Amazon

Retail

Answers unrecognised clients with a 503 carrying a CAPTCHA page, which is the most misread response on the retail web.

Amazon's robot check is a 503, and that single choice causes more wasted debugging than almost anything else in this glossary. 503 means service unavailable, so every well-behaved HTTP client treats it as a transient server fault and retries with backoff, which is exactly the wrong response. The service is not unavailable. The client was not recognised.

The response is served from Amazon's own infrastructure rather than a third-party bot vendor, and the body carries the familiar wording asking the visitor to enter the characters they see. A retry loop against it will produce a long run of 503s and a conclusion that Amazon is down.

A plain request with a default client identity draws this response immediately, with no volume required, which confirms it is a client assessment rather than a rate limit.

What is in front of it

In-house bot detection at Amazon's edge, fronted by CloudFront.
A server: Server response header, which is Amazon's characteristically uninformative value.
x-cache: Error from cloudfront appears on the robot-check response.

Status codes

503 Robot check

Challenge. Observed behaviour.

A CAPTCHA page served on a service-unavailable status. The site is healthy; the client was not accepted.

What triggers it

A default or absent User-Agent, which alone is enough to trigger it.
Data centre address ranges.
Request pacing or navigation patterns that do not resemble browsing.

How to confirm it

server: Server and x-cache: Error from cloudfront.
A body asking the visitor to enter the characters shown, or wording about making sure you are not a robot.

What to do about it

Do not retry on a schedule. This 503 is not transient and a backoff loop will simply repeat it.
Check the body before classifying the failure. A 503 with a CAPTCHA in it is a completely different problem from a 503 with an error page in it.
For product and pricing data, Amazon operates the Product Advertising API and Selling Partner APIs. Sanctioned access is more stable than fighting the robot check, and it does not break when the check changes.

HTTP/2 503
server: Server
x-cache: Error from cloudfront
content-type: text/html

<title>Sorry! Something went wrong!</title>
... Enter the characters you see below ...

Notes

The 503 arrives on the first request, so it says nothing about your request rate.
Because it is an in-house system, none of the vendor headers in this glossary will help you attribute it. The server: Server and CloudFront combination is the signature.