Bot management · HUMAN Security (formerly PerimeterX)
HUMAN Bot Defender
Difficulty 5/5
The old PerimeterX engine. Leans hardest of any vendor on behavioural telemetry — cursor paths, key cadence, touch pressure — via an obfuscated sensor.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: high
How it decides
-
A per-customer sensor script (`client.perimeterx.net/<appId>/main.min.js`) collecting device and interaction telemetry.
-
`_px3` — the risk token. Short-lived, bound to the collected signals, re-minted continuously.
-
Behavioural scoring: mouse acceleration curves, dwell time, scroll physics. Headless automation with no input events scores badly even from a clean address.
-
A “Press & Hold” human challenge rather than a classic CAPTCHA.
What you see when it stops you
- A “Press & Hold to confirm you are a human” button
- HTTP 403 with a JSON body referencing `blockScript` or `_pxAppId`
- `_px3`, `_pxhd`, `_pxvid` or `pxcts` cookies
- Requests to `captcha.px-cdn.net`
Signatures the detector matches
Publicly observable artefacts HUMAN Bot Defender sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Cookie | _px3 risk cookie | 75 |
| Cookie | _pxhd cookie | 65 |
| Cookie | _pxvid device id cookie | 65 |
| Cookie | pxcts telemetry cookie | 60 |
| Cookie | _px2 cookie (legacy) | 55 |
| Page markup | client.perimeterx.net sensor script | 75 |
| Page markup | _pxAppId bootstrap | 65 |
| Page markup | PerimeterX captcha host | 70 |
| Page markup | “Press & Hold” human challenge | 45 |
| Header | x-px-block header | 70 |
| Status | 403 block response | 10 |
What actually gets through
-
Drive a real browser and generate real input events. This is the vendor where synthetic interaction measurably changes the outcome.
-
Residential or mobile exits; datacenter ranges are scored down but are not the deciding term the way they are with DataDome.
-
One browser profile per identity. `_pxvid` is a durable device id — sharing it across addresses is itself a signal.
-
Never solve the challenge on a different fingerprint than the one making the follow-up requests.
Hosts on record running it
From the detector's curated database. Observed, not live — stacks change, and large sites often run different protection per market.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.