What Is DataDome? – Definition and How It Works

Learn what DataDome is, how its real-time detection works, how to recognise a DataDome block, and how it differs from Cloudflare's bot management.

DataDome is a commercial bot detection and mitigation service. Unlike a general CDN that added bot management, it was built for that single purpose — which shows in how aggressively it behaves and how quickly it decides.

1. What It Is

A bot protection layer sitting in front of a customer's site, evaluating every request in real time and deciding whether it comes from a human.

• Deployed as: a reverse proxy, a CDN integration, or a server-side module.
• Decides in: a few milliseconds, on every request.
• Outcomes: allow, challenge with a CAPTCHA, or block.
• Positioning: protection against scraping, credential stuffing, carding and account takeover.

It is heavily used in ecommerce, ticketing, classifieds and travel — verticals where scraping has direct commercial consequences.

2. How Detection Works

DataDome combines server-side and client-side signals:

Server-side, before any page loads:

• TLS fingerprint — which client library or browser performed the handshake
• HTTP/2 frame ordering and settings
• Header set, values and ordering
• IP reputation, ASN classification, and history across its whole customer base
• Request rate and timing patterns

Client-side, via injected JavaScript:

• Browser fingerprint — canvas, WebGL, fonts, screen, hardware
• Automation markers and property inconsistencies
• Behavioural signals — mouse movement, scroll dynamics, timing between interactions
• Environment coherence across all of the above

The cross-customer element is significant. A fingerprint or IP that misbehaved on one protected site carries that reputation to every other, so blocking can begin on a site you have never touched.

3. Recognising a DataDome Block

The distinguishing marker is the domain captcha-delivery.com:

<script src="https://ct.captcha-delivery.com/c.js"></script>

Also common:

• A datadome cookie set on the response
• x-datadome or x-dd-b response headers
• HTTP 403 with a challenge page body
• A geometric puzzle CAPTCHA rather than a checkbox

Content-only checks miss this reliably. A DataDome challenge frequently arrives with a plausible-looking response, so a scraper checking status codes alone records a success and stores nothing. Detect it by searching the body for captcha-delivery, not by trusting the status line.

4. Compared With Cloudflare

DataDome is generally the harder of the two to pass with an HTTP client, because it invests entirely in this one problem and leans on client-side behavioural signals that only a real browser environment can produce.

A caution when detecting either: /cdn-cgi/challenge-platform and cf-chl- scripts appear on normally served Cloudflare pages, not only on challenges. Treating their presence as proof of a block produces false positives on pages that returned perfectly good content.

5. Why HTTP Clients Fail Against It

The client-side layer is the reason. A plain HTTP request never executes the injected JavaScript, so the signals it would produce are simply absent — and absence is itself conclusive.

Even before that, the server-side layer usually settles it. A requests TLS fingerprint paired with a Chrome user agent is a contradiction, and contradictions are the strongest evidence a detector has.

6. What This Means Practically

• Detect the challenge explicitly. Search response bodies for captcha-delivery; do not infer from status codes.
• Expect a real browser to be required. Sites behind DataDome generally need genuine browser environments rather than impersonating HTTP clients.
• Environment coherence matters more than IP. Rotating addresses under an automation-flagged fingerprint changes little.
• Reputation is shared. Aggressive behaviour against one protected site affects your access to others.
• Check for an official API first. Many DataDome-protected sites offer data feeds or partner APIs, and that route removes the problem rather than fighting it.

7. Real-World Examples

• A scraper reporting 100% success and storing zero rows, because every 403 challenge page parsed cleanly to nothing.
• A retailer where residential proxies changed nothing, since the block keyed on TLS and automation markers.
• A previously working setup blocked on a new site, on reputation accumulated elsewhere.
• A Cloudflare false positive, where a script-include on a normal page was read as a challenge and a valid 1.98 MB response was discarded.
• A ticketing site requiring a full browser where an impersonating HTTP client had sufficed elsewhere.

8. Summary

DataDome is a dedicated bot detection service that evaluates every request in real time using TLS and HTTP/2 fingerprints, IP reputation, injected client-side fingerprinting, and behavioural signals — with reputation shared across all the sites it protects.

Recognise it by captcha-delivery.com in the response body, a datadome cookie, or x-datadome headers. Detect it by inspecting content, because challenges arrive as parseable pages and status codes alone will report success.

It is generally stricter than a CDN's bot management because client-side behavioural signals are central to it. Where a site is behind DataDome, checking for an official data route is usually a better first step than escalating the technique.

Potential Related Glossary

• DataDome
• Browser Fingerprints
• Headless Browser
• Residential Proxies