Anti-bot detection is systems protecting sites against automated traffic. They do not answer "is this a bot" with a simple yes/no — they output a score based on ~40 signals, and block above threshold.
Main players (2026):
- Cloudflare Bot Management — default for 30%+ of the internet. JS challenge ("Checking your browser…") is their signature.
- Akamai Bot Manager — Fortune 500 (banks, telecoms, premium retail). More aggressive than Cloudflare.
- Datadome — French, popular in EU e-commerce and ticketing.
- PerimeterX (HUMAN) — sneakers, drops, gaming. Hardest to bypass.
What they check: IP reputation, TLS fingerprint, HTTP/2 fingerprint, headers order, browser fingerprinting (canvas, WebGL, fonts, audio), behavioral (mouse curves, typing rhythm, scroll velocity).
Bypass for production: playwright-extra + stealth plugin, residential proxies, fingerprint rotation, real session warming. Accuracy 70-95% for protected targets — never 100%.