HUMAN (formerly PerimeterX) is an enterprise bot defense and fraud prevention platform whose Bot Defender product protects web, mobile app, and API traffic. It integrates at the edge - via CDN workers, reverse-proxy middleware, or SDKs - and pairs that server-side enforcement with a client-side JavaScript sensor that collects telemetry from every visitor. It is widely deployed on large retail, e-commerce, and real estate properties, which is consistent with its presence on multiple high-traffic sites in our registry.
HUMAN scores every request with a combination of network-level and client-level signals: IP reputation and ASN classification (datacenter vs residential vs mobile carrier), TLS and HTTP-level fingerprints, and a JavaScript sensor that gathers device and browser characteristics plus behavioral telemetry such as mouse movement, touch, scroll, and typing cadence. Scores are carried in first-party cookies and tokens, so a session is continuously re-evaluated rather than checked once. Crucially, much of the decision happens before any challenge is shown - traffic from low-reputation IP ranges or with automation-typical fingerprints can be blocked outright, commonly with an HTTP 403 and a branded block page. Ambiguous traffic is escalated to the HUMAN Challenge, the well-known "Press & Hold" interaction, which measures how the interaction is performed rather than asking a puzzle question.
Because HUMAN weighs IP reputation heavily and pre-classifies ranges before a challenge ever renders, datacenter IPs are generally blocked wholesale and heavily pooled or previously abused residential ranges are increasingly pre-flagged. Real mobile-carrier IPs sit behind CGNAT shared with millions of legitimate phone users, making them the hardest class to blocklist wholesale, so legitimate large-scale collection against this class of protection generally requires carrier-grade mobile IPs with auditable provenance - such as physically owned carrier modems or an opt-in, compensated peer network. In every case, respect robots.txt, the site's Terms of Service, and applicable law, and collect only data you are permitted to collect.
Honest about which fits - from running it yourself on our proxies to a fully managed pipeline.
Best when: You have engineers and 1-2 easy targets
Best when: Light, unprotected pages at low volume
Best when: 1-3 hard, defended targets like a HUMAN (PerimeterX)-protected site
Observed via public response signatures, reviewed July 2026. Read-only reference.
Responsible use. This is a technical reference to how a protection technology works, not a guide to defeating it. Respect each site's robots.txt, Terms of Service and applicable law, and collect only data you are permitted to.
No. The visible "Press & Hold" prompt is only the escalation layer. Most gating happens invisibly through IP reputation, TLS and browser fingerprinting, and behavioral scoring collected by its client-side sensor - a large share of automated traffic is classified and blocked before any challenge is displayed.
Typical indicators include first-party cookies and tokens with a px prefix, a loaded JavaScript sensor calling PerimeterX-associated endpoints, HTTP 403 responses with a PerimeterX-branded block page, and the distinctive Press & Hold verification screen.
Because the verdict is a composite score, not a browser check. A clean, fully human-operated browser can still fail if the IP range it connects from has poor reputation - for example a datacenter ASN or a heavily shared, previously flagged residential pool - since IP class is evaluated before and alongside everything else.