96.3% anti-bot pass rate. $0 in proxies.

How we measured it

A benchmark is only worth as much as its method. Here is exactly what we ran, including the one site we did not clear.

• 27 real sites, 22 of them protected

  Live production sites behind commercial anti-bot vendors (DataDome, Akamai, PerimeterX, Cloudflare, Amazon, Imperva) plus in-house-protected directory and social sites. The remaining 5 rows are unprotected controls (example.com, the toscrape sandboxes, Wikipedia, Hacker News) that catch a broken harness. All 27 count toward the headline; the controls all passed.

• Paced, not flooded

  Requests are paced to behave like a real client. The free-tier rate limiter caps at 10/min by design. Reproduce with --concurrency 1 --delay 4000

• Block detection

  A site counts as passed only when the response clears both an HTTP-status check and a content-fingerprint check for known block / challenge pages.

• Dated and reproducible

  Run on 2026-06-23. The script and the raw per-site rows are published in the repo, so anyone can re-run it.

Results by anti-bot vendor

The hardest tier of the modern web sits behind a handful of fingerprinting vendors. Here is the pass rate against each one, from the raw run.

The rows above sum to the headline: 22 sites behind a commercial anti-bot vendor plus 5 unprotected controls is 27 sites, 26 of which passed. Controls are listed so the arithmetic is checkable, not to pad the score. Every row comes from bench-clean.json.

Reproduce it

The benchmark script is scripts/benchmark-antibot.mjs, published here verbatim. It targets a live deployment, walks the site list, and writes the raw per-site rows (URL, vendor, status, latency, pass/fail) this page reports on. The exact output of the 2026-06-23 run is published at /bench-clean.json so you can diff your run against ours.

node scripts/benchmark-antibot.mjs --concurrency 1 --delay 4000

# Expected output shape:
# { "overall": 96.3, "passed": 26, "total": 27, "p50Ms": 2171,
#   "rows": [ { "url": "...", "vendor": "datadome", "pass": true, "ms": 2255, "status": 200 }, ... ] }

The free-tier rate limiter caps at 10 requests/min by design, so pace the run with--concurrency 1 --delay 4000. Flooding it produces 429s, which is the limiter working, not a scrape failure.

Run history

One run so far. This page grows a new row every time the benchmark is re-run against a deployed build.

• Small sample

  n=27. That is enough to say something real about the major anti-bot vendors, not enough to promise a percentage on a site we have never tested.

• No residential-proxy targets

  The suite has no sites that require residential IPs to reach at all (e.g. Mercado Libre). Those need a paid proxy provider, not the free-tier engine this run measures.

• Benchmark ≠ SLA

  This is a point-in-time measurement, not an uptime or success-rate guarantee. Sites change their defenses; a pass today is not a promise for every future request.

• Our own run, not audited

  We ran this against our own deployment. The script is published so you can re-run it yourself. That is the check, not a third-party attestation.