The dirty secret of “99% success rate” claims

Every scraping service claims high success rates. Bright Data: “99.9% success.” ScraperAPI: “99% uptime.” ZenRows: “98.7% success.” Oxylabs: “99.2% success.”

These numbers aren’t lies. They’re misdirection.

These services achieve high success rates on sites with basic anti-bot protection — the kind that blocks the most obvious bots and lets everything else through. Then they advertise those numbers as if they apply to all websites.

Try those same services on a site protected by Akamai Bot Manager, DataDome, PerimeterX, or Kasada. The “99% success rate” drops to 0-60%. But you won’t find that in their marketing materials.

The web scraping industry has a classification problem. Not all anti-bot protection is created equal, and the difference between basic and advanced is the difference between a locked screen door and a bank vault.

Basic anti-bot protection: what it looks like

Basic anti-bot protection is designed to stop the laziest bots — scripts that send raw HTTP requests without any browser emulation. Here’s what basic protection includes:

IP rate limiting

Block IPs that send more than X requests per minute. The simplest defense. Defeated by any proxy rotation service.

User-Agent validation

Reject requests with missing, empty, or known-bot User-Agent strings (like python-requests/2.28). Defeated by setting a Chrome User-Agent header.

Basic header checking

Check for the presence of standard browser headers (Accept, Accept-Language, Accept-Encoding). Defeated by copying headers from a real browser request.

Simple Cloudflare (free/pro tier)

Cloudflare’s free and Pro plans offer basic JavaScript challenges and managed rules. These challenges are well-documented, and most scraping libraries can solve them automatically.

Basic CAPTCHAs

Simple image CAPTCHAs or hCaptcha challenges that can be solved with CAPTCHA-solving services at $1-3 per 1,000 solves.

Who handles basic protection well: Everyone. Bright Data, ScraperAPI, ZenRows, Oxylabs, Apify, Crawlee — any service with proxy rotation and basic browser emulation handles these sites with 95%+ success rates. This is where their “99% success” numbers come from.

Advanced anti-bot protection: a different universe

Advanced anti-bot protection doesn’t just check if you look like a browser. It analyzes whether you are a browser, using ML models trained on billions of request signals. Here are the major advanced systems:

Akamai Bot Manager

Akamai protects roughly 30% of the world’s top websites. Their Bot Manager uses:

  • Device fingerprinting via sensor data: Their JavaScript sensor collects 150+ signals including canvas fingerprints, WebGL data, font enumeration, and browser API availability. This data generates the _abck cookie.
  • TLS fingerprinting: JA3/JA4 analysis of the TLS handshake, matched against a database of known client fingerprints.
  • Behavioral biometrics: Continuous analysis of mouse movements, keystrokes, and touch events.
  • Session reputation: Cross-request correlation that tracks fingerprint consistency across a session.

Akamai doesn’t just challenge suspicious requests. It builds a comprehensive behavioral profile and blocks at the session level.

DataDome

DataDome specializes in real-time bot detection with sub-2ms decision latency:

  • First-request classification: DataDome makes a bot/human decision on the very first request, before any behavioral data exists. It uses TLS fingerprint, header analysis, and IP reputation for initial classification.
  • ML ensemble models: Gradient-boosted trees for structured features, neural networks for sequential behavioral data.
  • Device intelligence: Comprehensive JavaScript-based fingerprinting that detects headless browsers, automation frameworks, and stealth plugins.

DataDome is particularly aggressive — one suspicious signal can block an entire session permanently.

PerimeterX (HUMAN Security)

PerimeterX is the behavioral analysis specialist:

  • Advanced mouse movement analysis: They analyze not just that you moved the mouse, but the mathematical properties of the movement — velocity, acceleration, jerk (third derivative of position), curvature. Programmatic mouse movements have different statistical distributions than human movements.
  • Interaction sequencing: The order and timing of all page interactions are modeled against human baselines.
  • Canvas and audio fingerprinting: Deep fingerprint analysis that detects spoofing through statistical anomalies.

Kasada

Kasada takes a unique approach with proof-of-work challenges:

  • Dynamic JavaScript challenges: Kasada generates unique JavaScript challenges that require real browser execution. The challenges change frequently, preventing static solutions.
  • Client-side computation: Proof-of-work puzzles that verify genuine browser execution capabilities.
  • Telemetry analysis: Extensive device and behavioral telemetry that’s evaluated server-side.

Kasada is particularly effective against headless browser farms because their challenges stress-test browser capabilities that headless environments often lack.

Cloudflare Turnstile (managed/enterprise)

Cloudflare’s advanced offering goes far beyond their basic JavaScript challenge:

  • Managed challenges: Adaptive challenges that adjust difficulty based on threat signals.
  • Private Access Tokens: Integration with device attestation frameworks.
  • ML-based threat scoring: Comprehensive request analysis using Cloudflare’s massive traffic visibility.

Why Bright Data, ScraperAPI, and ZenRows fail on advanced protection

These services use a fundamentally flawed approach for advanced anti-bot sites:

Bright Data

Bright Data’s approach: route requests through residential proxies, render with headless browsers, and hope for the best. On basic sites, this works because IP rotation and browser rendering are sufficient. On Akamai Bot Manager, their headless browser fingerprint gets caught by sensor analysis, their TLS fingerprint is cataloged, and their behavioral patterns are flagged. Residential IPs don’t help when the browser environment is the detection target.

Typical success rate on advanced sites: 40-60%

ScraperAPI

ScraperAPI’s “anti-bot” mode is retry logic with a marketing budget. When a request fails, they retry from a different IP with the same browser configuration. On DataDome, every retry fails identically because the fingerprint — not the IP — is the problem. Their basic headless browser rendering doesn’t pass advanced JavaScript challenges.

Typical success rate on advanced sites: 5-20%

ZenRows

ZenRows claims “AI-powered” anti-bot bypass. Their approach uses premium proxies and headless browser rendering with stealth configurations. Against advanced anti-bot systems, their headless browsers get fingerprinted like everyone else’s. “AI-powered” doesn’t mean anything when the anti-bot system’s AI is trained on billions more data points than yours.

Typical success rate on advanced sites: 20-40%

Oxylabs

Oxylabs combines residential proxies with their Web Scraper API’s browser rendering. Same story: the browser environment gets detected, the residential IP provides no meaningful cover. They’re slightly better than ScraperAPI on some Akamai configurations but still fail consistently on DataDome and PerimeterX.

Typical success rate on advanced sites: 30-50%

How to identify which protection level your target uses

Before choosing a scraping service, identify the anti-bot protection on your target site. Here’s how:

Quick identification methods

  1. Check for known anti-bot scripts: Open DevTools on the target site and look for script sources:

    • *.akamaihd.net or _abck cookie → Akamai Bot Manager
    • *.datadome.co or datadome cookie → DataDome
    • *.perimeterx.net or *.px-cdn.net or _px cookies → PerimeterX
    • *.kasada.io or cd.js → Kasada
    • challenges.cloudflare.com → Cloudflare Turnstile

  2. Try a basic request: Send a curl request with a Chrome User-Agent. If you get the full page content, it’s basic protection (or none). If you get a challenge page or empty response, it’s likely advanced.

  3. Check the challenge type: If you see a full-page interstitial with a “checking your browser” message, note the provider branding. Advanced systems often show branded challenge pages.

The critical decision

If your target has basic protection: Use whatever scraping service is cheapest. They all work. Don’t overpay for Bright Data when ScraperAPI or a simple proxy with Playwright will do the job.

If your target has advanced protection: Generic scraping services will burn your budget with failed requests. You need a service that reverse-engineers the specific anti-bot deployment and uses real browser environments that pass fingerprint analysis.

We built UltraWebScrapingAPI for the hard sites

We don’t pretend to be the best option for scraping a basic Wordpress blog. Use whatever you want for that.

We exist for the sites that Bright Data, ScraperAPI, ZenRows, and Oxylabs can’t handle. Akamai Bot Manager with aggressive sensor configurations. DataDome with first-request blocking. PerimeterX with advanced behavioral analysis. Kasada with dynamic proof-of-work challenges.

Our approach:

  • Real Chrome browsers with authentic fingerprints — not headless, not stealth-patched
  • Per-site reverse engineering of the specific anti-bot configuration
  • Custom bypass strategies tailored to each target’s exact detection rules
  • 90%+ success guarantee (typically 99%+) on the hardest anti-bot sites

Test any URL in our playground — paste a Akamai, DataDome, or PerimeterX-protected URL and see the difference between a service built for basic sites and one built for advanced anti-bot protection.