Block pages: what you see, and which anti-bot system it is

Start with the sentence on the page: each system prints its own, and it is the most reliable mark. Search this table for the words you see.

The status code alone is ambiguous. Read it together with what comes with it: the same code means different things on different systems.

When the page says nothing, the headers and the cookies still do. Most of these marks say which system is in front of the site, not that it stopped you: only the two response headers that name an action say that.

• The status code is not proof. Imperva and F5 BIG-IP often serve their block page with 200. Kasada answers a new visitor with 429 before any rate was exceeded. On AWS WAF a 405 is a puzzle, not a wrong method. Code that trusts the status stores block pages as data.
• The words are the best proof. Every system prints its own sentence, and sites rarely change it. One line of the body is enough to name the system: a reference, a support ID, an incident ID, a title.
• A mark is not a block. A cookie or a header says which system is in front of the site. It is on the answers that pass as well as on the ones that are stopped, so check the body before you call an answer blocked.

If you met one of these pages in your browser, the first steps are nearly always the same: JavaScript and cookies on, ad blockers and VPN off for that site, a normal up-to-date browser, one reload. When the page prints a reference, a Ray ID or a support ID, send it to the site: only its team can read it. The page of each message has the steps that fit it.

If a script of yours collects public pages and meets one of these, the system tells you what failed: the address, the client, a check that needs a browser, or a limit. Each guide explains its system, and one call to the Web Unlocker returns the page with the name of the system in the answer.

You do not have to read the block yourself. Send the URL to the REST endpoint: when the page comes back, blocked is false. When every attempt met a wall, the answer says which system it recognised in vendor and what kind of stop it was in blockClass.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

On the proxy endpoint the same two facts come back as the headers x-qp-vendor and x-qp-block-class.

What the answer tells you

The values of blockClass

The full list, with what to do for each value, is in the Web Unlocker section of the API docs.

Every row comes from the documentation of the system itself, listed at the foot of this page, and from the words the block pages print. Nothing here is taken from a forum.

The words and the marks are what each system sends by default. A site can restyle a block page, rename a cookie or change a status code, so treat one mark as a hint and two as an answer.

The canary of 11 November 2026 runs a fixed list of 27 protected targets, sites of the eight systems in these tables among them: 72 of 81 calls came back with the real page, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.