Anti-bot status codes

A 403 from Cloudflare, a 202 from AWS WAF and a 429 from Kasada mean three different things. Reference for 13 bot management products and 12 major sites.

Status code lookup

200

• Akamai Bot Manager: Deceptive. Deny page served on a success status. The status line says success and the body is a denial or an alternate page. Serving deceptive content is an available Bot Manager response action.
• Cloudflare Turnstile: Allowed. siteverify success. The token was valid. The body carries success true along with the hostname and timestamp of the challenge.
• Cloudflare Turnstile: Blocked. siteverify failure. The token was rejected. Still an HTTP 200; the body carries success false and an error-codes array naming the reason.
• DataDome: Challenge. Device Check interstitial. A silent verification page was served in place of the resource. DataDome documents Device Check as an interstitial that runs without any user interaction and then redirects to the requested resource if the client is legitimate.
• DataDome: Allowed. Custom response tag. The request was allowed through but tagged with an HTTP header so the application can apply its own logic, such as serving alternate content.
• F5 Distributed Cloud Bot Defense: Deceptive. Application-shaped block. A block dressed as an ordinary application response, which is the configuration F5 explicitly recommends.
• HUMAN Security: Allowed. Monitor mode. Detection ran and scored the request, but the enforcer is in monitor mode so nothing was blocked. HUMAN documents monitor mode as the default until px_block_enabled is set.
• Imperva: Deceptive. Challenge or block page on a success status. The status line reports success while the body is an interstitial challenge or a denial. This is routine Imperva behaviour rather than an edge case.
• Walmart: Deceptive. CAPTCHA page on a success status. The status line reports success and the body is a bot challenge rather than the requested page.

202

• AWS WAF: Challenge. Challenge action. A silent challenge was issued because the request had no valid token. AWS documents this as HTTP status code 202 Request Accepted with the header x-amzn-waf-action set to challenge.

302

• Google Search: Challenge. Redirect to the sorry interstitial. The search request was diverted to the challenge page rather than answered.
• Queue-it: Rate limited. Redirect into the waiting room. The site is over its configured capacity and this session has been placed in the queue.
• Queue-it: Allowed. Release to the destination. The queue released this session and is redirecting it back to the original URL with a signed token.
• Ticketmaster: Rate limited. Waiting room redirect. The session was placed in a virtual waiting room because demand exceeds capacity. Not a bot verdict.

400

• Instagram: Blocked. Checkpoint required. The account has been flagged and must complete verification. The hold is on the identity, not on the request.

403

• Akamai Bot Manager: Blocked. Access Denied. The classifier or a WAF rule denied the request. This is the standard Bot Manager deny action.
• AWS WAF: Blocked. Block action. A rule with the Block action matched. AWS documents that Block responds with an HTTP 403 Forbidden status code, and that in rules you define you can customize the response.
• Cloudflare: Challenge. Interstitial challenge. A challenge page was served in place of the resource. The request was held, not refused.
• Cloudflare: Blocked. WAF or firewall block, error 1020. A rule denied the request outright. No challenge is offered and there is nothing for the client to solve.
• Cloudflare: Blocked. Browser signature banned, error 1010. The client's browser signature was rejected. Cloudflare's wording is that the owner of the website has banned your access based on your browser's signature.
• Cloudflare: Blocked. Client reputation ban, error 1012. Access denied based on activity attributed to the client's address or network rather than to this request.
• DataDome: Blocked. Block or challenge page. DataDome enforced a response. Both hard blocks and CAPTCHA challenges arrive as 403, and the body distinguishes them.
• DataDome: Challenge. Slider CAPTCHA. An interactive challenge was served. DataDome's is a slider puzzle with an audio alternative.
• F5 Distributed Cloud Bot Defense: Blocked. Configured block. A block using a conventional status code. F5 lets the operator select the status code returned for blocked requests.
• Fastly Next-Gen WAF: Blocked. Configured block response. The same block decision, on deployments where the operator changed the response status to the more conventional 403.
• G2: Blocked. Layered block. A refusal carrying markers from both products in the stack. The DataDome headers identify which one decided.
• HUMAN Security: Blocked. Enforcer block. The enforcer scored the request above the blocking threshold and refused it.
• HUMAN Security: Challenge. Advanced Blocking Response on an AJAX call. A blocked fetch or XHR request answered with a JSON object describing the challenge, so the page can render it inline instead of navigating to an interstitial.
• Imperva: Blocked. Access denied with incident ID. The WAF or bot protection layer refused the request and issued an incident reference.
• Kasada: Blocked. Hard block. The request was refused outright, typically before any challenge was offered.
• Nike: Blocked. Access Denied. Akamai Bot Manager denied the request, with a reference number for support.
• Reddit: Blocked. Forbidden. Access refused, typically for authentication, permission, or subreddit-level reasons rather than bot classification.
• Sucuri Website Firewall: Blocked. Access Denied. The firewall refused the request and printed the reason and a support ID.
• Ticketmaster: Blocked. Edge block. The request was refused before reaching the application.
• Tripadvisor: Blocked. DataDome block. DataDome enforced a block response.
• Zillow: Blocked. PerimeterX block. The HUMAN enforcer scored the request above the blocking threshold and refused it at the edge.

405

• AWS WAF: Challenge. CAPTCHA action. A CAPTCHA puzzle was required. AWS documents this as HTTP status code 405 Method Not Allowed with the header x-amzn-waf-action set to captcha.

406

• Fastly Next-Gen WAF: Blocked. Agent block. The Next-Gen WAF agent blocked the request. 406 is the historic Signal Sciences default and remains the most recognisable signature of the product.

429

• Akamai Bot Manager: Rate limited. Rate control triggered. A rate control policy fired. Worth noting that this can appear on a low request count, because Akamai rate controls can be scoped to a shared address or network rather than to your session.
• Cloudflare: Rate limited. Rate limited, error 1015. The site's rate limiting rules were exceeded. The request shape is acceptable; the pace is not.
• DataDome: Rate limited. Rate limiting response. A Rate Limiting rule's volume threshold was crossed. DataDome documents this response as allowing traffic below a threshold over an hour or a day, then applying a CAPTCHA, Block, or Device Check above it.
• Fastly Next-Gen WAF: Rate limited. Rate limiting rule. A rate limiting rule fired against the source.
• Google Search: Challenge. Unusual traffic. Automated query patterns were detected from the source network and a challenge is required before searching continues.
• HUMAN Security: Rate limited. Rate limited. Request rate exceeded, separately from the risk score decision.
• Imperva: Rate limited. Rate limited. A rate policy was exceeded.
• Instagram: Rate limited. Rate limited. Request volume exceeded for the account, the address, or both.
• Kasada: Challenge. Challenge required. Not a rate limit. The client has no valid Kasada token and is being asked to run the proof-of-work challenge before proceeding.
• Reddit: Rate limited. Rate limited. Request rate exceeded for the client or token.
• Shopify: Rate limited. Rate limited. Request rate exceeded. This is Shopify's rate limiting code, and it is the one that clears with patience.
• Wayfair: Rate limited. Rate limited. A Cloudflare rate limiting rule was exceeded for this source.

430

• Shopify: Blocked. Security rejection. Shopify's security layer rejected the request. Distinct from rate limiting, which Shopify signals with 429.

503

• Akamai Bot Manager: Blocked. Custom deny response. A customer-configured deny response. Akamai lets operators pick the status and body for a denial, so this is a policy choice rather than a service problem.
• Amazon: Challenge. Robot check. A CAPTCHA page served on a service-unavailable status. The site is healthy; the client was not accepted.
• Cloudflare: Challenge. Legacy JavaScript challenge. The historic status for the JavaScript challenge and I'm Under Attack Mode, replaced by 403 during 2023.

530

• Cloudflare: Allowed. Origin unreachable, error 1033 and relatives. Not a bot decision at all. Cloudflare reached the edge but could not reach the origin behind it.

999

• LinkedIn: Blocked. Request Denied. LinkedIn refused the request. A non-standard code chosen so that it cannot be confused with anything else.

Products

• Akamai Bot Manager (CDN and WAF): Denies with a 403 Access Denied page carrying a reference number, and is unusual in offering operators a deliberately ambiguous 200 response and a tarpit that never answers at all.
• AWS WAF (CDN and WAF): The one product here whose challenge and CAPTCHA responses have documented, distinctive status codes: 202 for a challenge, 405 for a CAPTCHA, and 403 for a block.
• Cloudflare (CDN and WAF): Serves challenges and blocks on 403, rate limits on 429, and puts its own four-digit error code in the body rather than on the status line.
• Cloudflare Turnstile (Challenge service): A token verifier rather than a gatekeeper. Its API always answers 200, so the verdict lives in a JSON body and never in the status code.
• DataDome (Bot management): Blocks and challenges on 403, and is the easiest vendor in this glossary to attribute thanks to an explicit x-datadome header and a captcha-delivery.com bootstrap in the body.
• F5 Distributed Cloud Bot Defense (Bot management): Deliberately has no signature. F5 advises customers to make blocked responses look like ordinary application errors, so the status code is chosen to be uninformative.
• Fastly Next-Gen WAF (CDN and WAF): Best known for blocking on 406 Not Acceptable, a status code almost nothing else uses, which makes an unexplained 406 a strong vendor fingerprint.
• HUMAN Security (Bot management): The former PerimeterX. Blocks with a 403 that often carries an explicit x-px-blocked header, and answers blocked AJAX calls with JSON instead of an HTML challenge page.
• Imperva (CDN and WAF): Identifiable by an incident ID in the block page and by its incap cookies, and notable for serving challenges and blocks on a 200 as readily as on a 403.
• Kasada (Bot management): Distinctive for using 429 as a challenge rather than as a rate limit, and for x-kpsdk headers that make attribution unambiguous.
• Queue-it (Waiting room): Not a bot blocker at all: a fairness queue that answers with 302 redirects, so its signature is a redirect to a queue-it.net waiting room rather than an error.
• Shopify (Platform): Uses the non-standard 430 for security rejections so that it stays distinguishable from 429 rate limiting, which is a genuinely useful separation.
• Sucuri Website Firewall (CDN and WAF): A cloud firewall common in front of small and mid-sized sites, whose block page names the block reason and carries a support ID for allowlisting.

Sites

• Amazon (Retail): Answers unrecognised clients with a 503 carrying a CAPTCHA page, which is the most misread response on the retail web.
• G2 (Software reviews): Stacks DataDome behind Cloudflare, so one 403 carries the markers of two products at once.
• Google Search (Search): Redirects suspected automation to an interstitial on google.com/sorry and answers programmatic clients with 429 on the unusual-traffic path.
• Instagram (Social): Combines 429 rate limiting with checkpoint flows that interrupt an account rather than a request, so the block attaches to the identity rather than the connection.
• LinkedIn (Social): Returns HTTP 999, an invented status code outside the standard range, which breaks HTTP clients that assume codes stop at 599.
• Nike (Retail): Runs Akamai, identifiable by the akamai-grn reference header that appears on allowed and denied responses alike.
• Reddit (Social): Serves from its own edge and leans on 429 with Retry-After, making it one of the more conventional and better-behaved responders.
• Ticketmaster (Ticketing): Combines bot management with waiting rooms, so a 302 into a queue and a 403 block mean completely different things and need opposite responses.
• Tripadvisor (Travel): Returns a 403 with server: DataDome, naming the vendor in the one header everybody already logs.
• Walmart (Retail): Serves a CAPTCHA page on a 200 OK, so status-code-only detection records a successful fetch of a page containing no product data.
• Wayfair (Retail): Rate limits with a straightforward 429 from Cloudflare, which is one of the few responses here that actually clears if you wait.
• Zillow (Real estate): Blocks with a 403 carrying an explicit x-px-blocked header, which is about as unambiguous as attribution gets.