G2

Software reviews

Stacks DataDome behind Cloudflare, so one 403 carries the markers of two products at once.

G2 shows what a layered edge looks like on the wire. A single 403 arrives with Cloudflare's __cf_bm cookie and cf-ray header, DataDome's x-datadome, x-dd-b, and x-datadome-cid headers, a datadome cookie with a one-year lifetime, and references to both the Cloudflare challenge platform and DataDome's captcha delivery host.

Layering is common and it complicates diagnosis, because the marker you happen to notice first may not belong to the product that made the decision. The rule of thumb is that the more specific verdict header wins: x-dd-b names a DataDome block, whereas __cf_bm merely proves Cloudflare is in the path.

What is in front of it

DataDome: Blocks and challenges on 403, and is the easiest vendor in this glossary to attribute thanks to an explicit x-datadome header and a captcha-delivery.com bootstrap in the body.
Cloudflare: Serves challenges and blocks on 403, rate limits on 429, and puts its own four-digit error code in the body rather than on the status line.
Cloudflare as the CDN and first-line WAF.
DataDome as the bot management layer behind it.

Status codes

403 Layered block

Blocked. Observed behaviour.

A refusal carrying markers from both products in the stack. The DataDome headers identify which one decided.

What triggers it

Client fingerprints inconsistent with a browser.
Data centre address ranges.
No valid datadome cookie.

How to confirm it

x-datadome: protected with x-dd-b: 2 and an x-datadome-cid value.
A datadome cookie set with Max-Age=31536000.
Cloudflare's __cf_bm cookie and cf-ray on the same response.

What to do about it

Attribute using the verdict headers rather than the presence headers. x-dd-b is a decision; __cf_bm and x-datadome are only evidence that the products are deployed.
Capture x-datadome-cid for any false positive report.

HTTP/2 403
x-dd-b: 2
x-datadome: protected
x-datadome-cid: AHrlqAAAAAMAZc-WcMV57acAoE9qgA==
set-cookie: datadome=GLGPOXLEKAsX3BfQ8z5Gn...; Max-Age=31536000; Path=/; Secure
set-cookie: __cf_bm=pYme6xQ5WCVHn3NKSJQ95V...; HttpOnly; Secure; Path=/
server: cloudflare
cf-ray: a32711dd0caaa13a-IAD

Notes

When two products are stacked, expect two sets of cookies and two sets of headers on the same response.
hermes.com is a useful contrast: it returns 200 while still carrying x-datadome: protected, which proves that header marks presence rather than a block.

G2