisition of Imperva for roughly $3.6 billion in December 2023, and the product documentation now sits on Thales domains.9 Imperva proxies its detection through first-party domains or runs it server-side, so it leaves no vendor-owned script for a survey to count.
Measured:
- 46.6% block rate across 142 domains
- 95% CI of 40.6% to 52.6%, overlapping no other company in the set
4. DataDome
DataDome deploys in front of web, mobile and API traffic independently of the customer’s CDN, with pre-built integrations for Cloudflare, Akamai, Fastly and AWS CloudFront among others. It publishes a false positive rate of under 0.01%, glossed as fewer than one human seeing a challenge per 10,000 served.10 Forrester named it a Leader in the Bot and Agent Trust Management Software Wave in June 2026.11
Measured:
- 16.0% block rate across 92 domains
- 23.6% on 6 e-commerce domains against 15.5% on 85 general web domains
5. AWS WAF Bot Control
AWS WAF Bot Control runs as a managed rule group inside AWS WAF, split into Common Bot Control for self-identifying bots and Targeted Bot Control for evasive automation.12 It is opt-in and paid, so its presence on a domain follows a purchase rather than a default. Its 10 e-commerce domains are all Amazon locales, so that column carries one retailer’s configuration rather than a cross-site sample.
Measured:
- 11.2% block rate across 69 domains
- 28.9% on 10 e-commerce domains, all Amazon locales, against 8.2% on 59 general web domains
6. F5
F5 sells Distributed Cloud Bot Defense, built on Shape Security, which F5 acquired for approximately $1 billion in cash in December 2019.13 Forrester rated it a Strong Performer in the 2024 edition of the same Wave.14 Our labelling round demoted F5’s most common marker, a TS cookie followed by hex, to edge level after checking, since BIG-IP load balancing leaves the same cookie without any bot product in play. None of the 100 e-commerce domains carried F5 as their primary defence, so its figure rests on general web pages alone.
Measured:
- 7.4% block rate across 54 domains, all general web
7. HUMAN
HUMAN sells Bot Defender inside the Human Defense Platform and serves its detection scripts from PerimeterX domains, the company it merged with in 2022. Forrester named it a Leader in the same June 2026 Wave.15
Measured:
- 15.6% block rate across 40 domains
- 18.0% on e-commerce against 15.1% on general web, a 2.9-point gap
8. Anubis
Anubis is open-source software from Techaro that adds a proof-of-work challenge in front of a site. It carries no vendor relationship, no telemetry contract and no per-request bill, and its policy file defines allow, deny and challenge rules per route.16 A Forgejo maintainer reports the verification cost on the server side as minimal.17
Measured:
- 35.7% block rate across 28 domains
- 95% CI of 22.6% to 49.4%, 26.8 points wide
9. Alibaba Cloud Anti-Bot Service
Alibaba Cloud Anti-Bot Service delivers reverse-proxy bot protection for web, H5 and mobile traffic through Alibaba Cloud WAF and DCDN, with a JavaScript SDK for browser targets.18 It is marketed to e-commerce and classified-ads operators, and the three e-commerce domains carrying it returned the highest e-commerce figure in the set at 44.2%, on a sample too small to rank against the others.
Measured:
- 12.5% block rate across 23 domains
- 44.2% on 3 e-commerce domains against 6.9% on 17 general web domains
- 95% CI of 4.2% to 22.5%, 18.3 points wide
Anti-bot benchmark methodology
Domain selection
The set merges two AIMultiple benchmarks. The e-commerce scraper benchmark contributed 100 domains fetched at product and search pages, and the website unblocker benchmark contributed roughly 10,000 general web URLs. Fifty domains appear in both. The union is keyed by domain, giving 3,859 labelled domains, of which 3,812 were measured with the full provider panel.
Anti-bot detection
The e-commerce domains were labelled with a three-channel probe. A bare curl request surfaced block pages that name their vendor, a browser-like request captured vendor cookies and detection scripts left on a normal 200 response, and Bright Data Web Unlocker covered domains that returned nothing locally. Probes went to the product and search URLs the benchmark requested, not the homepage, because many sites run their defence on those paths alone.
Evidence was graded. A cookie or header that a single bot-defence product leaves, or a challenge page naming its vendor, counted as a label. A generic CDN cookie did not. Ambiguous markers went through a verification round that produced four corrections, including reassigning the __uzm cookie family from Imperva to Radware across seven eBay domains.
The general web labels arrived with that benchmark’s own dataset as a flat per-domain company list without evidence grades. Where the two sources disagreed, which happened on 13 of the 50 shared domains, the evidence-graded e-commerce label took precedence. Applying the opposite rule moves no company’s share by more than 0.1 points.
CAPTCHA widgets were dropped, since reCAPTCHA and hCaptcha say nothing about which stack decides to block. Pure CDNs were dropped for the same reason, since a 403 behind CloudFront may be the site’s own rule.
Block rate measurement
Block rate is 100 minus the mean success rate of Bright Data, Zyte and Nimble, the three providers common to both benchmarks. Each provider’s per-domain rate is the mean of its two concurrency runs, at 5 and 100. Bucket figures weight every domain equally rather than pooling requests, so a domain fetched 50 times counts the same as one fetched once.
Oxylabs appears in both source benchmarks but is excluded here, having left the published e-commerce set with a broken product parser that returned 0% on product pages and 100% on search.
Confidence intervals
Intervals are 95% domain-cluster bootstraps with 10,000 resamples, resampling domains inside each bucket rather than requests, because pages on one domain are correlated.
Limitations
Each company’s product line spans tiers, and these rates reflect the tier each site had enabled during the benchmark window rather than the top of the range.
Companies that arrive bundled with a CDN and companies bought as a standalone purchase are not comparable on equal terms. A defence someone selected, paid for and tuned sits in front of a site with a known bot problem. This benchmark measures the outcome on real sites, not the products under matched configuration.
Add as preferred sourceFAQs
Bot detection decides, per request or per session, whether the client is a human operating a browser or an automated program. Mitigation is the second half, choosing the response, which can be allowing the request, throttling it, serving a challenge or blocking it. A system can classify a session as automated and still let it through, which is why deployment counts and block rates measure different things.
They name the same product category from different angles. G2 lists the category as Bot Detection and Mitigation. Cloudflare, Fastly and Radware market bot management. Akamai’s glossary uses bot mitigation. Forrester renamed its evaluation to Bot and Agent Trust Management Software in June 2026, on the reasoning that a growing share of automated traffic is AI agents acting for real users.19 Gartner has no standalone quadrant for it, and the capability sits inside Cloud Web Application and API Protection.
It means more requests did not return the expected content on the domains that company defends. Against three commercial unblocking services, Imperva returned 46.6% and Cloudflare 6.7%. Each company was measured on the sites that happened to run it, at whatever configuration those sites had, so the figure reports the outcome on real domains rather than a comparison of products under matched configuration.
Ten appeared on fewer than 20 domains and were left out of the charts. They are Radware, Sucuri, Queue-it, Kasada, Azion, Cequence Security, Google Cloud Armor, and the in-house defences at Naver, MercadoLibre and Instacart. Arkose Labs, Netacea, Fastly and AppTrana are active in the category but did not surface as a primary defence on any tested domain.
Further reading
- E-Commerce Scraper: 5 Providers Benchmarked
- Top 5 Website Unblockers Benchmarked & Compared
- The Most Common Web Scraping Challenges in 2026
- WAF Solutions: Benchmark-Based Comparison
- Best CAPTCHA Solving Services in 2026
- Large-Scale Web Scraping: 7 Providers Benchmarked
Cite this research
Pick the format that matches where you're publishing. Pasting the link version into your CMS preserves the backlink.
@misc{sari2026,
author = {Sarı, Ekrem},
title = {{Bot Detection: 9 Anti-Bot Vendors Benchmarked}},
year = {2026},
month = aug,
howpublished = {\url{https://aimultiple.com/bot-detection-software}},
note = {AIMultiple. Retrieved August 12, 2026}
}Reference Links
Be the first to comment
Your email address will not be published. All fields are required. Comments are left in their original language.