How to bypass Imperva Incapsula block pages

Imperva has two block pages, one for each of its layers, and it often serves them with a status code that looks like success.

Imperva is a cloud firewall in front of the site. Two of its layers stop scrapers, and they answer differently.

• The firewall layer classifies the client on the first request: IP reputation, the handshake, the headers. A refusal here is the incident page with its ID.
• The bot layer, Advanced Bot Protection, loads a script that inspects the browser and writes the reese84 cookie. A client that never runs it gets "Pardon Our Interruption".
• The session cookies visid_incap_ and incap_ses_ tie later requests to that first verdict. A request without them starts from zero.
• Many Imperva sites answer the check page with status 200. A scraper that only looks at the status stores a page of nothing and never notices.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP. When Imperva serves its check, a real browser opens the page, lets the script finish and returns the page behind it; a refused attempt is retried on a fresh exit.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

Do not trust the status code alone on Imperva sites. Read blocked in the answer: it is true when the page that came back is the check or the incident page, whatever status the site used.

What the answer tells you

The canary of 11 November 2026 runs a fixed list of 27 protected targets, Imperva sites among them: 72 of 81 calls came back with the real page, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

Getting past Imperva once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.