# Bypass PerimeterX (HUMAN) Press and Hold

> Bypass PerimeterX (HUMAN) when scraping: how to recognise the Press & Hold page, why clients are flagged, and one Web Unlocker call that returns the real page.

[Home](https://quanticdata.io/) / [Web Unlocker](https://quanticdata.io/web-unlocker/) / PerimeterX (HUMAN)

Web Unlocker · PerimeterX (HUMAN)

# How to bypass PerimeterX and the Press & Hold page

PerimeterX, now HUMAN Security, stops a scraper with a `403` page that says "Press & Hold to confirm you are a human". The Web Unlocker makes the request from a residential or mobile IP with a browser-grade client, so the page arrives before that challenge is shown, and retries on a fresh exit when it is.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-perimeterx-start-1) · [Read the docs](https://quanticdata.io/docs/#tag/Web-Unlocker/operation/unlockRequest)

- **9 of 9**: calls to PerimeterX-protected pages answered with the real page, canary of 11 November 2026
- **88.9%**: across all 27 protected targets of the same run
- **4.1 s**: median response across the run

- [What the block looks like](https://quanticdata.io/web-unlocker/bypass-perimeterx/#signs)
- [Why PerimeterX blocks a scraper](https://quanticdata.io/web-unlocker/bypass-perimeterx/#why)
- [Get the page](https://quanticdata.io/web-unlocker/bypass-perimeterx/#call)
- [Measured](https://quanticdata.io/web-unlocker/bypass-perimeterx/#measured)
- [Own stack or unlocker](https://quanticdata.io/web-unlocker/bypass-perimeterx/#compare)
- [Limits](https://quanticdata.io/web-unlocker/bypass-perimeterx/#limits)
- [FAQ](https://quanticdata.io/web-unlocker/bypass-perimeterx/#faq)

## What a PerimeterX block looks like

A browser gets a page with one button. A scraper that calls the site's API gets JSON it did not expect. Both are the same block.

| Where to look | What a PerimeterX block shows |
| --- | --- |
| Status code | `403`. An API or XHR call gets `403` with a JSON body instead of a page. |
| Page text | "Press & Hold to confirm you are a human (and not a bot)." The page title is "Access to this page has been denied". |
| Reference ID | A line that starts with "Reference ID #" and a long identifier, at the bottom of the page. |
| JSON body on API calls | Keys named `appId`, `jsClientSrc`, `blockScript`, `vid` and `uuid`. The `appId` starts with `PX`. |
| Elements and scripts | An element with the id `px-captcha`, and a script on a path that contains the `PX` app id. |
| Cookies | `_px3`, `_pxvid` and `_pxhd`, on some sites `pxcts`. `_px3` carries the risk score of the session. |

![A PerimeterX block and the page behind it: first the 403 answer with the words Press and Hold to confirm you are a human and a reference ID, then the challenge page replaced by the real page answering 200 after one Web Unlocker call, last the JSON answer with status 200, blocked false, the tier that served it, attempts and cost.](https://quanticdata.io/web-unlocker/bypass-perimeterx/diagram.webp?v=20261111g1)

*What PerimeterX answers to a script, and what one Web Unlocker call returns instead.*

## Why PerimeterX blocks a scraper

PerimeterX watches the session, not only the request. A script on every page of the site reports to its servers, and the verdict travels in the `_px3` cookie.

- First request: with no cookie yet, the decision rests on the IP, the TLS handshake and the headers. A scripted client is flagged here.
- On the page: the script collects browser and device signals and, later, how the pointer and the keyboard are used.
- On a low score: the site answers 403 with Press & Hold. Holding the button is a behaviour test: it measures how the press is made.
- On API calls: the same check answers with JSON, which breaks a scraper that expected data.

## Get the page behind PerimeterX with one call

Send the URL to the REST endpoint. With `mode: "auto"`, the default, the first attempt is a browser-grade request from a residential IP, which is what the first decision of PerimeterX looks at. A real browser opens the page when the site needs one, and a blocked attempt is retried on a fresh exit.

cURL:

```bash
curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'
```

Python:

```python
import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])
```

Node.js:

```javascript
const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));
```

When you call a site's JSON API, read `blocked` in the answer before you parse the body: a PerimeterX block on an API call is JSON too.

### What the answer tells you

| Field | What it says |
| --- | --- |
| `blocked` | `false` when the real page came back. `true` only when every attempt met the block; the block page is then in `body`. |
| `vendor` | The system the engine recognised on a blocked attempt. For this guide: `perimeterx`. |
| `blockClass` | Usually `captcha` for Press & Hold and `fingerprint` for a flat refusal. |
| `tier_served` | `tls` for a browser-grade request, `browser` when a real browser had to open the page. |
| `attempts`, `latency_ms` | How many tries the call took and how long it lasted. |
| `cost` | The bytes this call moved and what it was charged. |

## Measured, with a date

In the canary of 11 November 2026, all 9 calls to PerimeterX-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the [Web Unlocker status page](https://quanticdata.io/web-unlocker/status/).

## Your own scraper or the Web Unlocker

Getting past PerimeterX once is an afternoon. Staying past it every week is the work. This is what has to stay right, and who keeps it right.

| What has to be right | With your own scraper | With the Web Unlocker |
| --- | --- | --- |
| The IP address | You rent residential or mobile IPs and rotate them yourself. | Residential (Premium) or mobile exits, chosen by country, state and city. |
| The browser identity | Handshake, HTTP/2 settings and headers must describe one browser, and be updated with every browser release. | A browser-grade request on the first attempt, kept current for you. |
| The JavaScript check | You run real browsers for the pages that need one, and keep them from looking automated. | A real browser opens the page only when the site asks for one. |
| After a pass | You keep the `_px3` cookie alive with the script that renews it. | The session is kept for you while it is valid. |
| When a call still fails | You recognise the PerimeterX block page yourself and decide what to retry. | Retries on a fresh exit. The answer says `blocked`, `blockClass` and `vendor`. |

## What it is for, and what it does not do

- It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
- Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with `blocked: true` and `blockClass: "captcha"`, so your code can skip the page or try later.
- It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
- Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.

## PerimeterX and scraping: questions people ask

### What is the "Press & Hold to confirm you are a human" page?

It is the challenge page of PerimeterX, now part of HUMAN Security. The site scored your session as likely automated and answered 403 with a button to press and hold. The hold is a behaviour test, not a puzzle: it measures how the press is made, so a script cannot simply click it.

### Does the Web Unlocker press the Press & Hold button?

No. Press & Hold asks for a person and the Web Unlocker does not answer it. It gets the page by making the request in a way that is not challenged in the first place, and it retries from a fresh exit when a call does meet the challenge. If every attempt meets it, the answer says blocked: true with blockClass captcha.

### Why do I get JSON with appId and blockScript instead of data?

Your call to the site's API was blocked by PerimeterX. On API and XHR requests it answers 403 with a JSON body that names the app id and the block script, where a browser would show Press & Hold. Send the same URL through the Web Unlocker and read blocked and status in the answer to tell a block from real data.

### Does a residential proxy alone get past PerimeterX?

It helps with the first decision, which leans on the IP. The handshake of a scripted client and the missing browser signals still lower the score, and the challenge follows a few requests later. The Web Unlocker pairs residential and mobile exits with a browser-grade client and a real browser when needed.

### Is it legal to scrape a site protected by PerimeterX?

The protection system does not decide that. What matters is the page and the data: whether the page is public, what the terms of the site say, and which law covers the data, personal data above all. The Web Unlocker fetches pages anyone can open without signing in; it does not log in and it does not create accounts.

## Send the URL that PerimeterX blocks

Create the free account, open Web Unlocker in the dashboard and paste the URL into the test box. The answer shows the status, the tier that served the page, the attempts and the cost of the call.

[Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=bypass-perimeterx-start-2) · [How the Web Unlocker works](https://quanticdata.io/web-unlocker/)

Block pages:

- [Block page dictionary](https://quanticdata.io/web-unlocker/block-pages/)
- [Press and hold CAPTCHA](https://quanticdata.io/web-unlocker/press-and-hold-captcha/)
- [CAPTCHA when scraping](https://quanticdata.io/web-unlocker/captcha-when-scraping/)

Other systems:

- [Cloudflare](https://quanticdata.io/web-unlocker/bypass-cloudflare/)
- [DataDome](https://quanticdata.io/web-unlocker/bypass-datadome/)
- [Akamai Bot Manager](https://quanticdata.io/web-unlocker/bypass-akamai/)
- [Kasada](https://quanticdata.io/web-unlocker/bypass-kasada/)
- [Imperva (Incapsula)](https://quanticdata.io/web-unlocker/bypass-imperva/)
- [F5 BIG-IP and Shape](https://quanticdata.io/web-unlocker/bypass-f5/)
- [AWS WAF](https://quanticdata.io/web-unlocker/bypass-aws-waf/)

Also:

- [Web Unlocker](https://quanticdata.io/web-unlocker/)
- [Status and canary](https://quanticdata.io/web-unlocker/status/)
- [Residential proxies](https://quanticdata.io/residential-proxies/)
- [Mobile proxies](https://quanticdata.io/mobile-proxies/)
- [Web Scraper API](https://quanticdata.io/web-scraping-api/)

## References

By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData · Published 11 November 2026 · Updated 11 November 2026 · [Read as Markdown](https://quanticdata.io/web-unlocker/bypass-perimeterx/index.md)

- [HUMAN docs: the HUMAN Challenge (press and hold)](https://docs.humansecurity.com/applications/human-challenge)
- [HUMAN docs: Bot Defender overview](https://docs.humansecurity.com/applications/bd-overview)
- [HUMAN docs: use of cookies and web storage](https://docs.humansecurity.com/applications/use-of-cookies-web-storage)
- [Web Unlocker in the QuanticData API docs: request, answer, errors and blocked pages](https://quanticdata.io/docs/#tag/Web-Unlocker)
- [Web Unlocker status: the canary list, the method and every run](https://quanticdata.io/web-unlocker/status/)

---

Source: https://quanticdata.io/web-unlocker/bypass-perimeterx/ · Site index for AI: https://quanticdata.io/llms.txt