Detección de bots: 9 proveedores anti-bot comparados
Identificamos la empresa anti-bot que protege los ~3.800 dominios principales y medimos con qué frecuencia cada dominio bloqueó nuestros bots a través de 50.000 solicitudes.
Cuota de mercado anti-bot y tasa de bloqueo
Cloudflare defiende el 73,3 % de los 3.859 dominios y registró una tasa de bloqueo del 6,7 %. Imperva defiende el 3,7 % y registró una tasa de bloqueo del 46,6 %. Las dos medidas clasifican a las nueve empresas en órdenes casi opuestos.
Métricas explicadas: Block tasa es la proporción de solicitudes que no devolvieron el contenido esperado en los dominios que defiende una empresa, promediada entre Bright Data, Zyte y Nimble con 5 y 100 solicitudes concurrentes, ponderando cada dominio por igual en lugar de cada solicitud.
Ambas evaluaciones comparativas de origen están publicadas íntegramente: el análisis comparativo de scraping de comercio electrónico en 100 dominios de comercio electrónico y el análisis comparativo de desbloqueadores de sitios web en los 10.000 principales de Tranco.
Proveedores anti-bot en los dominios que probamos
Nueve empresas defienden al menos 20 de los dominios probados. Together representan 3.829 de los 3.859 que pudimos etiquetar.
Cloudflare’s gratis tier ships bot detection enabled by default. An independent measurement of the Tranco ranking found Cloudflare on 14,5 % of the top 1.000 domains and 37,6 % across the full million, a spread the authors attribute to the accessible gratis and low-cost tiers.1 Our general web sample sits in that long tail, so it carries the same concentration.
Ten more companies appeared below the 20-domain line and are not charted. They are Radware (9 domains), Sucuri (6), Queue-it (4), Kasada (3), Azion (2), Cequence Security (2), and single domains running Google Cloud Armor, Naver, MercadoLibre and Instacart in-house defences. Three domains resisted labelling and were excluded rather than pooled into an “other” bucket.
Block tasa por proveedor anti-bot
Imperva obtuvo la tasa de bloqueo más alta, con un 46,6 % y un intervalo de confianza del 95 % de 40,6 % a 52,6 % que no se superpone con ninguna otra empresa del conjunto. Anubis le sigue con un 35,7 %, en una muestra de 28 dominios cuyo intervalo va de 22,6 % a 49,4 %.
Block tasa e 95 % intervalos de confianza
The four companies at the top of this table hold 7,8 % of the deployed base between them. Cloudflare and Akamai, which hold 87,6 % between them, recorded 6,7 % and 10,7 %.
The two groups reached their sites by different routes. Cloudflare’s bot detection arrives switched on with a gratis CDN plan, and Akamai’s with an enterprise delivery contract. Imperva, DataDome, HUMAN and Anubis sit on a site because someone installed them there. The table therefore separates deployment routes as well as products, and this benchmark does not hold that variable fixed.
Metrics explained: The horizontal axis is block rate as defined above. The vertical axis is the share of the 3.859 labelled domains each company defends, on a logarithmic scale because the range runs from 0,6 % to 73,3 %. The shaded bands mark the higher-blocking and lower-blocking ends of the measured range, which is where each company landed on this data rather than a recommendation.
Anubis is the one entry with no vendor behind it. It is an open-source reverse proxy that puts a proof-of-work challenge in front of a site, adopted largely by open-source infrastructure under IA crawler load.2 Published analysis argues the approach should be weak against determined scrapers, because the challenge computes in under two seconds and stays valid for a week.3 Against the three commercial unblockers in this benchmark it recorded 35,7 %.
The interval widths track sample size rather than performance. Cloudflare’s runs 1.1 points wide on 2.829 domains. Alibaba’s runs 18.3 points wide on 23. Separations inside the middle of the table are not established.
Block tasa en dominios de comercio electrónico y web general
Akamai blocked 33,1 % of requests on the 42 e-commerce domains it defends and 8,9 % on the 503 general web domains, a factor of 3.7. Cloudflare recorded 30,0 % and 6,6 % across 16 and 2.779 domains.
HUMAN’s two figures sit 2.9 points apart. Other company in this table moved by at least 8 points between the two sets. Imperva runs the other way, at 47,1 % on the general web against 13,5 % on two e-commerce domains, a sample too small to compare against.
The e-commerce and general web columns come from different page types. The e-commerce benchmark requested product and search pages on retail sites. The general web benchmark requested one page per domain across a broad URL pool.
Análisis de los proveedores anti-bot
1. Cloudflare
Cloudflare scores every request on a 1 to 99 scale, with scores below 30 documented as the bot threshold, and exposes that score as a field customers write firewall rules against.4 The full scoring, JA3 and JA4 fingerprints and detection IDs sit in the Enterprise Bot Management add-on. Lower plans get Bot Fight Mode, which Cloudflare’s own documentation describes as having limited control and no path to skip it through firewall custom rules.5
Measured:
- 6,7 % block rate across 2.829 domains
- 73,3 % of tested domains, the largest deployed base in the set
2. Akamai
Akamai sells Bot Manager in Standard and Premier tiers and bundles Premier into Account Protector, its account-abuse product.6 Its block pages carry no vendor signature, which is why signature-based surveys undercount it and why our own labelling placed Akamai in a weaker evidence tier than vendors that name themselves. Reviewers on two sites report the same tuning burden in near-identical words, describing many false positives without careful calibration and a long list of exceptions across teams.7
Measured:
- 10,7 % block rate across 552 domains
- 33,1 % on e-commerce against 8,9 % on general web pages
3. Imperva
Imperva sells Advanced Bot Protection as a module of its application security platform, built on the Distil Networks technology it acquired in June 2019.8 Thales completed its acquisition of Imperva for roughly $3,6 billion in December 2023, and the product documentation now sits on Thales domains.9 Imperva proxies its detection through first-party domains or runs it server-side, so it leaves no vendor-owned script for a survey to count.
Measured:
- 46,6 % block rate across 142 domains
- 95 % CI of 40,6 % to 52,6 %, overlapping no other company in the set
4. DataDome
DataDome deploys in front of web, mobile and API traffic independently of the customer’s CDN, with pre-built integrations for Cloudflare, Akamai, Fastly and AWS CloudFront among others. It publishes a false positive rate of under 0,01 %, glossed as fewer than one human seeing a challenge per 10.000 served.10 Forrester named it a Leader in the Bot and Agent Trust Management Software Wave in June 2026.11
Measured:
- 16,0 % block rate across 92 domains
- 23,6 % on 6 e-commerce domains against 15,5 % on 85 general web domains
5. AWS WAF Bot Control
AWS WAF Bot Control runs as a managed rule group inside AWS WAF, split into Common Bot Control for self-identifying bots and Targeted Bot Control for evasive automation.12 It is opt-in and paid, so its presence on a domain follows a purchase rather than a default. Its 10 e-commerce domains are all Amazon locales, so that column carries one retailer’s configuration rather than a cross-site sample.
Measured:
- 11,2 % block rate across 69 domains
- 28,9 % on 10 e-commerce domains, all Amazon locales, against 8,2 % on 59 general web domains
6. F5
F5 sells Distributed Cloud Bot Defense, built on Shape Security, which F5 acquired for approximately $1 billion in cash in December 2019.13 Forrester rated it a Strong Performer in the 2024 edition of the same Wave.14 Our labelling round demoted F5’s most common marker, a TS cookie followed by hex, to edge level after checking, since BIG-IP load balancing leaves the same cookie without any bot product in play. None of the 100 e-commerce domains carried F5 as their primary defence, so its figure rests on general web pages alone.
Measured:
- 7,4 % block rate across 54 domains, all general web
7. HUMAN
HUMAN sells Bot Defender inside the Human Defense Platform and serves its detection scripts from PerimeterX domains, the company it merged with in 2022. Forrester named it a Leader in the same June 2026 Wave.15
Measured:
- 15,6 % block rate across 40 domains
- 18,0 % on e-commerce against 15,1 % on general web, a 2.9-point gap
8. Anubis
Anubis is open-source software from Techaro that adds a proof-of-work challenge in front of a site. It carries no vendor relationship, no telemetry contract and no per-request bill, and its policy file defines allow, deny and challenge rules per route.16 A Forgejo maintainer reports the verification cost on the server side as minimal.17
Measured:
- 35,7 % block rate across 28 domains
- 95 % CI of 22,6 % to 49,4 %, 26.8 points wide
9. Alibaba Cloud Anti-Bot Service
Alibaba Cloud Anti-Bot Service delivers reverse-proxy bot protection for web, H5 and mobile traffic through Alibaba Cloud WAF and DCDN, with a JavaScript SDK for browser targets.18 It is marketed to e-commerce and classified-ads operators, and the three e-commerce domains carrying it returned the highest e-commerce figure in the set at 44,2 %, on a sample too small to rank against the others.
Measured:
- 12,5 % block rate across 23 domains
- 44,2 % on 3 e-commerce domains against 6,9 % on 17 general web domains
- 95 % CI of 4,2 % to 22,5 %, 18.3 points wide
Metodología de la evaluación comparativa anti-bot
Selección de dominios
The set merges two AIMultiple benchmarks. The análisis comparativo de scraping de comercio electrónico contributed 100 domains fetched at product and search pages, and the análisis comparativo de desbloqueadores de sitios web contributed roughly 10.000 general web URLs. Fifty domains appear in both. The union is keyed by domain, giving 3.859 labelled domains, of which 3.812 were measured with the full provider panel.
Detección anti-bot
The e-commerce domains were labelled with a three-channel probe. A bare curl request surfaced block pages that name their vendor, a browser-like request captured vendor cookies and detection scripts left on a normal 200 response, and Bright Data Web Unlocker covered domains that returned nothing locally. Probes went to the product and search URLs the benchmark requested, not the homepage, because many sites run their defence on those paths alone.
Evidence was graded. A cookie or header that a single bot-defence product leaves, or a challenge page naming its vendor, counted as a label. A generic CDN cookie did not. Ambiguous markers went through a verification round that produced four corrections, including reassigning the __uzm cookie family from Imperva to Radware across seven eBay domains.
The general web labels arrived with that benchmark’s own dataset as a flat per-domain company list without evidence grades. Where the two sources disagreed, which happened on 13 of the 50 shared domains, the evidence-graded e-commerce label took precedence. Applying the opposite rule moves no company’s share by more than 0.1 points.
CAPTCHA widgets were dropped, since reCAPTCHA and hCaptcha say nothing about which stack decides to block. Pure CDNs were dropped for the same reason, since a 403 behind CloudFront may be the site’s own rule.
Block tasa de medición
Block rate is 100 minus the mean success rate of Bright Data, Zyte and Nimble, the three providers common to both benchmarks. Each provider’s per-domain rate is the mean of its two concurrency runs, at 5 and 100. Bucket figures weight every domain equally rather than pooling requests, so a domain fetched 50 times counts the same as one fetched once.
Oxylabs appears in both source benchmarks but is excluded here, having left the published e-commerce set with a broken product parser that returned 0 % on product pages and 100 % on search.
Confidence intervals
Intervals are 95 % domain-cluster bootstraps with 10.000 resamples, resampling domains inside each bucket rather than requests, because pages on one domain are correlated.
Limitaciones
Each company’s product line spans tiers, and these rates reflect the tier each site had enabled during the benchmark window rather than the top of the range.
Companies that arrive bundled with a CDN and companies bought as a standalone purchase are not comparable on equal terms. A defence someone selected, paid for and tuned sits in front of a site with a known bot problem. This benchmark measures the outcome on real sites, not the products under matched configuration.
Añadir como fuente preferidaPreguntas frecuentes
La detección de bots decide, por solicitud o por sesión, si el cliente es un humano que maneja un navegador o un programa automatizado. La mitigación es la segunda mitad: elige la respuesta, que puede ser permitir la solicitud, limitarla, presentar un desafío o bloquearla. Un sistema puede clasificar una sesión como automatizada y aun así dejarla pasar, por lo que el recuento de despliegues y las tasas de bloqueo miden cosas diferentes.
Denominan la misma categoría de producto desde ángulos diferentes. G2 incluye la categoría como Bot Detection and Mitigation. Cloudflare, Fastly y Radware comercializan la gestión de bots. El glosario de Akamai utiliza mitigación de bots. Forrester renombró su evaluación a Bot and Agent Trust Management Software en junio de 2026, con el argumento de que una proporción creciente del tráfico automatizado son agentes de IA que actúan en nombre de usuarios reales.19 Gartner no tiene un cuadrante independiente para esto, y la capacidad se incluye dentro de Cloud Web Application and API Protection.
Significa que más solicitudes no devolvieron el contenido esperado en los dominios que defiende esa empresa. Frente a tres servicios comerciales de desbloqueo, Imperva devolvió un 46,6 % y Cloudflare un 6,7 %. Cada empresa se midió en los sitios que casualmente la utilizaban, con la configuración que tuvieran esos sitios, de modo que la cifra informa del resultado en dominios reales y no de una comparación de productos con una configuración equiparada.
Diez aparecieron en menos de 20 dominios y se dejaron fuera de los gráficos. Son Radware, Sucuri, Queue-it, Kasada, Azion, Cequence Security, Google Cloud Armor y las defensas internas de Naver, MercadoLibre e Instacart. Arkose Labs, Netacea, Fastly y AppTrana están activos en la categoría, pero no aparecieron como defensa principal en ningún dominio probado.
Más información
- E-Commerce Scraper: 5 proveedores comparados
- Los 5 mejores desbloqueadores de sitios web comparados
- Los desafíos más comunes del web scraping en 2026
- Soluciones WAF: comparación basada en evaluaciones comparativas
- Los mejores servicios de resolución de CAPTCHA en 2026
- Web scraping a gran escala: 7 proveedores comparados
Cita este benchmark
Elige el formato que se ajuste al lugar donde vas a publicar. Pegar la versión con enlace en tu CMS conserva el enlace de retroceso.
@misc{sari2026,
author = {Sarı, Ekrem},
title = {{Detección de bots: 9 proveedores anti-bot comparados}},
year = {2026},
month = aug,
howpublished = {\url{https://aimultiple.com/bot-detection-software}},
note = {AIMultiple. Recuperado el 12 de agosto de 2026}
}Resultados y marcas de tiempo de 25 puntos de datos. Descargue los datos resumidos que se muestran en los gráficos y las tablas de este artículo como un archivo ZIP que contiene 3 archivos CSV.
¿Quieres los datos granulares que hay detrás? Únete a Premium
Enlaces de referencia
Sé el primero en comentar
Tu dirección de correo electrónico no será publicada. Todos los campos son obligatorios. Los comentarios se dejan en su idioma original.