Bot Detection: 9 Anti-Bot Vendors Benchmarked
We measured content retrieval across more than 3,800 labelled domains using three commercial scraping services. We grouped the results by the anti-bot companies identified on those domains.
Anti-bot market share and block rate
Cloudflare was identified on 73.3% of the 3,859 labelled domains. The block rate for this group was 6.7%. Imperva was identified on 3.7% of domains, with a block rate of 46.6%. The two measures rank the nine companies in close to opposite orders.
Metrics explained: We use block rate for the percentage of attempts that did not return the expected content, averaged over Bright Data, Zyte and Nimble at concurrency levels of 5 and 100, with each domain weighted equally. It includes failures such as parser errors, missing pages and geographic restrictions, as well as anti-bot challenges. The share figures describe the 3,859 labelled domains in this sample.
Both source benchmarks are published in full, the e-commerce scraper benchmark across 100 e-commerce domains and the website unblocker benchmark across the Tranco top 10,000.
Anti-bot vendors on the domains we tested
Nine companies were identified on at least 20 of the tested domains. Together they account for 3,829 of the 3,859 we could label.
Cloudflare’s free tier ships bot detection enabled by default. An independent measurement of the Tranco ranking found Cloudflare on 14.5% of the top 1,000 domains and 37.6% across the full million, a spread the authors attribute to the accessible free and low-cost tiers.1 Our general web sample sits in that long tail, so it carries the same concentration.
Ten more companies appeared below the 20-domain line and are not charted. They are Radware (9 domains), Sucuri (6), Queue-it (4), Kasada (3), Azion (2), Cequence Security (2), and single domains running Google Cloud Armor, Naver, MercadoLibre and Instacart in-house defences. Three domains could not be labelled and were excluded from the analysis.
Block rate by anti-bot vendor
Domains labelled Imperva had the highest measured block rate at 46.6%, with a 95% confidence interval of 40.6% to 52.6%. Anubis follows at 35.7%, on a 28-domain sample whose interval runs from 22.6% to 49.4%. These intervals overlap.
Block rate and 95% confidence intervals
The four companies at the top of this table account for 7.8% of the labelled sample. Cloudflare and Akamai account for 87.6% between them and recorded block rates of 6.7% and 10.7%.
These rates reflect the combination of site settings, page types and scraping services in the sample. Deployment choices were not controlled, so differences between vendor groups cannot be attributed solely to the products.
Metrics explained: The horizontal axis is block rate as defined above. The vertical axis is the share of the 3,859 labelled domains attributed to each company, on a logarithmic scale because the range runs from 0.6% to 73.3%. The shaded bands mark the higher and lower ends of the measured block-rate range.
Anubis is the one entry with no vendor behind it. It is an open-source reverse proxy that puts a proof-of-work challenge in front of a site, adopted largely by open-source infrastructure under AI crawler load.2 Published analysis argues the approach should be weak against determined scrapers, because the challenge computes in under two seconds and stays valid for a week.3 Against the three commercial unblockers in this benchmark it recorded 35.7%.
Confidence interval widths reflect sample size and variation in outcomes. Cloudflare’s runs 1.1 points wide on 2,829 domains. Alibaba’s runs 18.3 points wide on 23. Separations inside the middle of the table are not established.
Block rate on e-commerce and general web domains
Domains labelled Akamai recorded a block rate of 33.1% in the e-commerce sample and 8.9% in the general web sample, a factor of 3.7. The two samples contained 42 and 503 domains. Domains labelled Cloudflare recorded 30.0% and 6.6% across 16 and 2,779 domains.
HUMAN’s two figures sit 2.9 points apart. Every other company in this table moved by at least 8 points between the two sets. Imperva runs the other way, at 47.1% on the general web against 13.5% on two e-commerce domains, a sample too small to compare against.
The e-commerce and general web columns come from different page types. The e-commerce benchmark requested product and search pages on retail sites. The general web benchmark requested one page per domain across a broad URL pool.
Review of the anti-bot vendors
1. Cloudflare
Cloudflare scores every request on a 1 to 99 scale, with scores below 30 documented as the bot threshold, and exposes that score as a field customers write firewall rules against.4 The full scoring, JA3 and JA4 fingerprints and detection IDs sit in the Enterprise Bot Management add-on. Lower plans get Bot Fight Mode, which Cloudflare’s own documentation describes as having limited control and no path to skip it through firewall custom rules.5
Measured:
- 6.7% block rate across 2,829 domains
- 73.3% of tested domains, the largest deployed base in the set
2. Akamai
Akamai sells Bot Manager in Standard and Premier tiers and bundles Premier into Account Protector, its account-abuse product.6 Its block pages carry no vendor signature, which is why signature-based surveys undercount it and why our own labelling placed Akamai in a weaker evidence tier than vendors that name themselves. Reviewers on two sites report the same tuning burden in near-identical words, describing many false positives without careful calibration and a long list of exceptions across teams.7
Measured:
- 10.7% block rate across 552 domains
- 33.1% on e-commerce against 8.9% on general web pages
3. Imperva
Imperva sells Advanced Bot Protection as a module of its application security platform, built on the Distil Networks technology it acquired in June 2019.8 Thales completed its acquisition of Imperva for roughly $3.6 billion in December 2023, and the product documentation now sits on Thales domains.9 Imperva proxies its detection through first-party domains or runs it server-side, so it leaves no vendor-owned script for a survey to count.
Measured:
- 46.6% block rate across 142 domains
- 95% CI of 40.6% to 52.6%, overlapping the Anubis interval
4. DataDome
DataDome deploys in front of web, mobile and API traffic independently of the customer’s CDN, with pre-built integrations for Cloudflare, Akamai, Fastly and AWS CloudFront among others. It publishes a false positive rate of under 0.01%, glossed as fewer than one human seeing a challenge per 10,000 served.10 Forrester named it a Leader in the Bot and Agent Trust Management Software Wave in June 2026.11
Measured:
- 16.0% block rate across 92 domains
- 23.6% on 6 e-commerce domains against 15.5% on 85 general web domains
5. AWS WAF Bot Control
AWS WAF Bot Control runs as a managed rule group inside AWS WAF, split into Common Bot Control for self-identifying bots and Targeted Bot Control for evasive automation.12 It is opt-in and paid. Its 10 e-commerce domains are all Amazon locales, so that column represents one retailer’s deployment across regional sites.
Measured:
- 11.2% block rate across 69 domains
- 28.9% on 10 e-commerce domains, all Amazon locales, against 8.2% on 59 general web domains
6. F5
F5 sells Distributed Cloud Bot Defense, built on Shape Security, which F5 acquired for approximately $1 billion in cash in December 2019.13 Forrester rated it a Strong Performer in the 2024 edition of the same Wave.14 Our labelling round demoted F5’s most common marker, a TS cookie followed by hex, to edge level after checking, since BIG-IP load balancing leaves the same cookie without any bot product in play. None of the 100 e-commerce domains carried F5 as their primary defence, so its figure rests on general web pages alone.
Measured:
- 7.4% block rate across 54 domains, all general web
7. HUMAN
HUMAN sells Bot Defender inside the Human Defense Platform and serves its detection scripts from PerimeterX domains, the company it merged with in 2022. Forrester named it a Leader in the same June 2026 Wave.15
Measured:
- 15.6% block rate across 40 domains
- 18.0% on e-commerce against 15.1% on general web, a 2.9-point gap
8. Anubis
Anubis is open-source software from Techaro that adds a proof-of-work challenge in front of a site. It carries no vendor relationship, no telemetry contract and no per-request bill, and its policy file defines allow, deny and challenge rules per route.16 A Forgejo maintainer reports the verification cost on the server side as minimal.17
Measured:
- 35.7% block rate across 28 domains
- 95% CI of 22.6% to 49.4%, 26.8 points wide
9. Alibaba Cloud Anti-Bot Service
Alibaba Cloud Anti-Bot Service delivers reverse-proxy bot protection for web, H5 and mobile traffic through Alibaba Cloud WAF and DCDN, with a JavaScript SDK for browser targets.18 It is marketed to e-commerce and classified-ads operators, and the three e-commerce domains carrying it returned the highest e-commerce figure in the set at 44.2%, on a sample too small to rank against the others.
Measured:
- 12.5% block rate across 23 domains
- 44.2% on 3 e-commerce domains against 6.9% on 17 general web domains
- 95% CI of 4.2% to 22.5%, 18.3 points wide
Anti-bot benchmark methodology
Domain selection
The set merges two AIMultiple benchmarks. The e-commerce scraper benchmark contributed 100 domains fetched at product and search pages, and the website unblocker benchmark contributed roughly 10,000 general web URLs. Fifty domains appear in both. The union is keyed by domain, giving 3,859 labelled domains, of which 3,812 were measured with the full provider panel.
Anti-bot detection
We labelled the e-commerce domains using three probe channels. Two used a custom Python script calling curl. One used curl’s default headers. The other supplied a Chrome 138/macOS User-Agent and HTTP headers such as Accept, Accept-Language, client hints and Sec-Fetch. This second mode was described as browser-like. It saved response headers and HTML without launching a browser or executing JavaScript. We inspected Set-Cookie headers and HTML for vendor signatures and script references, including those in HTTP 200 responses. Bright Data Web Unlocker provided a third channel for domains inaccessible locally. Targets included sampled product and search URLs from the benchmark, plus homepages for comparison. These probes identified vendors. The performance figures came from the separate scraping benchmarks.
Labels used vendor-specific cookies, headers, HTML signatures and challenge pages, with evidence graded by strength. Generic CDN markers alone were insufficient. Generic vendor deny pages supported company attribution but did not distinguish bot-management products from other security rules. Verification of ambiguous markers led to corrections, including reassigning the __uzm cookie family from Imperva to Radware across seven eBay domains.
The general web labels arrived with that benchmark’s own dataset as a flat per-domain company list without evidence grades. Where the two sources disagreed, which happened on 13 of the 50 shared domains, the evidence-graded e-commerce label took precedence. Applying the opposite rule moves no company’s share by more than 0.1 points.
CAPTCHA widgets were dropped, since reCAPTCHA and hCaptcha say nothing about which stack decides to block. Pure CDNs were dropped for the same reason, since a 403 behind CloudFront may be the site’s own rule.
Block rate measurement
Block rate is 100 minus the mean success rate of Bright Data, Zyte and Nimble, the three providers common to both benchmarks. Success means retrieval of the expected content. Each provider’s per-domain rate is the mean of its two concurrency runs, at 5 and 100. Each domain receives equal weight, so a domain fetched 50 times counts the same as one fetched once. Failures include causes other than confirmed anti-bot blocking.
Oxylabs appears in both source benchmarks but is excluded here, having left the published e-commerce set with a broken product parser that returned 0% on product pages and 100% on search.
Confidence intervals
Intervals are 95% domain-cluster bootstraps with 10,000 resamples. We resample domains within each vendor group because pages on one domain are correlated. These intervals describe variation across sampled domains. They do not account for systematic labelling errors or differences in site configuration.
Limitations
Vendor labels identify companies from observable signatures. They do not establish the exact product tier, configuration or rule responsible for a failed request. Evidence grades were available for the e-commerce labels. The general web labels lacked those grades, so attribution confidence differs between the two sources.
Sites differed in content and security settings, and each vendor was observed on the sites that used it. The results describe retrieval outcomes for the tested services and sites. They do not isolate product-level bot-detection accuracy or establish a ranking under matched configurations.
Add as preferred sourceFAQs
Bot detection decides, per request or per session, whether the client is a human operating a browser or an automated program. Mitigation is the second half, choosing the response, which can be allowing the request, throttling it, serving a challenge or blocking it. A system can classify a session as automated and still let it through, which is why deployment counts and block rates measure different things.
They name the same product category from different angles. G2 lists the category as Bot Detection and Mitigation. Cloudflare, Fastly and Radware market bot management. Akamai’s glossary uses bot mitigation. Forrester renamed its evaluation to Bot and Agent Trust Management Software in June 2026, on the reasoning that a growing share of automated traffic is AI agents acting for real users.19 Gartner has no standalone quadrant for it, and the capability sits inside Cloud Web Application and API Protection.
It means the tested scraping services more often failed to retrieve the expected content on domains attributed to that company. Domains labelled Imperva recorded 46.6% and those labelled Cloudflare recorded 6.7%. The metric includes failures unrelated to bot protection. Sites and security configurations varied across vendors, so these figures do not isolate the effectiveness of each anti-bot product.
Ten appeared on fewer than 20 domains and were left out of the charts. They are Radware, Sucuri, Queue-it, Kasada, Azion, Cequence Security, Google Cloud Armor, and the in-house defences at Naver, MercadoLibre and Instacart. Arkose Labs, Netacea, Fastly and AppTrana are active in the category but did not surface as a primary defence on any tested domain.
Further reading
- E-Commerce Scraper: 5 Providers Benchmarked
- Top 5 Website Unblockers Benchmarked & Compared
- The Most Common Web Scraping Challenges in 2026
- WAF Solutions: Benchmark-Based Comparison
- Best CAPTCHA Solving Services in 2026
- Large-Scale Web Scraping: 7 Providers Benchmarked
Cite this benchmark
Pick the format that matches where you're publishing. Pasting the link version into your CMS preserves the backlink.
@misc{sari2026,
author = {Sarı, Ekrem},
title = {{Bot Detection: 9 Anti-Bot Vendors Benchmarked}},
year = {2026},
month = aug,
howpublished = {\url{https://aimultiple.com/bot-detection-software}},
note = {AIMultiple. Retrieved August 12, 2026}
}Results and timestamps of 43 data points. Download the summary data shown in this article's charts and tables as a ZIP file containing 5 CSV files.
Want the granular data behind it? Join Premium
Reference Links
Be the first to comment
Your email address will not be published. All fields are required. Comments are left in their original language.