What is an anti-bot system?

TL;DR

An anti-bot system sits between a visitor and a website and decides whether that visitor is a person. It gathers signals at three levels, the network connection, the browser environment and the pattern of behaviour over time, combines them into a score, and picks an outcome: serve the page, issue a challenge, or refuse. Cloudflare, Akamai, DataDome, PerimeterX and Imperva are the systems most scrapers meet.

The three layers of signal

Network. Who is connecting, before a single byte of the page is served. IP reputation and whether the address belongs to a datacenter, a residential provider or a mobile carrier. The TLS handshake, whose exact cipher ordering differs between real browsers and HTTP libraries. HTTP/2 frame settings, which also vary by client.

Browser environment. What the page can observe once it runs. Header completeness and ordering, the results of JavaScript execution, and the fingerprint built from screen, fonts, canvas, WebGL and audio. A client that never runs the JavaScript fails this layer by omission.

Behaviour. How the visit unfolds. Request timing and regularity, navigation order, mouse movement and scroll, and whether the same identity reappears in an implausible pattern.

Why scores rather than rules

Early bot detection used rules: block this user agent, block this IP range. Rules are easy to enumerate and easy to evade, so detection moved to scoring, where dozens of weak signals combine into one confidence value.

This changes what "getting blocked" means. There is rarely a single check you failed. A datacenter IP alone might be tolerated, and a missing Sec-Fetch-Site header alone might be tolerated, while both together push the score past the threshold. It also means the threshold moves: the same request can pass on a quiet morning and fail during an attack.

The three outcomes

Serving the page is the pass case. Blocking outright is the obvious fail, arriving as a 403, a 503, or a silent 444.

The middle outcome is the one that catches pipelines out. A challenge, whether a JavaScript proof-of-work or an interactive CAPTCHA, is often served with a 200 status code. A scraper checking only the status code records a success and stores a challenge page.

Where Zenrows fits

Presenting a consistent identity across all three layers at once is the difficult part, and it changes as detection changes. Adaptive Stealth Mode selects a coherent configuration per target rather than exposing individual knobs, so the TLS handshake, headers, fingerprint and IP describe the same plausible visitor. The goal is a request that never raises the score, which is why challenges are avoided rather than answered.

Key takeaways

Anti-bot systems score requests across network, browser and behavioural signals instead of applying fixed rules, so a block is usually the sum of several weak tells rather than one mistake. Their middle outcome, the challenge, frequently carries a 200 status code, which is why content assertions matter more than status checks.