Bot management · HUMAN Security (formerly PerimeterX)

HUMAN Bot Defender

Difficulty 5/5

The old PerimeterX engine. Leans hardest of any vendor on behavioural telemetry — cursor paths, key cadence, touch pressure — via an obfuscated sensor.

  • TLS fingerprinting
  • JS challenge required
  • Behavioural scoring
  • IP reputation weight: high

How it decides

  • A per-customer sensor script (`client.perimeterx.net/<appId>/main.min.js`) collecting device and interaction telemetry.

  • `_px3` — the risk token. Short-lived, bound to the collected signals, re-minted continuously.

  • Behavioural scoring: mouse acceleration curves, dwell time, scroll physics. Headless automation with no input events scores badly even from a clean address.

  • A “Press & Hold” human challenge rather than a classic CAPTCHA.

What you see when it stops you

  • A “Press & Hold to confirm you are a human” button
  • HTTP 403 with a JSON body referencing `blockScript` or `_pxAppId`
  • `_px3`, `_pxhd`, `_pxvid` or `pxcts` cookies
  • Requests to `captcha.px-cdn.net`

Signatures the detector matches

Publicly observable artefacts HUMAN Bot Defender sends to every visitor. Paste a response into the analyser and these are what it looks for.

WhereSignalWeight
Cookie_px3 risk cookie75
Cookie_pxhd cookie65
Cookie_pxvid device id cookie65
Cookiepxcts telemetry cookie60
Cookie_px2 cookie (legacy)55
Page markupclient.perimeterx.net sensor script75
Page markup_pxAppId bootstrap65
Page markupPerimeterX captcha host70
Page markup“Press & Hold” human challenge45
Headerx-px-block header70
Status403 block response10

What actually gets through

  • Drive a real browser and generate real input events. This is the vendor where synthetic interaction measurably changes the outcome.

  • Residential or mobile exits; datacenter ranges are scored down but are not the deciding term the way they are with DataDome.

  • One browser profile per identity. `_pxvid` is a durable device id — sharing it across addresses is itself a signal.

  • Never solve the challenge on a different fingerprint than the one making the follow-up requests.

Hosts on record running it

From the detector's curated database. Observed, not live — stacks change, and large sites often run different protection per market.

Not sure this is what
is blocking you?

Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.