cdpfleet Pre-launch Get early access

cdpfleet / Bot protection

Measured, dated

What gets through where.

A week of measurements on the bot-protection vendors' own pages: headless Chromium, headful Chrome and Edge, and Camoufox, through your own proxy and residential exits, one load per cell, nothing clicked. Dated snapshots, not promises.

  • 4vendors, on their own sites
  • 5languages per case
  • 0CAPTCHAs solved

The matrix

Vendor (page)Headless ChromiumHeadful Chrome / EdgeCamoufoxNotes — measured
Cloudflare challenge (scrapingcourse.com)challenge, every cellchallenge, every cellcleared by itself in 1–18 sNetwork and tier changed nothing; the browser decided. Case 64, 2026-10-21
Cloudflare background check (nowsecure.nl)contentcontentcontentEvery setup got the page and a cf_clearance cookie. Case 64, 2026-10-21
DataDome (datadome.co)blocked (403) 19/20mostly content, CAPTCHA in some runsmostly content, CAPTCHA in some runsDecided on the first response; no consistent network effect. Case 65, 2026-10-22
Akamai Bot Manager (akamai.com)blocked (403) 10/10content, every cellcontent, every cell_abck stayed unvalidated and the page was served anyway. Case 67, 2026-10-23
HUMAN (humansecurity.com)press-and-hold 10/10content 10/10 on own proxy, 10/15 on residentialpress-and-hold 12/15HUMAN and Akamai disagreed about Camoufox. Case 67, 2026-10-23
reCAPTCHA v3 / hCaptcha demosscore 0.9 / widget shownscore 0.9 / widget shownscore 0.9 / widget shownThe demos don't separate browsers. Case 68, 2026-10-24

One load per cell, nothing clicked, five runs per case (one per language). Outcomes: content (the real page), cleared (an automatic check passed by itself), challenge (a CAPTCHA or press-and-hold), blocked (a block page). Camoufox is based on Firefox source; cdpfleet is not affiliated with Mozilla.

Where to start, per vendor

  • Cloudflare: start with Camoufox when a page shows Cloudflare's interstitial. On scrapingcourse.com it cleared by itself in 1–18 s while headless Chromium, headful Chrome and Edge stayed on the challenge in every cell (case 64, 2026-10-21). A profile that had cleared once loaded the page straight away on the next visit from the same exit.
  • DataDome: start headful (Chrome, Edge or Camoufox) and keep a profile. Headless Chromium was blocked 19 times in 20; the headful setups mostly got the page, and a returning profile never did worse than its first visit, turning Chrome's CAPTCHA into content in 3 of 3 runs (case 65, 2026-10-22).
  • Akamai: any headful browser. Headful Chrome, Edge and Camoufox got akamai.com in every cell; only headless Chromium was turned away (case 67, 2026-10-23).
  • HUMAN: headful Chrome or Edge, best on your own proxy (content in 10 of 10 cells there, 10 of 15 on residential exits). Camoufox met the press-and-hold in 12 of 15 cells (case 67, 2026-10-23).
  • Unknown vendor: find out first. The cookies and request hosts each vendor leaves (__cf_bm, datadome, _abck, _px* and so on) identified it on 19–20 of 20 public sites (case 62, 2026-10-20).
Camoufox, headful, on a sticky residential exit, with a profile that keeps its cookies
// npm install [email protected]
// Browsers run on cdpfleet, so no `npx playwright install` is needed.
import { firefox } from 'playwright';

const KEY = process.env.CDPFLEET_API_KEY;

// 1. Launch the browser
const res = await fetch('https://starter.cdpfleet.com/camoufox/session', {
  method: 'POST',
  headers: { 'x-api-key': KEY, 'content-type': 'application/json' },
  body: JSON.stringify({
    proxy: 'cdpfleet-resi-country-us-session-shop1-lifetime-30',
    headless: false,
    geoip: true,
    profile: 'shop-visitor',
  }),
});
if (!res.ok) throw new Error(`launch failed: ${res.status} ${await res.text()}`);
const { wsUrl } = await res.json();

// 2. Connect and drive it
const browser = await firefox.connect(wsUrl, { headers: { 'x-api-key': KEY } });
const context = browser.contexts()[0]; // the saved profile — a new context isn't saved
const page = context.pages()[0] ?? await context.newPage();
await page.goto('https://example.com');
console.log(await page.title());
await browser.close(); // ends the session and stops billing

Why outcomes vary by site and day

  • Each site sets its own rules. The same vendor can be strict on one site and lenient on another, which is why these cases use the vendors' own pages and say "on these pages on this date" (case 65, case 67).
  • Vendors change their checks all the time. Every result here is a dated snapshot.
  • The network mattered less than the browser. Tier 1 vs Tier 4 never turned a Chromium challenge into a pass on Cloudflare (case 64), DataDome showed no consistent network effect (case 65), and the rotating own proxy accounted for most of the demo-page misses (case 68).
  • Not every visit clears. Camoufox's first visit to the Cloudflare challenge stayed on it in two later runs, so there was nothing for a profile to skip (case 64).

What didn't help

  • VPN Tunnel didn't change a verdict. It makes WebRTC show the exit IP and enables HTTP/3, but Cloudflare's and DataDome's verdicts were the same with and without it on these pages (case 69, 2026-10-24).
  • humanize made no measurable difference on DataDome's pages: the page after the cursor moves loaded 5 of 5 times with it on and 4 of 5 with it off (case 65, 2026-10-22).
  • CAPTCHA demo scores don't rank browsers. Google's v3 demo gave every setup 0.9, headless Chromium included, the same browser the real protections blocked (case 68, 2026-10-24).
  • Bot-test pages aren't the target site. Public fingerprint test pages flagged headless Chromium everywhere and disagreed about the rest (case 63, 2026-10-20). Judge a setup on the site you care about.

When to stop

  • These cases measure; they don't defeat. Every case loads public pages once per setup, clicks nothing and solves no CAPTCHA. When a site shows a challenge, that is the site's answer.
  • Don't farm CAPTCHAs or hammer a site. Retrying until something passes wears the site down and burns your exits. Back off, honour Retry-After (case 53), or hand the page to a person in live view.
  • Respect the site. Read its terms, prefer its API or a data feed where one exists, and keep your request rate polite. No setup here is a promise of access.