How Scraping Pipelines Handle Human Security and PerimeterX Bot Defender
Human Security (formerly PerimeterX) Bot Defender is widely deployed on major e-commerce platforms, media sites, and travel booking systems. It is one of the most common bot detection systems that enterprise scraping pipelines encounter on retail and consumer-facing web properties. Its defining characteristic is the depth of its behavioral biometric analysis — it is designed specifically to distinguish human and automated interaction patterns at the signal level.
This article explains how Human Security’s detection works, what it specifically checks, and what production pipelines require to collect from protected sources. Webparsers provides structured data from protected sources through our API Marketplace — see API Docs for coverage. See also our article on handling anti-bot systems.
Human Security’s Detection Architecture
| Detection layer | Signal type | What automation fails on |
|---|---|---|
| Behavioral biometrics | Mouse dynamics, scroll velocity, click patterns, keyboard timing | Absent mouse events, mechanically uniform timing, no scroll physics |
| Device fingerprinting | Canvas, WebGL, audio, fonts, screen, navigator properties | Headless browser signatures, inconsistent device profiles |
| Code Defender | JavaScript runtime integrity, DOM manipulation detection | Injected scripts that modify page behavior or intercept events |
| Network signals | IP reputation, TLS fingerprint, HTTP/2 settings | Datacenter IPs, known proxy providers, automation TLS profiles |
| Collective intelligence | Cross-customer attack signals, shared threat database | IPs/devices identified on other Human Security customers are shared |
The Code Defender component is worth noting specifically — it detects automation tools that inject scripts into the page or modify the DOM to intercept events. Some collection approaches instrument the page directly; Code Defender is designed to detect this instrumentation and flag the session.
Why Behavioral Biometrics Is the Core Challenge
Behavioral biometrics are harder to fake than static fingerprint values for a specific reason: they need to be statistically consistent with real human behavior over time, not just present in the correct form.
- Mouse movement must have realistic physics. Human mouse movement has acceleration, deceleration, curvature, and micro-corrections. Perfectly linear mouse paths, or mouse movement at constant velocity, are immediately anomalous. The simulation must produce movement that follows human motor control patterns.
- Scroll behavior has expected characteristics. Human scrolling accelerates and decelerates, pauses, and reverses. Instant full-page scrolls or mechanically regular scroll increments do not match human behavior profiles.
- Absence of behavioral signals is itself a signal. A session where the page loads and a request is made with no mouse movement, no scroll events, and no interaction is not just missing signals — the absence itself scores as high-confidence automation.
- Behavioral patterns must persist across requests. A session that produces behavioral signals on the first page but not subsequent pages is flagged as potentially automated — real users maintain consistent behavioral patterns throughout a session.
Infrastructure Requirements for Human Security Targets
- Headless browser with comprehensive anti-detection. The complete fingerprint hardening required for DataDome applies here too — canvas, WebGL, audio, navigator properties, and hardware signals must form a coherent, realistic device profile. See our article on headless browser tools.
- Behavioral simulation before and during data collection. Mouse movement, scrolling, and interaction patterns must be simulated throughout the session. Behavioral simulation that only runs on the entry page and stops during collection is detected by Human Security’s session-level behavioral analysis.
- No DOM manipulation or event interception by collection code. Code Defender detects injected scripts and DOM modification. Collection approaches that instrument the page directly trigger this detection. Browser-level collection without page instrumentation is required.
- Residential proxies with clean Human Security network reputation. The collective intelligence network means that IP reputation on Human Security is shared across all customers. Burned IPs lose effectiveness everywhere Human Security is deployed simultaneously. See our article on proxy management.
How Webparsers Handles Human Security Protected Sources
- We simulate continuous behavioral signals throughout each session. Behavioral simulation does not stop after page load — it continues through the collection process. Human Security’s session-level behavioral analysis requires sustained, consistent signals, not a one-time burst of mouse events at page entry.
- We avoid page instrumentation that Code Defender detects. Our collection approach does not inject scripts into pages or intercept events in ways that Code Defender identifies as automated tooling.
- We maintain dedicated proxy pools with clean Human Security reputation. Given the shared threat intelligence network, we segment proxy pools for Human Security targets to protect IP reputation from contamination by other collection activities.
- We monitor behavioral scoring indicators per source. Rising challenge rates or challenge escalation patterns indicate that Human Security’s model has updated or our behavioral simulation is being detected. Monitoring provides time to adapt before coverage degrades. See our article on scraping monitoring and alerting.
- Data from Human Security protected sources is available through our API Marketplace for supported platforms. See API Marketplace for available structured data.
Discuss Human Security Protected Source Collection
Frequently Asked Questions
What is Human Security and how is it related to PerimeterX?
Human Security is the company formed from the merger of White Ops and PerimeterX. The PerimeterX Bot Defender product continues under the Human Security brand. Sites that showed PerimeterX scripts are now running Human Security’s platform — the technology is the same product line, evolved under the Human Security name. The underlying detection approach — behavioral biometrics, JavaScript fingerprinting, collective intelligence network — remains consistent with the PerimeterX product.
How does PerimeterX Bot Defender detect automation?
Bot Defender deploys a JavaScript sensor that collects behavioral biometric signals (mouse movement, keyboard timing, scroll physics, click patterns) alongside device fingerprints and network signals. These are scored against models trained on real human behavior. Sessions without behavioral signals, with automation-characteristic fingerprints, or from IPs with poor reputation in Human Security’s network receive challenges or blocks. The system is particularly sensitive to absent mouse events and mechanically consistent timing.
What is Human Security Code Defender?
Code Defender is a component of Human Security’s platform that monitors the JavaScript runtime for evidence of automation tooling — injected scripts, DOM manipulation, event interception, and browser extension interference. It is designed to detect collection approaches that instrument the page directly rather than operating at the browser environment level. Collection that avoids page instrumentation does not trigger Code Defender; collection that injects code or modifies the DOM does.
Does Human Security affect all pages on a protected site equally?
No. Like most bot protection deployments, Human Security is typically configured more aggressively on high-value pages — checkout, account login, search results on competitive platforms — than on general content pages. The protection configuration is set by the site operator, so protection levels vary per page type and per customer. Understanding which pages have strong Human Security deployment and which have lighter configuration is part of any collection design for Human Security protected domains.