Tripadvisor
Travel
Returns a 403 with server: DataDome, naming the vendor in the one header everybody already logs.
Tripadvisor answers unrecognised clients with a 403 whose Server header reads DataDome. That is unusually direct: most deployments hide the vendor behind the site's own branding, and this one puts it in the response line.
Travel content is heavily scraped for pricing and review aggregation, so protection is applied to ordinary content pages rather than reserved for logins or checkouts.
What is in front of it
- DataDome: Blocks and challenges on 403, and is the easiest vendor in this glossary to attribute thanks to an explicit x-datadome header and a captcha-delivery.com bootstrap in the body.
- DataDome, identified directly by the Server response header.
Status codes
403 DataDome block
Blocked. Observed behaviour.
DataDome enforced a block response.
What triggers it
- TLS and HTTP fingerprints that do not match a real browser.
- No valid datadome cookie.
- Data centre address ranges.
How to confirm it
- server: DataDome on the response.
- Often x-datadome and x-dd-b alongside it, and a captcha-delivery.com bootstrap in the body.
What to do about it
- Check the t field in the body's dd object to tell a hard block from a solvable challenge.
- See the DataDome entry for the full response set, including the Allow and Monetize paths an operator can use for declared bots.
Notes
- server: DataDome is the single fastest attribution in this whole glossary. It costs nothing to check.