What protects US public-data portals: a 61-URL census
Before the benchmark ran, 61 candidate URLs were fetched once each from a clean US datacenter IP with an honest User-Agent, to establish which targets are protected at all. That census is why the study has a difficulty ladder rather than a list of homepages: only 18 of the first 50 candidates returned usable content, and of 22 state business-entity search portals probed, three did — Alabama, Rhode Island and Minnesota.
These pages group the results by what sits in front of the portal.
| System | Portals found | Did any tier get past it? |
|---|---|---|
| Cloudflare | 8 | No. Higher tiers turn a 403 into a challenge, never into a page. |
| Imperva (Incapsula) | 3 | No. Identical 212-byte stub on all six arms. |
| reCAPTCHA and generic captchas | 7 | No. Nothing solves a captcha over HTTP. |
| CloudFront 403 | 3 | Yes — residential scored 100% on Arkansas, the only such case in 32 targets. |
| Tarpit | 3 | Partly. A proxy gets an answer; the answer is a captcha. |
| HTTP 202 with an empty body | 2 | No. Identical on every arm. |
| JavaScript shell | 3 | Not applicable — nothing is blocking. It needs a browser. |
| DataDome | 1 | Not measured. The one target found was excluded at the compliance gate. |
The finding that runs through all of them
Across all 1,920 benchmark requests, as the proxy tier climbs the blocked
count falls and the challenge count rises, monotonically:
| Arm | blocked | challenge |
|---|---|---|
| direct (no proxy) | 50 | 40 |
| datacenter, pinned | 50 | 48 |
| datacenter, rotating | 54 | 49 |
| anti-detect, pinned | 36 | 67 |
| anti-detect, rotating | 38 | 72 |
| residential | 20 | 84 |
Anti-Detect Mode and residential exits do something real and measurable: they get past the outright 403 and reach the challenge page. Nothing converts a challenge into a success, because a plain HTTP client cannot solve an interactive challenge at any tier or price.
On these targets the binding constraint is not the IP address and not the TLS fingerprint. It is the challenge, and the honest answer for those targets is a real browser — see the Browser API — or an official bulk download, not a more expensive proxy tier.
A caution about signature-based censuses
The classifications on these pages come from matching vendor signatures against
the response body. That over-reports: Cloudflare injects its challenge script
into ordinary responses it proxies, and g-recaptcha appears on any page that
embeds the widget, including a search form that renders perfectly. Two
benchmarked targets and one census row are flagged on their own pages as
probable misclassifications. Read a signature as "this vendor is in the path",
not as "this request was blocked".
Run date: 2026-08-18 · All 32 benchmarked targets · Excluded targets · Full report · Census data
Test your own target
The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.