Akamai Bot Manager is Akamai's enterprise bot-detection product, running at the CDN edge in front of the origin server on a large share of e-commerce, airline, ticketing, and financial-services sites. It scores requests using sensor data, device fingerprinting, and behavioral analytics before deciding whether to serve, challenge, or block.
Akamai injects a JavaScript payload (commonly referred to as sensor data) into pages that collects browser and device signals — screen properties, installed fonts, canvas rendering, navigator fields, timing data — and posts them back for scoring. It also sets characteristic cookies, most visibly _abck and bm_sz, which track a session's trust level across requests and are themselves a giveaway that a site runs Akamai when you inspect the response.
Because the sensor data runs client-side, a plain HTTP request that never executes JavaScript often can't produce it at all, which is one reason Akamai-protected sites are a common trigger for needing a real (or well-emulated) browser engine rather than a bare HTTP client.
A hard block from Akamai Bot Manager typically shows up as a 403 with an Akamai reference ID in the response body — distinct from a generic origin-server 403, and a useful diagnostic clue on its own. Akamai also supports softer responses: serving deliberately degraded or rate-limited content to low-trust sessions instead of an outright block, which can look like a scraping bug (missing fields, truncated results) rather than a detection event if you're not specifically checking for it.
As with other anti-bot vendors, the fix isn't solving the block after the fact — it's presenting a request whose network, browser, and behavioral signals are internally consistent enough that the sensor data never scores as automated in the first place.
How Crawlora handles this
Crawlora's browser-rendering tier executes JavaScript with a real, patched engine — so Akamai's sensor data reflects the same coherent browser and IP identity across every layer — rather than trying to hand-craft or replay the sensor payload separately from the rest of the request.
Glossary
FAQ
Look for the _abck and bm_sz cookies in the response, or an Akamai reference ID in a 403 block page's body. Crawlora's Anti-Bot Index also publishes scan results identifying the anti-bot vendor and configuration for a large set of sites.
No — they're competing products from different companies, each with its own detection logic, sensor data format, and thresholds. A technique that gets a request through a Cloudflare-protected site doesn't necessarily work against an Akamai-protected one, and vice versa.
Akamai can serve degraded or partial responses to low-trust sessions instead of a hard block, which shows up as missing fields or truncated results rather than an obvious error. If output looks incomplete on a site you know runs Akamai, treat it as a possible soft-block signal, not just a parsing bug.
Beyond Akamai Bot Manager, Crawlora's own docs cover the rest of the stack — browse the APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.