Three systems protect most of the commercial internet. Together ~50% of top 100k sites have one of them. Each has its own detection methodology and bypass difficulty.
Cloudflare Bot Management
Most popular. Every request goes through Cloudflare edge network — they see everything (IP reputation across the whole network, TLS fingerprints, HTTP/2, behavioral).
Detection signature: JS challenge ("Checking your browser… Just a moment"). Although Turnstile (Cloudflare CAPTCHA) is invisible in 90% of cases.
Bypass difficulty: medium. Residential proxy + Playwright stealth + reasonable rate = ~85-95% success. Premium tier requires consistent fingerprint + warmed sessions.
Identification in the wild: headers cf-ray, cf-cache-status; cookie __cf_bm.
Akamai Bot Manager
Enterprise focus — banks, telecoms, premium retail (Nike, Adidas). Most advanced behavioral analysis. Hard-bans more aggressively than Cloudflare.
Detection signature: rarely visible challenge, more often silent block (403) or fake responses (returns dummy data). Hard to debug.
Bypass difficulty: hard. Requires premium residential / mobile proxy, full stealth, behavioral simulation (mouse curves, typing rhythm), warmed sessions. 60-85% success rate.
Identification: headers akamai-x-cache, x-akamai-transformed; cookies _abck, bm_sz.
Datadome
French, popular in EU. Specialty: high-traffic e-commerce (Cdiscount, Veepee, partially Allegro in PL), ticketing, news media.
Detection signature: page captcha challenge (geometric shapes), silent 403, deception (fake products with fake prices for detected bots).
Bypass difficulty: hard. Specialize in ML-driven behavioral detection. Requires mobile proxies (residential is not enough), behavioral patterns, captcha solving service. 50-80% success rate, requires ongoing maintenance.
Identification: cookies datadome, response headers x-dd-b.