How to bypass F5 bot defense and "Request Rejected"

The F5 block is easy to miss, because the page that rejects you usually arrives with the status code of a normal answer.

Two F5 products do this job, and a site can run either or both.

• BIG-IP Advanced WAF sits in the site's own data centre. It checks each request against a policy and, with bot defense on, sends a JavaScript check to a client it has not seen. A violation gets the Request Rejected page.
• Shape, sold today as F5 Distributed Cloud Bot Defense, guards the valuable calls: login, search, prices, checkout. A script on the page signs those calls with data about the browser, and the server refuses a call whose signature is missing or wrong.
• Both judge the client first: the IP, the handshake and the headers decide whether the request is even given the check.
• The rejection page is the same for a bot and for a broken form, which is why the support ID is the only clue the page gives.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP; when the site answers with its JavaScript check, a real browser opens the page, lets it reload and returns what arrived.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

On F5 sites, read blocked rather than status: a rejection page served with 200 comes back with blocked: true. To reach content that appears only after a click or a search, add an actions list to the call.

What the answer tells you

In the canary of 11 November 2026, all 6 calls to F5-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

Getting past F5 once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.