> ## Documentation Index
> Fetch the complete documentation index at: https://docs.roolink.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Identify the protection on a site

> Two minutes with a powhttp recording tells you whether a target is Akamai Web, Akamai BMP, or something Roolink does not cover, and which extra checks the site has switched on.

Every protection vendor leaves fingerprints in the traffic: the cookies it sets, the scripts it loads, and the shape of its block page. Record one visit with [powhttp](/capture-requests), then read the three places below.

## Look at the cookies

Open the first response from the site's own host and read its `set-cookie` headers.

| Cookie names                                           | What it means                                                                                                                                         |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| `_abck`, `bm_sz`, and often `bm_sv`, `bm_mi`           | Akamai Bot Manager. The `_abck` value is long and contains `~-1~` on a fresh session; a browser that passed the sensor check has `~0~` there instead. |
| `sbsd_o`, `bm_so`, `bm_o`, `bm_sc` alongside the above | Akamai with SBSD switched on. See [SBSD](/akamai-web/sbsd).                                                                                           |
| `sec_cpt` alongside the above                          | Akamai with Sec-CPT switched on. See [Sec-CPT](/akamai-web/sec-cpt).                                                                                  |
| `datadome`                                             | DataDome. Not Akamai; Roolink does not cover it.                                                                                                      |
| `cf_clearance`, `__cf_bm`                              | Cloudflare. Not Akamai; Roolink does not cover it.                                                                                                    |
| `_px2`, `_px3`, `_pxvid`                               | HUMAN (PerimeterX). Not Akamai; Roolink does not cover it.                                                                                            |

In a mobile app the same Akamai cookies appear on the app's API host, and protected requests carry an extra header, `X-acf-sensor-data`, with a long opaque value. That header is the mark of Akamai BMP, the SDK version of Bot Manager.

## Look for the script

Akamai Bot Manager loads one script from the site's own host. Its path looks random, has no file extension, and is usually the last `<script>` before `</body>`:

```html theme={null}
<script type="text/javascript" src="/aB3dE/fG7/hI/jK/LmNoPqRsTuVwXyZ" defer></script>
```

The browser posts to that same path a moment later with a `sensor_data` body. If you see the pair, the site runs Akamai Web, and the [Quickstart](/akamai-web/quickstart) is your next stop.

Two smaller scripts tell you which extras are on:

| Script                                                                   | Extra                                                                                                                             |
| ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- |
| A second script on the site's host whose query string carries `v=<UUID>` | SBSD. A `t=` parameter next to the `v=` means the site is actively challenging you: [SBSD challenge (429)](/akamai-web/sbsd-429). |
| A script whose response mentions `bazadebezolkohpepadr`                  | Pixel. Present on many sites, enforced on very few. See [Pixel](/akamai-web/pixel).                                               |

## Look at the first blocked response

When a request is refused, the response itself names the vendor.

| Response                                                                                                             | What it means                                                                                     |
| -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| `403` with an "Access Denied" page and a line such as `Reference #18.6f2c1a7b.1700000000.abc123`                     | Akamai. The reference number is the giveaway.                                                     |
| `429` whose body contains the SBSD script tag with `v=` and `t=` in its query, or a small JSON body with a `t` token | Akamai SBSD challenge: [SBSD challenge (429)](/akamai-web/sbsd-429).                              |
| `428` with a JSON body containing `sec-cp-challenge`, `token`, `nonce` and `difficulty`                              | Akamai Sec-CPT: [Sec-CPT](/akamai-web/sec-cpt).                                                   |
| A protected action returns an error page or empty result while `_abck` still contains `~-1~`                         | Akamai, and the sensor was never accepted. Work through the [Quickstart](/akamai-web/quickstart). |
| A page titled "Please verify you are a human" with a `datadome` cookie                                               | DataDome. Not covered.                                                                            |
| "Checking your browser" or "Just a moment…"                                                                          | Cloudflare. Not covered.                                                                          |

## Pick the product

| You are automating     | Signs                                                                            | Product                                                                                                                 |
| ---------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| A website in a browser | `_abck` and `bm_sz` cookies, the random-path script, `sensor_data` posts         | [Akamai Web](/akamai-web/quickstart)                                                                                    |
| A mobile app's API     | `X-acf-sensor-data` header on protected requests, Akamai cookies on the API host | [Akamai BMP](/akamai-bmp/quickstart)                                                                                    |
| Anything else          | None of the above                                                                | Roolink does not cover it today. Ask in [Discord](https://discord.gg/rooapi) if you are unsure what you are looking at. |

A site can run more than one layer. Solve the sensor first, then add SBSD, Sec-CPT or Pixel only when the recording shows the site uses them.