Anti-Bot Vendor Guide

What to expect and how to optimize for each provider.

Sessemi detects and solves challenges automatically. You don't need to know which vendor a site uses — send a URL, get back HTML. But understanding what each vendor cares about helps you choose the right pool and build resilient scrapers.

Choosing a Pool

Your choice of proxy pool has the biggest impact on cost, speed, and success rate:

Cloudflare SUPPORTED

Cloudflare is the most common anti-bot provider — over 20% of websites use it. It presents challenges that verify the client is a legitimate environment, ranging from invisible proof-of-work to interactive widgets.

What You'll See

Recommendations

Pool: Datacenter works for most Cloudflare sites. Cloudflare primarily validates request behavior, not IP reputation. Switch to residential only if you see persistent challenge_timeout failures, which indicates the site has a configuration that blocks datacenter ranges outright.

Batches: The first request to a domain triggers a solve. Subsequent requests reuse the clearance and complete in 1–3 seconds.

{
  "url": "https://cloudflare-protected-site.com/products",
  "pool": "datacenter",
  "solve": true,
  "wait_for": ".product-list"
}json

DataDome SUPPORTED

DataDome is used by major e-commerce and real estate platforms. It's more aggressive than Cloudflare — it combines device fingerprinting, IP reputation scoring, and behavioral analysis. The key difference: DataDome cares a lot about where you're connecting from.

What You'll See

Recommendations

Pool: Residential is strongly recommended. DataDome maintains an IP reputation database and blocks most datacenter ranges. With residential IPs, the device check often passes silently — requests complete in 2–3 seconds with no solver overhead.

Datacenter as fallback: Works but triggers the slider on almost every first request. Use it for low-volume scrapes where 30–50s solve time is acceptable.

AJAX Endpoints

Many DataDome-protected sites have AJAX endpoints for secondary data (phone numbers, prices, availability). These require the same clearance as page requests. To access them:

1. Use a session (session parameter) for the initial page load.

2. Use script-only mode to call AJAX endpoints on the same session.

3. Space calls at 1.5–2 second intervals. Rapid requests trigger behavioral detection.

// Step 1: Establish session
{
  "url": "https://datadome-site.com/listings",
  "session": "my-session",
  "solve": true
}

// Step 2: AJAX on same session (no url, script only)
{
  "session": "my-session",
  "script": "const r = await fetch('/api/data/123'); return await r.json();"
}json

Akamai SUPPORTED

Akamai Bot Manager is used by large enterprises — airlines, banks, retailers. It collects device telemetry and scores requests server-side. Unlike Cloudflare and DataDome, Akamai rarely shows visible challenges — most decisions happen invisibly.

Sessemi detects and solves Akamai challenges automatically. The first request to an Akamai-protected domain takes longer than Cloudflare or DataDome. Subsequent requests to the same domain reuse the clearance and are significantly faster.

Batch Scraping

Sessemi is optimized for batch workloads. The first request to a protected domain pays the solve cost; subsequent requests reuse the clearance.

AJAX Enrichment Pattern

Many scraping workflows need secondary data behind AJAX endpoints — phone numbers, prices, availability. The recommended pattern:

1. Session for page HTML — establishes clearance, solves challenges if needed.

2. Direct requests for pagination — pages 2–N reuse clearance automatically.

3. Script-only for AJAX — runs fetch() inside the session with valid clearance.

Error Recovery

Diagnostic Fields

Common Failures

Named Sessions

Named sessions let you persist cookies across multiple requests to the same domain. A session is created by passing "session": "my-name" in the request. All subsequent requests with the same session name reuse the cookies, clearances, and IP.

When to Use Sessions

Session Lifecycle

Sessions expire after 5 minutes of inactivity or 1 hour total. When a session expires, the next request with that name creates a fresh one — new IP, new cookies. For long-running scrapers, detect 401/403 and re-establish the session.

Mint, Then Replay

The most common pattern: one expensive browser request to solve challenges and capture cookies, followed by many cheap requests that replay those cookies.

// Step 1: Browser solve + cookie minting (~6s)
{
  "url": "https://www.example.com",
  "pool": "residential",
  "country": "FR",
  "session": "my-session"
}

// Step 2+: Cookie replay (~2s each)
{
  "url": "https://www.example.com/api/products?page=1",
  "pool": "residential",
  "country": "FR",
  "session": "my-session"
}