WAF · Imperva
Imperva (Incapsula)
Difficulty 4/5
A full WAF with Advanced Bot Protection bolted on. Strong on reputation and rules, and it leaves the most legible fingerprint of any vendor here.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: high
How it decides
-
Reputation and rule evaluation at the edge, with a JS challenge served from an `_Incapsula_Resource` path.
-
`visid_incap_<siteId>` and `incap_ses_<n>_<siteId>` cookies carrying visitor and session identity.
-
Advanced Bot Protection — the former Distil Networks engine — adds device fingerprinting and behavioural scoring.
-
An incident id printed on every block page, which is genuinely useful when you are debugging your own traffic.
What you see when it stops you
- “Request unsuccessful. Incapsula incident ID: 1234-567890”
- `x-iinfo` or `x-cdn: Incapsula` response headers
- `visid_incap_`, `incap_ses_` or `nlbi_` cookies
- A `/_Incapsula_Resource?SWJIYLWA=…` script tag
Signatures the detector matches
Publicly observable artefacts Imperva (Incapsula) sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | x-iinfo header | 75 |
| Header | x-cdn: Incapsula | 70 |
| Cookie | visid_incap_* visitor cookie | 70 |
| Cookie | incap_ses_* session cookie | 70 |
| Cookie | nlbi_* load-balancer cookie | 45 |
| Page markup | _Incapsula_Resource challenge script | 75 |
| Page markup | Incapsula incident page | 75 |
| Status | 403 block response | 10 |
What actually gets through
-
Residential exits. The reputation feed is broad and datacenter ranges are heavily represented in it.
-
A real browser to satisfy the resource challenge and hold the `visid_incap_` identity.
-
Long, slow sessions. Rules here fire on velocity more readily than on fingerprint alone.
-
Preserve cookie ordering and casing — a mismatched jar is itself scored.
Hosts on record running it
From the detector's curated database. Observed, not live — stacks change, and large sites often run different protection per market.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.