# Bypass Kasada Bot Protection: the 429 Page

> Bypass Kasada when scraping: how to recognise its 429 answer with an empty page, why scripted clients never pass it, and one call that returns the real page.

[Home](https://quanticdata.io/) / [Web Unlocker](https://quanticdata.io/web-unlocker/) / Kasada

Web Unlocker · Kasada

# How to bypass Kasada and its empty 429 page

Kasada answers a scraper with a `429` and a page that holds nothing but a script. A browser runs the script and the page reloads; an HTTP client stays on the 429. The Web Unlocker opens a real browser on a residential or mobile IP, waits for the reload and returns the page in one JSON answer.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-kasada-start-1) · [Read the docs](https://quanticdata.io/docs/#tag/Web-Unlocker/operation/unlockRequest)

- **6 of 6**: calls to Kasada-protected pages answered with the real page, canary of 11 November 2026
- **88.9%**: across all 27 protected targets of the same run
- **4.1 s**: median response across the run

- [What the block looks like](https://quanticdata.io/web-unlocker/bypass-kasada/#signs)
- [Why Kasada blocks a scraper](https://quanticdata.io/web-unlocker/bypass-kasada/#why)
- [Get the page](https://quanticdata.io/web-unlocker/bypass-kasada/#call)
- [Measured](https://quanticdata.io/web-unlocker/bypass-kasada/#measured)
- [Own stack or unlocker](https://quanticdata.io/web-unlocker/bypass-kasada/#compare)
- [Limits](https://quanticdata.io/web-unlocker/bypass-kasada/#limits)
- [FAQ](https://quanticdata.io/web-unlocker/bypass-kasada/#faq)

## What a Kasada block looks like

Kasada shows no message and no captcha. The block is a status code that seems to mean something else, and a page with nothing on it.

| Where to look | What a Kasada block shows |
| --- | --- |
| Status code | `429` on the first request of a new visitor, even at one request a day. It is not a rate limit. |
| Body | An almost empty HTML page: a `script` tag and nothing to read. No message, no captcha. |
| Script path | A file named `ips.js` under two long random folder names, on the site's own domain. |
| Request headers | After the script ran, the browser adds `x-kpsdk-ct` and `x-kpsdk-cd` to its API calls. Without them those calls get `429`. |
| Cookies | A pair of session cookies: `KP_UIDz` and `KP_UIDz-ssn`, or a name chosen by the site and the same name ending in `-ssn`. |
| What a person sees | A blank page for a moment, then the site. Nothing to click. |

![A Kasada block and the page behind it: first the 429 answer with an empty page that holds one script named ips.js, then that page replaced by the real page answering 200 after one Web Unlocker call, last the JSON answer with status 200, blocked false, the tier that served it, attempts and cost.](https://quanticdata.io/web-unlocker/bypass-kasada/diagram.webp?v=20261111g1)

*What Kasada answers to a script, and what one Web Unlocker call returns instead.*

## Why Kasada blocks a scraper

Kasada does not ask a visitor to prove anything by hand. It makes every new visitor prove it is a real browser before the site answers at all.

- The first answer is always the script. It runs inside the browser, checks that the environment is a genuine one and does a small piece of computing work.
- The result goes back as a token. Only then does the page reload with the real content.
- Every API call after that has to carry fresh `x-kpsdk` headers produced by the same script.
- The script changes often, so an answer written by hand stops working without notice.
- For a scraper this means the first request to a Kasada site needs a real browser. There is no cheaper path.

## Get the page behind Kasada with one call

Send the URL to the REST endpoint. On a Kasada site the engine opens a real browser on a residential IP, lets the script run, waits for the page to reload and returns the page that arrived after the reload, with the status of that page.

cURL:

```bash
curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'
```

Python:

```python
import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])
```

Node.js:

```javascript
const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));
```

Leave `mode` on `auto`. With `mode: "tls"` no browser is opened, and on a Kasada site the first call then comes back blocked. For many pages of one site, keep calling from the same account so that the session is reused.

### What the answer tells you

| Field | What it says |
| --- | --- |
| `blocked` | `false` when the real page came back. `true` only when every attempt met the block; the block page is then in `body`. |
| `vendor` | The system the engine recognised on a blocked attempt. For this guide: `kasada`. |
| `blockClass` | Usually `fingerprint` for the 429 that a client without JavaScript receives. |
| `tier_served` | `tls` for a browser-grade request, `browser` when a real browser had to open the page. |
| `attempts`, `latency_ms` | How many tries the call took and how long it lasted. |
| `cost` | The bytes this call moved and what it was charged. |

## Measured, with a date

In the canary of 11 November 2026, all 6 calls to Kasada-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

The first request to a protected site waits for the site's own check. The next ones from the same account reuse the session: in our test of 11 November 2026, four requests in a row to the same Kasada-protected page took 11.9 s, 1.9 s, 1.9 s and 1.8 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the [Web Unlocker status page](https://quanticdata.io/web-unlocker/status/).

## Your own scraper or the Web Unlocker

Getting past Kasada once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

| What has to be right | With your own scraper | With the Web Unlocker |
| --- | --- | --- |
| The IP address | You rent residential or mobile IPs and rotate them yourself. | Residential (Premium) or mobile exits, chosen by country, state and city. |
| The browser identity | Handshake, HTTP/2 settings and headers must describe one browser, and be updated with every browser release. | A browser-grade request on the first attempt, kept current for you. |
| The JavaScript check | You run real browsers for the pages that need one, and keep them from looking automated. | A real browser opens the page only when the site asks for one. |
| After a pass | You keep the session cookies and produce fresh `x-kpsdk` headers for every API call. | The session is reused for your next calls to that site. |
| When a call still fails | You recognise the Kasada block page yourself and decide what to retry. | Retries on a fresh exit. The answer says `blocked`, `blockClass` and `vendor`. |

## What it is for, and what it does not do

- It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
- Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with `blocked: true` and `blockClass: "captcha"`, so your code can skip the page or try later.
- It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
- Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.

## Kasada and scraping: questions people ask

### Why does Kasada return 429 on my very first request?

Because the 429 is not a rate limit there. Kasada answers every new visitor with a 429 and a script; a browser runs it, proves itself and is sent back to the page. A client that cannot run JavaScript keeps receiving the same 429, however slowly it asks.

### Can I bypass Kasada with requests, cURL or a headless browser?

Not with an HTTP client: the script has to run. A headless browser runs it, but the script looks for the marks that automation leaves in a browser and withholds the token when it finds them. The Web Unlocker opens a real browser on a residential or mobile IP for the first call and returns the page it gets.

### What are the x-kpsdk-ct and x-kpsdk-cd headers?

They are the tokens that Kasada's script adds to the browser's API calls after it has run: one identifies the validated session, the other answers a small computing challenge for each request. The API of a protected site refuses calls without them. They are produced in the browser and do not survive being copied to another session.

### Is the Kasada check paid on every call?

No. The first call waits for the script to run and the page to reload. After that, your calls to the same site reuse the session until the site asks again. In our test of 11 November 2026, four calls in a row to the same Kasada-protected page took 11.9, 1.9, 1.9 and 1.8 seconds.

### Is it legal to scrape a site protected by Kasada?

The protection system does not decide that. What matters is the page and the data: whether the page is public, what the terms of the site say, and which law covers the data, personal data above all. The Web Unlocker fetches pages anyone can open without signing in; it does not log in and it does not create accounts.

## Send the URL that Kasada blocks

Create the free account, open Web Unlocker in the dashboard and paste the URL into the test box. The answer shows the status, the tier that served the page, the attempts and the cost of the call.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-kasada-start-2) · [How the Web Unlocker works](https://quanticdata.io/web-unlocker/)

Block pages:

- [Block page dictionary](https://quanticdata.io/web-unlocker/block-pages/)
- [CAPTCHA when scraping](https://quanticdata.io/web-unlocker/captcha-when-scraping/)

Other systems:

- [Cloudflare](https://quanticdata.io/web-unlocker/bypass-cloudflare/)
- [DataDome](https://quanticdata.io/web-unlocker/bypass-datadome/)
- [Akamai Bot Manager](https://quanticdata.io/web-unlocker/bypass-akamai/)
- [PerimeterX (HUMAN)](https://quanticdata.io/web-unlocker/bypass-perimeterx/)
- [Imperva (Incapsula)](https://quanticdata.io/web-unlocker/bypass-imperva/)
- [F5 BIG-IP and Shape](https://quanticdata.io/web-unlocker/bypass-f5/)
- [AWS WAF](https://quanticdata.io/web-unlocker/bypass-aws-waf/)

Also:

- [Web Unlocker](https://quanticdata.io/web-unlocker/)
- [Status and canary](https://quanticdata.io/web-unlocker/status/)
- [Residential proxies](https://quanticdata.io/residential-proxies/)
- [Mobile proxies](https://quanticdata.io/mobile-proxies/)
- [Web Scraper API](https://quanticdata.io/web-scraping-api/)

## References

By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData · Published 11 November 2026 · Updated 11 November 2026 · [Read as Markdown](https://quanticdata.io/web-unlocker/bypass-kasada/index.md)

- [Kasada: how its bot defense works (the product documentation needs a customer login)](https://www.kasada.io/bot-defense)
- [RFC 6585, section 4: 429 Too Many Requests](https://www.rfc-editor.org/rfc/rfc6585.html#section-4)
- [Web Unlocker in the QuanticData API docs: request, answer, errors and blocked pages](https://quanticdata.io/docs/#tag/Web-Unlocker)
- [Web Unlocker status: the canary list, the method and every run](https://quanticdata.io/web-unlocker/status/)

---

Source: https://quanticdata.io/web-unlocker/bypass-kasada/ · Site index for AI: https://quanticdata.io/llms.txt