# Bypass Imperva Incapsula When Scraping

> Bypass Imperva Incapsula when scraping: what Pardon Our Interruption and the Incapsula incident ID mean, and one Web Unlocker call that returns the real page.

[Home](https://quanticdata.io/) / [Web Unlocker](https://quanticdata.io/web-unlocker/) / Imperva (Incapsula)

Web Unlocker · Imperva (Incapsula)

# How to bypass Imperva Incapsula block pages

Imperva, formerly Incapsula, stops a scraper with a page titled "Pardon Our Interruption" or with "Request unsuccessful. Incapsula incident ID". The Web Unlocker sends the URL from a residential or mobile IP, lets a real browser clear the check when one is served, retries on a fresh exit, and returns the page as JSON.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-imperva-start-1) · [Read the docs](https://quanticdata.io/docs/#tag/Web-Unlocker/operation/unlockRequest)

- **88.9%**: calls answered with the real page across 27 protected targets, Imperva among them, canary of 11 November 2026
- **81**: calls, 3 runs, default settings
- **4.1 s**: median response across the run

- [What the block looks like](https://quanticdata.io/web-unlocker/bypass-imperva/#signs)
- [Why Imperva blocks a scraper](https://quanticdata.io/web-unlocker/bypass-imperva/#why)
- [Get the page](https://quanticdata.io/web-unlocker/bypass-imperva/#call)
- [Measured](https://quanticdata.io/web-unlocker/bypass-imperva/#measured)
- [Own stack or unlocker](https://quanticdata.io/web-unlocker/bypass-imperva/#compare)
- [Limits](https://quanticdata.io/web-unlocker/bypass-imperva/#limits)
- [FAQ](https://quanticdata.io/web-unlocker/bypass-imperva/#faq)

## What an Imperva block looks like

Imperva has two block pages, one for each of its layers, and it often serves them with a status code that looks like success.

| Where to look | What an Imperva block shows |
| --- | --- |
| Status code | `403` on a refusal. The check page can come with `200`, so the status alone does not tell you. |
| Page text | "Pardon Our Interruption. As you were browsing, something about your browser made us think you were a bot." |
| Incident page | "Request unsuccessful. Incapsula incident ID:" followed by a number with a dash in it. |
| Frame | An `iframe` whose source starts with `/_Incapsula_Resource?`. On a blocked answer it is the only content of the page. |
| Response headers | `x-iinfo` on every answer, and `x-cdn: Imperva` or `x-cdn: Incapsula`. |
| Cookies | `visid_incap_` and `incap_ses_` followed by the id of the site, `nlbi_`, and `reese84` on sites that run Advanced Bot Protection. |

![An Imperva Incapsula block and the page behind it: first the 403 answer with the words Pardon Our Interruption, the incident ID variant and the _Incapsula_Resource mark, then the check page replaced by the real page answering 200 after one Web Unlocker call, last the JSON answer with status 200, blocked false, the tier that served it, attempts and cost.](https://quanticdata.io/web-unlocker/bypass-imperva/diagram.webp?v=20261111g1)

*What Imperva answers to a script, and what one Web Unlocker call returns instead.*

## Why Imperva blocks a scraper

Imperva is a cloud firewall in front of the site. Two of its layers stop scrapers, and they answer differently.

- The firewall layer classifies the client on the first request: IP reputation, the handshake, the headers. A refusal here is the incident page with its ID.
- The bot layer, Advanced Bot Protection, loads a script that inspects the browser and writes the `reese84` cookie. A client that never runs it gets "Pardon Our Interruption".
- The session cookies `visid_incap_` and `incap_ses_` tie later requests to that first verdict. A request without them starts from zero.
- Many Imperva sites answer the check page with status 200. A scraper that only looks at the status stores a page of nothing and never notices.

## Get the page behind Imperva with one call

Send the URL to the REST endpoint. With `mode: "auto"`, the default, the first attempt is a browser-grade request from a residential IP. When Imperva serves its check, a real browser opens the page, lets the script finish and returns the page behind it; a refused attempt is retried on a fresh exit.

cURL:

```bash
curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'
```

Python:

```python
import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])
```

Node.js:

```javascript
const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));
```

Do not trust the status code alone on Imperva sites. Read `blocked` in the answer: it is `true` when the page that came back is the check or the incident page, whatever status the site used.

### What the answer tells you

| Field | What it says |
| --- | --- |
| `blocked` | `false` when the real page came back. `true` only when every attempt met the block; the block page is then in `body`. |
| `vendor` | The system the engine recognised on a blocked attempt. For this guide: `imperva`. |
| `blockClass` | Usually `js_challenge` for the check that a browser clears, `captcha` when the page asks a person, and `access_denied` for the incident page. |
| `tier_served` | `tls` for a browser-grade request, `browser` when a real browser had to open the page. |
| `attempts`, `latency_ms` | How many tries the call took and how long it lasted. |
| `cost` | The bytes this call moved and what it was charged. |

## Measured, with a date

The canary of 11 November 2026 runs a fixed list of 27 protected targets, Imperva sites among them: 72 of 81 calls came back with the real page, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the [Web Unlocker status page](https://quanticdata.io/web-unlocker/status/).

## Your own scraper or the Web Unlocker

Getting past Imperva once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

| What has to be right | With your own scraper | With the Web Unlocker |
| --- | --- | --- |
| The IP address | You rent residential or mobile IPs and rotate them yourself. | Residential (Premium) or mobile exits, chosen by country, state and city. |
| The browser identity | Handshake, HTTP/2 settings and headers must describe one browser, and be updated with every browser release. | A browser-grade request on the first attempt, kept current for you. |
| The JavaScript check | You run real browsers for the pages that need one, and keep them from looking automated. | A real browser opens the page only when the site asks for one. |
| After a pass | You keep `visid_incap_`, `incap_ses_` and `reese84` together, from the client that earned them. | The session is kept for you while it is valid. |
| When a call still fails | You recognise the Imperva block page yourself and decide what to retry. | Retries on a fresh exit. The answer says `blocked`, `blockClass` and `vendor`. |

## What it is for, and what it does not do

- It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
- Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with `blocked: true` and `blockClass: "captcha"`, so your code can skip the page or try later.
- It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
- Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.

## Imperva and scraping: questions people ask

### What does "Pardon Our Interruption" mean?

It is the bot check of Imperva's Advanced Bot Protection. The site decided that your browser or script looked automated, often because JavaScript or cookies were off or the requests came too fast, and showed this page instead of the content. A real browser passes it; a script receives it again on every request.

### What is an Incapsula incident ID?

It is the reference Imperva prints when its firewall refuses a request: Request unsuccessful, Incapsula incident ID, then a number. The site owner can look the ID up to see which rule fired. For you it means the request was stopped at the firewall, before the site and before any JavaScript check.

### Can I bypass Incapsula with Python requests?

Seldom on a protected page. A requests call has no browser handshake and cannot run the script that sets the reese84 cookie, so it gets the incident page or the interruption page. One POST to the Web Unlocker from Python makes the request with a browser-grade client and opens a real browser when the check is served.

### Why does my scraper get status 200 and an empty page from an Imperva site?

Because Imperva often serves its check page with status 200. The body holds only a frame that loads /_Incapsula_Resource, and no content. Look at the size and the text, not at the status. The Web Unlocker does this for you: the answer says blocked: true when the page that came back is the check.

### Is it legal to scrape a site protected by Imperva?

The protection system does not decide that. What matters is the page and the data: whether the page is public, what the terms of the site say, and which law covers the data, personal data above all. The Web Unlocker fetches pages anyone can open without signing in; it does not log in and it does not create accounts.

## Send the URL that Imperva blocks

Create the free account, open Web Unlocker in the dashboard and paste the URL into the test box. The answer shows the status, the tier that served the page, the attempts and the cost of the call.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-imperva-start-2) · [How the Web Unlocker works](https://quanticdata.io/web-unlocker/)

Block pages:

- [Block page dictionary](https://quanticdata.io/web-unlocker/block-pages/)
- ["Pardon Our Interruption"](https://quanticdata.io/web-unlocker/pardon-our-interruption/)
- [CAPTCHA when scraping](https://quanticdata.io/web-unlocker/captcha-when-scraping/)

Other systems:

- [Cloudflare](https://quanticdata.io/web-unlocker/bypass-cloudflare/)
- [DataDome](https://quanticdata.io/web-unlocker/bypass-datadome/)
- [Akamai Bot Manager](https://quanticdata.io/web-unlocker/bypass-akamai/)
- [PerimeterX (HUMAN)](https://quanticdata.io/web-unlocker/bypass-perimeterx/)
- [Kasada](https://quanticdata.io/web-unlocker/bypass-kasada/)
- [F5 BIG-IP and Shape](https://quanticdata.io/web-unlocker/bypass-f5/)
- [AWS WAF](https://quanticdata.io/web-unlocker/bypass-aws-waf/)

Also:

- [Web Unlocker](https://quanticdata.io/web-unlocker/)
- [Status and canary](https://quanticdata.io/web-unlocker/status/)
- [Residential proxies](https://quanticdata.io/residential-proxies/)
- [Mobile proxies](https://quanticdata.io/mobile-proxies/)
- [Web Scraper API](https://quanticdata.io/web-scraping-api/)

## References

By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData · Published 11 November 2026 · Updated 11 November 2026 · [Read as Markdown](https://quanticdata.io/web-unlocker/bypass-imperva/index.md)

- [Imperva docs: Cloud WAF error pages and codes](https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/error-codes.htm)
- [Imperva docs: CAPTCHA and challenge behavior](https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/captcha-challenges.htm)
- [Imperva docs: Advanced Bot Protection](https://docs-cybersec.thalesgroup.com/bundle/advanced-bot-protection/page/abp/94085.htm)
- [Web Unlocker in the QuanticData API docs: request, answer, errors and blocked pages](https://quanticdata.io/docs/#tag/Web-Unlocker)
- [Web Unlocker status: the canary list, the method and every run](https://quanticdata.io/web-unlocker/status/)

---

Source: https://quanticdata.io/web-unlocker/bypass-imperva/ · Site index for AI: https://quanticdata.io/llms.txt