The press and hold CAPTCHA: "Press & Hold to confirm you are a human"

A browser gets a page with one button. Code that calls the site's API gets JSON it did not expect. Both are the same block, and the same company wrote both.

It is a real check and a short one: press the button, keep it down until the bar fills, release. Sites use it in place of picture puzzles. When it answers "Please try again" or keeps coming back, the page could not read the press, or the session still looks automated.

• Hold with one steady press, mouse or finger, until the bar completes. Do not click again and again.
• Pause ad blockers and privacy extensions on the site and reload: they can block the script that reads the press.
• Turn off the VPN or proxy. On a shared address the score stays low, and the button returns after each pass.
• Allow cookies for the site. The pass is stored in a cookie, and without it the next page asks again.
• Use a normal window of an up-to-date browser rather than an in-app browser.
• The challenge works from the keyboard, and a site can switch on an enhanced accessibility mode. If you cannot hold a button, ask the site's support for another way in.

PerimeterX watches the session, not only one request. A script on every page of the site reports to its servers, and the verdict travels in the _px3 cookie.

• First request: with no cookie yet, the decision rests on the address, the handshake and the headers. A scripted client is flagged here.
• On the page: the site's script collects browser and device signals, and how the pointer and the keyboard are used.
• On a low score: the answer is the 403 with the button. The hold is a behaviour test. The page records pointer, touch and keyboard events while the button is down, so a scripted click does not pass.
• On API calls: the same block is JSON with appId and blockScript, which breaks code that expected data.

The whole picture of the system is in the guide: Bypass PerimeterX (HUMAN) Press and Hold.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP, which is what the first decision looks at. A real browser opens the page when the site needs one, and a blocked attempt is retried on a fresh exit. The button is never pressed.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

When you call a site's JSON API, read blocked in the answer before you parse the body: a block on an API call is JSON too.

What the answer tells you

In the canary of 11 November 2026, all 9 calls to PerimeterX-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.