What Is Imperva Incapsula? – Definition and How It Works
Learn what Imperva's edge security platform does, how its WAF and bot management combine, and what its classification looks for.
Incapsula is the original name for Imperva's cloud application security platform — a reverse proxy providing a web application firewall, bot management, denial-of-service protection, and content delivery. The product is now branded under Imperva.
1. What It Combines
| Component | Purpose |
|---|---|
| Web application firewall | Blocks requests matching attack patterns |
| Bot management | Classifies automated traffic |
| DDoS protection | Absorbs volumetric attacks |
| Content delivery | Caches and accelerates |
| API security | Protects and monitors API endpoints |
Because all of it sits at the edge, decisions are made before traffic reaches the origin — which is why a refusal can arrive in milliseconds and why error pages carry the platform's branding.
2. How Traffic Reaches It
DNS points at the platform rather than at the origin, so visitors connect to an edge node. The origin's real address is not exposed, and the platform can then filter, cache, and route.
That is the same architecture every edge security platform uses, and it is why the address a client connects to says nothing about the origin.
3. What Classification Evaluates
- Network signals — address reputation and network class.
- Transport signals — TLS handshake characteristics.
- Protocol signals — HTTP framing and header composition.
- Client-side telemetry from a script running in the page.
- Behavioural signals across a session.
As with comparable products, the decisive factor is usually contradiction between layers rather than any single value: a declared identity that the connection's own evidence does not support.
4. The Actions
Allow, challenge, throttle, monitor, or block — configured per category by the site. Monitor mode is the important operational feature, since it allows a rule's false-positive cost to be measured before it is enforced.
Because configuration is per customer, identical traffic can pass one site and be refused by another on the same platform.
5. Verified Bots
Known crawlers that publish address ranges and honour robots.txt are categorised separately and usually allowed.
For anyone running legitimate automation, that is the durable route: a documented user agent and published addresses make your traffic classifiable as something a site can permit deliberately.
6. What Visitors Experience
A challenge page, a delay, or a block page carrying a reference identifier. That identifier is what a site's operator needs to find the rule that matched, so including it in any support request is the fastest path to a resolution.
7. For Legitimate Collection
Persistent refusal is a signal about volume and consistency rather than a puzzle. Reduce request rate, preserve session state, keep the client internally coherent, and for anything sustained, seek permission or an API.
An allow-list entry keyed on a stable identifier survives platform updates in a way client tuning does not.
8. Summary
Imperva's platform, formerly Incapsula, is an edge reverse proxy combining a web application firewall, bot management, DDoS protection, and content delivery.
It classifies traffic from network, transport, protocol, client-telemetry, and behavioural signals, weighting contradiction most heavily, and applies per-site actions — which is why outcomes depend as much on configuration as on the traffic.