How to bypass AWS WAF challenge and CAPTCHA pages

AWS WAF is unusual in that the status code tells you exactly which action the rule took. One response header confirms it.

AWS WAF is a rule engine. The owner of the site chooses which rule groups run and what each one does: count, block, challenge or CAPTCHA. The Bot Control group is the one that looks for scrapers.

• Common bots: requests are matched on the User-Agent, on the IP ranges of hosting providers and on the signatures of known libraries. A match is blocked with 403.
• Targeted bots: Bot Control follows each client through a token and scores its behaviour: the request rate, how the session moves, signs of automation in the browser.
• Challenge: a script runs silently in the browser, proves that it is one and stores the aws-waf-token. An HTTP client cannot run it and stays on 202.
• CAPTCHA: when the rule asks for a person, the puzzle page comes with 405, and passing it renews the token.
• The token expires after a few minutes by default, so a scraper that gets through once is asked again soon.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP. When AWS WAF answers 202, a real browser opens the page, runs the challenge, and returns the page that loads after it.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

A 405 on an AWS WAF site is the CAPTCHA action, not a wrong method: changing the method does not help. Keep calling from the same account so that the session is reused while its token is valid.

What the answer tells you

The canary of 11 November 2026 runs a fixed list of 27 protected targets, AWS WAF sites among them: 72 of 81 calls came back with the real page, with a median response of 4.1 s.

The first request to a protected site waits for the site's own check. The next ones from the same account reuse the session: in our test of 11 November 2026, four requests in a row to the same AWS WAF-protected page took 6.6 s, 1.8 s, 4.3 s and 1.8 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

Getting past AWS WAF once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.