Website Antibot API

OverviewLink to Overview

Before scraping a website, it helps to know what kind of bot protection stands in your way. The Website Antibot API answers that question: send a URL and get back the protection vendor Piloterr recognizes (Cloudflare, DataDome, Akamai, a captcha, and more).

Piloterr loads the page once, like a normal browser visit, and looks at the response: HTTP headers, cookies, and page content. It reports what it finds, how sure it is, and the clues that matched.

This is detection only. It does not solve captchas, bypass WAFs, or scrape protected pages. Use it to decide your next step: Website Crawler, Rendering, or WebUnlocker.

Costs 1 credit per call.

When to use itLink to When to use it

• You tried to crawl a site and got blocked: find out who is blocking you.
• You are building a pipeline and want a quick pre-check before picking an endpoint.
• You monitor competitors or prospects and want to know if they added bot protection.
• You need a simple answer for a client or teammate: "This site runs on Cloudflare Bot Management."

QuickstartLink to Quickstart

GET https://api.piloterr.com/v2/website/antibot?query=https://www.example.com&timeout=15

ParametersLink to Parameters

Response exampleLink to Response example

{
  "requested_url": "https://www.example.com",
  "final_url": "https://www.example.com/",
  "status": 200,
  "vendor": "cloudflare",
  "confidence": "high",
  "detections": [
    {
      "vendor": "cloudflare",
      "confidence": "high",
      "evidence": [
        "Header cf-ray: abc123-LHR",
        "Cookie __cf_bm present (Bot Management)"
      ]
    }
  ]
}

When nothing is detected:

{
  "requested_url": "https://example.org",
  "final_url": "https://example.org/",
  "status": 200,
  "vendor": "none",
  "confidence": null,
  "detections": []
}

Understanding the responseLink to Understanding the response

Each item in detections:

How to read it: start with root vendor + confidence for a quick answer. Open detections when you need the full picture or when several protections overlap.

Detected protectionsLink to Detected protections

Good to knowLink to Good to know

• A challenge page (403, 503, "Checking your browser") is still a successful analysis. That page is often exactly the signal you were looking for.
• none is not a guarantee. Some protections only show up after JavaScript runs in a real browser.

What to do next on PiloterrLink to What to do next on Piloterr

Error codesLink to Error codes

LimitationsLink to Limitations

• Passive check: one HTTP request, no JavaScript execution on the page.
• Captcha widgets or sensor scripts injected at runtime may not appear in the raw HTML.
• For research and planning only, not for bypassing protections.