How to bypass PerimeterX and the Press & Hold page

A browser gets a page with one button. A scraper that calls the site's API gets JSON it did not expect. Both are the same block.

PerimeterX watches the session, not only the request. A script on every page of the site reports to its servers, and the verdict travels in the _px3 cookie.

• First request: with no cookie yet, the decision rests on the IP, the TLS handshake and the headers. A scripted client is flagged here.
• On the page: the script collects browser and device signals and, later, how the pointer and the keyboard are used.
• On a low score: the site answers 403 with Press & Hold. Holding the button is a behaviour test: it measures how the press is made.
• On API calls: the same check answers with JSON, which breaks a scraper that expected data.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP, which is what the first decision of PerimeterX looks at. A real browser opens the page when the site needs one, and a blocked attempt is retried on a fresh exit.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

When you call a site's JSON API, read blocked in the answer before you parse the body: a PerimeterX block on an API call is JSON too.

What the answer tells you

In the canary of 11 November 2026, all 9 calls to PerimeterX-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

Getting past PerimeterX once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.