DataDome CAPTCHA and Blocks, With PerimeterX and hCaptcha

Only after these, and only for public pages the terms allow, does the setup in the rest of this article apply. ProxyField's rule for every site: public pages only, and follow the site's terms.

Blocked while browsing as a person? Use a current browser with JavaScript and cookies on, pause privacy extensions, turn off any VPN or proxy, wait a few minutes before you reload, and contact the retailer if the block stays. DataDome's Device Check runs in the browser, so a browser that blocks scripts or cookies cannot pass it.

Sources for the DataDome column: DataDome docs, its cookie page and its slider page; for PerimeterX: HUMAN's HUMAN Challenge and cookies pages; for hCaptcha: hCaptcha docs.

DataDome answers a suspicious page request with one of three pages, which the site configures in its dashboard (Response pages); AI agents calling a site's MCP endpoints get a JSON error instead:

A scraper that sees the Device Check pass and then the slider on later pages is sending signals that change during the session: the IP, the cookies or the request pattern.

DataDome's CAPTCHA is its own slider, which DataDome describes as "100% homemade with zero third-party involvement" and which works on mobile and desktop. A site can trigger it with custom rules, but DataDome notes that its threat detection models can override the site's choice (DataDome Slider). In practice, you see it when DataDome's scoring is unsure about a request; when it is sure, you get a block instead.

The datadome cookie carries the session's state: DataDome uses it "for both server-side and client-side detection to assess the legitimacy of a request", keeps it for 1 year, and says it contains no personally identifiable information (DataDome: Cookies and stored data). A scraper that drops cookies, or swaps IPs while keeping the cookie, gives DataDome an easy signal.

PerimeterX became part of HUMAN Security, and its bot defense now runs under the HUMAN name (Bot Defender). Its challenge, the HUMAN Challenge, asks you to press and hold a button; HUMAN says it tracks mouse, touch and keyboard events on the challenge page and is built to be hard to solve through API calls, automation or CAPTCHA farms (HUMAN Challenge). Its _px cookies keep the visitor's session with HUMAN and, by HUMAN's account, hold no personally identifiable information. Like DataDome, it decides mostly from signals collected before the challenge appears (the browser, the client's fingerprint, the IP and the request pattern), so a scraper that triggers it on every page has a signal problem, not a challenge problem.

hCaptcha is a CAPTCHA the site embeds itself: a widget that, once solved, adds a token to the form, which the site's server verifies with hCaptcha before it accepts the request. hCaptcha's documentation says each token can be redeemed once and expires after 120 seconds by default, and that "a frontend callback alone does not authorize the request". Enterprise accounts can use passive "No-CAPTCHA" modes and receive a bot score with each verification (hCaptcha docs). For a scraper, that means solving has to happen just before submitting, in the same session.

CyberSiARA sells SiARA Shield, which it positions as a CAPTCHA alternative: behavioral analysis of mouse movement, typing and interaction first, and, only for sessions that look suspicious, a visual test it describes as "designed to resist AI and OCR-based attacks" (CyberSiARA). As with the others, most visitors never see the challenge, and a scraper that does has already been scored as suspicious.

Work on the signals first; the table shows what each fix changes on each system.

Residential proxies and mobile proxies cover the first row; ProxyField sticky sessions hold an IP for 30 s to 36 h, with country, region and city targeting. The browser and TLS rows are in browser fingerprinting in web scraping and TLS and TCP fingerprinting.

Plain Selenium, and default headless Playwright or Puppeteer, are among the easiest clients for these systems to spot: automation flags and headless differences are exactly what their JavaScript checks look for. What helps, in order:

1. Run headed or a less detectable browser build, on a desktop-like setup, not default headless.
2. One browser context per session, with its own sticky residential IP and cookies, kept for the whole session.
3. Navigate like a visitor where the site expects it: land on a listing page before product pages, and pace requests.
4. Detect the challenge and back off. When the slider or the press-and-hold page appears, close that context and start a new session later, rather than retrying at once.

This Playwright snippet opens one context through the ProxyField gateway and checks whether the page shows a CAPTCHA frame. As written it gets a new IP on every request; to keep one IP for the context, add a session id: -region-<region>, -session-<id> and -ttl-<seconds> (30 to 129,600 seconds, 20 minutes by default) after the location, as in <login>-country-us-region-new_york-city-new_york-session-he9f2qga-ttl-600. Replace <login> and <password>, and adjust the selector to the challenge your target shows.

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(headless=False, proxy={
        "server": "http://gate.proxyfield.io:7000",
        "username": "<login>-country-us-city-new_york",
        "password": "<password>",
    })
    context = browser.new_context(locale="en-US", timezone_id="America/New_York")
    page = context.new_page()
    page.goto("https://example.com/", wait_until="domcontentloaded")
    page.wait_for_timeout(3000)  # challenge frames load after the page
    challenged = page.locator("iframe[src*='captcha']").count() > 0
    print("challenge shown" if challenged else "page loaded", page.title())
    browser.close()

The locale and time zone match a US IP: a browser that says one country while the IP says another is a mismatch these systems score. Proxy setup per tool: Playwright, Puppeteer, Selenium.

On retail sites that use DataDome, scrapers usually meet it on product and search pages. Start with the official routes above. Where the terms allow collection, a setup that holds up:

• Pace requests per site, and spread them over many residential IPs, with one sticky IP per session.
• Keep each session's cookies, including datadome, and never move a cookie to another IP.
• Use a real browser for pages that run the JavaScript tag; use the site's JSON endpoints where the page loads its data from them.
• Treat the slider as a stop sign for that session, not something to hammer.

Some scraping APIs run the browser and the IPs for you; none is a guaranteed way past a protected site, so test one on your target before you rely on it.

ProxyField's Web Scraping API fetches any URL as plain HTTP or with JavaScript rendering, billed on successful results only; contact sales.

Many solver services list hCaptcha, and some list DataDome's slider and HUMAN's challenge. A solved challenge from these systems is tied to the session that saw it, so the solver must work through the same IP and with the same browser details, and the next request is still scored on its own signals. That makes solvers a fallback for an occasional challenge, not a way to scrape a protected site at volume. How solver services compare: CAPTCHA solver services compared.

These systems are bought by sites that want to limit automated access. If every IP and client you try is challenged, go back to the official routes: the site's terms, an official API or feed, a request for access, or DataDome bot authentication for a commercial crawler. Login, sign-up and checkout flows are where the challenges protect accounts and stock, and automating them is what ProxyField's acceptable use policy forbids (fake accounts, fraud). See is web scraping legal.

ProxyField residential proxies and mobile proxies share one balance, with sticky sessions up to 36 h and city targeting; residential traffic costs $2.95/GB for 1 GB down to $1.95/GB from 1,000 GB, with no subscription. They change the IP signal only, not the site's terms.