Walmart
Retail
Serves a CAPTCHA page on a 200 OK, so status-code-only detection records a successful fetch of a page containing no product data.
Walmart is the cleanest example of why status codes cannot be trusted alone. A plain request returns HTTP 200, with all the headers of a healthy response, and a body that is a CAPTCHA page. Every layer of a typical pipeline reports success, and the data that lands in the database is a challenge page.
This failure mode is worse than a block. A 403 stops your pipeline and tells you to fix something. A 200 with no content quietly fills your storage with junk, and you find out weeks later when someone asks why the price history has gaps.
Walmart runs a layered stack at the edge, and the composition has changed over time, so attribution matters less than the behaviour: validate the body.
What is in front of it
- Akamai Bot Manager: Denies with a 403 Access Denied page carrying a reference number, and is unusual in offering operators a deliberately ambiguous 200 response and a tarpit that never answers at all.
- HUMAN Security: The former PerimeterX. Blocks with a 403 that often carries an explicit x-px-blocked header, and answers blocked AJAX calls with JSON instead of an HTML challenge page.
- Reported to run Akamai Bot Manager at the edge, with additional bot management layers on sensitive paths.
- The 200-with-CAPTCHA behaviour is consistent with Akamai's alternate-content response actions, which return a substitute page on a success status.
Status codes
200 CAPTCHA page on a success status
Deceptive. Observed behaviour.
The status line reports success and the body is a bot challenge rather than the requested page.
What triggers it
- A client identity that does not match a real browser.
- Data centre address ranges.
- Access to product and search paths without having loaded the site's client-side scripts.
How to confirm it
- A body containing CAPTCHA markup where product markup should be.
- A response noticeably smaller than a genuine product page.
- Absence of the structured product data the real page always carries.
What to do about it
- Assert on content, not on status. Pick a required element of the real page and fail the request when it is missing.
- Add a size floor. A product page that comes back as a few kilobytes is not a product page.
- Walmart operates partner and affiliate APIs for catalogue data, which return structured data and do not silently degrade.
Notes
- Any monitoring built on HTTP status will report this site as fully healthy while collecting nothing.
- This pattern appears across several large retailers, so the defensive habit generalises.