NewString UnraveledResearch powered by data we scrape from the web.Read the latest issue →
String
Book demoSign up
← Answers

Which scraping APIs can bypass DataDome in 2026?

String team · Published November 10, 2026 · Updated November 10, 2026

Four scraping APIs returned more than 90% of requests on the 19 DataDome sites in the October 30, 2026 run of the open Web Data Frontier Benchmark. Context.dev returned all 95. String and Scrape.do returned 93 of 95, or 97.9%, and Scrapfly 92.6%. The other 13 APIs scored between 85.3% and 7.4%. Every request was checked for text from the real page, so a DataDome challenge that came back with a success code counted as a failure.

None of the five tested vendors we found advertising a 98% to 99.99% success rate reached that number on the same run. The gap ran from 6.0 to 28.8 points. The section on published numbers below shows which claims come with a test you can rerun.

How the scraping APIs did on DataDome

Each of the 19 sites was requested five times per provider, 95 requests per provider. A request counted only when the body contained a marker from the real page.

Provider DataDome success rate Requests returned, of 95 Overall rate, 100 sites Anti-bot setting in the run
Context.dev 100% 95 93.0% Strongest offered
String 97.9% 93 98.6% Strongest offered
Scrape.do 97.9% 93 94.0% Strongest offered
Scrapfly 92.6% 88 86.8% Below its current setting
ScrapingBee 85.3% 81 85.2% Below its current setting
Firecrawl 85.3% 81 81.2% Below its current setting
Apify 85.3% 81 79.4% Strongest offered
ScraperAPI 75.8% 72 76.4% Below its current setting
Bright Data 74.7% 71 75.4% Strongest offered
Zyte 68.4% 65 79.6% Below its current setting
Oxylabs 67.4% 64 67.4% Strongest offered
Decodo 65.3% 62 71.2% Strongest offered
Nimble 64.2% 61 68.0% Below its current setting
ZenRows 52.6% 50 41.8% Strongest offered
Browserbase 31.6% 30 43.0% Strongest offered
Scrapingdog 16.8% 16 27.6% Below its current setting
ScrapingAnt 7.4% 7 40.0% Below its current setting

Eight providers ran below their current anti-bot setting: Scrapfly, Firecrawl, ScraperAPI, Zyte, ScrapingAnt, ScrapingBee, Scrapingdog and Nimble. Their adapters are in the public test code, and a provider can open a pull request to change its own. The test code also changed how it calls ScrapingBee, Decodo and Browserbase for this run, so a move for those three since September can come from the test, not the product. ZenRows' own API closed the connection without a response on the last 43 targets of the suite, and those attempts count as failures.

The DataDome sites in the run include idealista.com, seatgeek.com, marketwatch.com, wsj.com and barrons.com. The per-site grid is on the benchmark page and in the raw results.

DataDome splits the field more than the average shows

The 17 APIs averaged 68.7% on the DataDome sites in the October 30 run, against 71.1% across all 100 sites. The same 17 averaged 70.8% on Cloudflare sites, 64.8% on Akamai sites and 81.8% on PerimeterX sites.

The average hides the spread. Nine of the 17 scored lower on DataDome than on the run as a whole, and seven scored higher. ScrapingAnt fell the furthest, from 40.0% overall to 7.4% on DataDome. Zyte fell 11.2 points and Browserbase 11.4. Context.dev rose 7.0 points to 100%, Apify 5.9 and Scrapfly 5.8. String moved 0.7 points, from 98.6% overall to 97.9%.

So an overall leaderboard rank says little about DataDome on its own. Zyte ranks seventh of 17 overall and tenth on DataDome. Apify ranks eighth overall and ties for fifth on DataDome.

DataDome trains models per customer: it advertises tens of thousands of them, so the traffic it compares you to is each site's own (Scrapfly, updated August 2026). A pass on one DataDome site predicts less than a pass on one Cloudflare site. Nineteen sites is a sample, not the whole of DataDome's customer list, so run your own targets before you pick.

Want to check one of your own DataDome URLs now? curl -s https://request.usestring.ai/v1/fetch -H "Authorization: Bearer $STRING_API_KEY" -H "Content-Type: application/json" -d '{"url":"https://www.idealista.com/"}' returns the page, and the first 20,000 standard fetches are free.

Which scraping providers publish real success-rate numbers?

Few do. Most vendors publish one headline rate with no test set, no pass rule and no test code, so the number cannot be checked. Here are the claims we found on vendor pages, next to what the same vendors returned on the open run.

Vendor Published claim Method published with it Overall, October 30 run DataDome, October 30 run
Decodo 99.99% success rate (pricing page, checked September 2026) No 71.2% 65.3%
Bright Data 99.99% success rate (Bright Data blog, checked September 2026) No 75.4% 74.7%
Scrape.do 99.98% success rate (pricing page, checked September 2026) No 94.0% 97.9%
Scrapfly 99% success rate (search result, captured July 2026, shown here) No 86.8% 92.6%
ScrapingBee 98%+ success rate (search result, captured July 2026, shown here) No 85.2% 85.3%

The gap between claim and measurement was 28.8 points for Decodo, 24.6 for Bright Data, 12.8 for ScrapingBee, 12.2 for Scrapfly and 6.0 for Scrape.do. A vendor's own test can be true and still describe a different set of sites, a looser pass rule or retries the buyer never sees. A 99% from one vendor and a 98% from another describe two tests, not two products.

The third-party benchmarks have their own limits, as of July 2026:

  • Proxyway tells vendors ahead of time what the test will be, covers about 15 sites, and uses affiliate links. With roughly one site per anti-bot vendor, one site can be the whole DataDome grade.
  • AIMultiple reports anti-bot results for Cloudflare, PerimeterX and DataDome, and says on its site that paying vendors get a link on their name. It has since added more domains and an industry breakdown.
  • Scrapeway and ScrapingTest each present themselves as independent and rank one provider first. Their domain records trace Scrapeway to the company behind Scrapfly and ScrapingTest to the founder of Scrape.do, the providers they rank first.

A success rate you can trust has four parts: a published list of target URLs, a pass rule that checks the page content and not the status code, test code anyone can rerun with their own keys, and the failures shown next to the wins. Our post on the benchmark problem explains why we built one with all four. Disclosure: String built the Web Data Frontier Benchmark and sells the API that ranks first in it, which is why the targets, the pass rule and every adapter are open on GitHub. To test a vendor yourself, see how to evaluate a web scraping API during a trial.

How to tell a site uses DataDome

DataDome's challenge loads from captcha-delivery.com. A small page that names that host is a challenge, whatever its status code says (how to get past a CAPTCHA when scraping).

Look for these signs:

  • A short HTML page that loads a script from captcha-delivery.com, often a slider or a JavaScript "device check".
  • An x-datadome: protected response header. MarketWatch and WSJ sent it with a 401 in our stock market data test.
  • A 401 or 403 on the first request from a plain HTTP client. Our 403 guide maps each response shape to its fix.
  • A 200 with no content you expect. Check for text only the real page has, the same rule as for blocks that come back as HTTP 200.

A short check in Python catches the common shapes:

import re
import requests

DATADOME = re.compile(r"captcha-delivery\.com", re.I)

def looks_blocked(resp: requests.Response, expected_text: str) -> bool:
    body = resp.text or ""
    if resp.status_code in (401, 403, 429):
        return True
    if resp.headers.get("x-datadome") or DATADOME.search(body):
        return True
    # A 200 can still be a block: check for text that only the real page has.
    return expected_text.lower() not in body.lower()

Doing it yourself

A TLS-impersonating client fails first on DataDome. MarketWatch, WSJ and Barron's returned 401 to every local client we tried in October 2026, curl_cffi included.

A real browser runs DataDome's JavaScript, which an HTTP client cannot. A stock headless browser still leaves automation traces, and stealth builds close only some of them. Camoufox carries an issue in which a DataDome-protected classifieds site blocks it on every attempt while the same IP loads the page in a private browser tab.

What works today can stop working tomorrow. One r/webscraping user who ran a DataDome captcha solver wrote in January 2025: "It was working with a 100% success rate on a hundred requests, now it is 0%." (thread). Our answer on why scraping APIs break when bot protection upgrades covers that pattern.

For the general playbook, see how to scrape a website without getting blocked.

How String gets through DataDome

String is a web scraping API for developers and AI agents that returns protected pages in one request and bills only for successful requests. On DataDome-protected pages, that means:

  • String returned 93 of 95 DataDome requests in a public test. That was the October 30, 2026 run of the open benchmark, 19 DataDome sites at five attempts each (benchmark).
  • String returned 98.6% of all 500 requests in the same run, first of 17 APIs, and none of its responses was a block page sent with a success code (October results).
  • One request, no challenge handling on your side. A POST to /v1/fetch with a URL returns the page; String picks a plain request, a premium residential proxy or a real browser per page (fetch docs).
  • The site's own status comes back in a header. The x-status-code response header carries what the target returned.
  • A blocked request costs nothing. String bills only when content comes back (pricing).
  • Agents get it as a tool. The hosted MCP server gives Claude, Cursor, ChatGPT and other MCP clients web_access_fetch.

Here is the same call in Python:

import os
import requests

resp = requests.post(
    "https://request.usestring.ai/v1/fetch",
    headers={"Authorization": f"Bearer {os.environ['STRING_API_KEY']}"},
    json={"url": "https://www.idealista.com/", "format": "markdown"},
    timeout=150,
)
print(resp.headers.get("x-status-code"), resp.text[:500])

Where String fits

  • For: teams that need listings, prices, tickets or news from DataDome-protected marketplaces, classifieds and publishers, and would rather not run browsers and challenge handling themselves.
  • Not for: a site that sells the same data through an official API or feed, or pages behind a login you do not own.
  • Price: as of October 2026, Starter is $19 a month and Growth is $99 a month, plus usage. A standard fetch is $0.25 per 1,000 on Starter and $0.16 on Growth. A fetch on the premium residential proxy, used only when a page needs it, is $2.40 and $0.90 (pricing). The first 20,000 standard fetches are free.
  • Integrations: a REST API for any language, an OpenAPI spec, an MCP server, and String Actors in the Apify Store.
  • Limits: 15 requests a second on Starter, up to 90+ on Volume, and up to 10,000 concurrent fetches (pricing).

For every provider across all 100 sites, see the best web scraping APIs ranking. For the other walls, see PerimeterX (HUMAN), Akamai Bot Manager, Kasada and Cloudflare. Start with the DataDome page your scraper fails on today, and run it through the fetch call above with a free key.

FAQ

Which scraping APIs can bypass DataDome?

In the October 30, 2026 run of the open Web Data Frontier Benchmark, Context.dev returned all 95 requests to 19 DataDome sites. String and Scrape.do returned 93 of 95, or 97.9%, and Scrapfly 92.6%. ScrapingBee, Firecrawl and Apify scored 85.3%. The lowest of the 17 APIs tested scored 7.4%.

Which scraping providers publish real success-rate numbers?

Few publish a number you can check. Decodo and Bright Data advertise 99.99%, Scrape.do 99.98%, Scrapfly 99% and ScrapingBee 98%+, none with a published test set or test code. On the open October 30, 2026 run, the same five scored between 71.2% and 94.0% across 100 sites. A number is checkable when its target list, pass rule and test code are public.

Why do vendor success rates differ so much from independent tests?

The vendor picks the sites, the pass rule and the retries. A test of easy pages, or one that counts any 200 as a success, scores high. The open benchmark uses 100 sites chosen to be hard and counts a request only when the real page content comes back, so a challenge page with a 200 is a failure.

How do I know a site uses DataDome?

Look for a short page that loads a script from captcha-delivery.com, a slider or "device check" challenge, or an x-datadome response header. A 401 or 403 on the first request from a plain HTTP client is common. Some blocks come back as a 200 with no real content, so check for text you expect.

Does curl_cffi get past DataDome?

Not on the sites we tried. MarketWatch, WSJ and Barron's, all DataDome sites, returned 401 to every local client we tested in October 2026, curl_cffi included. DataDome scores more than the TLS handshake, and an HTTP client cannot run its JavaScript.

Do headless browsers get past DataDome?

Sometimes. A real browser runs DataDome's JavaScript, which an HTTP client cannot. DataDome also looks for automation traces, and stealth builds such as Camoufox still get blocked on some DataDome sites. Each update to DataDome's models can break a setup that worked the week before.

Why does a DataDome bypass work on one site and fail on the next?

DataDome trains its models on each customer's own traffic and advertises tens of thousands of them. A setup that passes one site's model can fail the next. In the October 30 run, 9 of 17 scraping APIs scored lower on DataDome sites than on the benchmark as a whole.

How do I test a scraping API on DataDome before I buy?

Run your own DataDome URLs, five attempts each, and count a request as passed only when the response contains text from the real page. Our open benchmark code does exactly this and runs with your own API keys. String's first 20,000 standard fetches are free.

Sources

Get your API key →Explore the Web Access API