Imperva Incapsula
and CapMonster Cloud

Captcha solving, site installation, and testing.

Pricing of Imperva Incapsula solution

CAPTCHA
Price (USD)
$ 2.00
1000 tokens
Inherited a site with a captcha or another protection layer but no access to the source code? In that case you naturally ask: which solution is installed, is it configured correctly, and how can the workflow be tested?

In this article, we have tried to answer all the key questions. The first step in solving the task is to determine which protection system is being used. To do this, you can refer to the list of popular captchas and anti-bot protection systems, where you will find visual examples and key indicators that help you quickly understand what you are dealing with.

If you discover that your site uses Imperva Incapsula, the next step is to study its properties and operation in more detail. In this article, you can also review the instructions on how to integrate Imperva Incapsula so that you fully understand how it functions on your site. This will help you not only understand the current protection, but also properly plan its maintenance.

What is Incapsula
What is Incapsula
Imperva Incapsula Web Protection is a cloud-based system for protecting websites and applications from external threats. The system uses secure reverse proxies and a Web Application Firewall (WAF) located worldwide on CDN servers. The site is routed through secure Imperva servers, allowing every request to be inspected and malicious activities to be filtered.

How to solve Incapsula via CapMonster Cloud

When testing pages protected by Imperva Incapsula, it is often necessary to ensure that the protection is working correctly and that the system properly filters suspicious traffic.

You can manually check the protection on your site:

  • Open the desired page and ensure that Incapsula presents a check.
  • Try to access without completing the check — the site should return a 405 error or an additional challenge.
  • After passing the check, access should open without errors.

To automate such checks, you can use services like CapMonster Cloud.

CapMonster accepts Imperva challenge parameters (e.g., the _incap_ cookie, data from HTML and scripts), processes them, and returns ready-made valid cookies that can be inserted into a browser or HTTP client.

Working with CapMonster Cloud via API typically involves the following steps:

Creating a taskCreating a task
arrow
Sending an API requestSending an API request
arrow
Receiving the resultReceiving the result
arrow
Injecting Incapsula cookies into the pageInjecting Incapsula cookies into the page
arrow
Imperva Incapsula recognition using ready-made libraries
The CapMonster Cloud service provides ready-made libraries for convenient work in Python and JavaScript (Node.js).
Python
JavaScript
Solving, retrieving parameters, and setting cookies
An example in Node.js for the full cycle of captcha recognition on your web page. Possible approaches: use HTTP requests to get HTML and protection system parameters, send the response, and process the result. Or using automation tools (e.g., Playwright) — open the page, wait for the check, send parameters via the CapMonster Cloud client, receive the result, substitute cookies into the browser (for testing, you can use both correct and incorrect data), and view the result.
// npm install playwright @zennolab_com/capmonstercloud-client
// npx playwright install chromium

import { chromium } from "playwright";
import { CapMonsterCloudClientFactory, ClientOptions, ImpervaRequest } from '@zennolab_com/capmonstercloud-client';

async function main() {
    // 1) Settings
    const TARGET_URL = "https://example.com";
    const API_KEY = "YOUR_CAPMONSTER_API_KEY";

    const proxy = {
        proxyType: "http",
        proxyAddress: "PROXY_IP",
        proxyPort: 8080,
        proxyLogin: "PROXY_USER",
        proxyPassword: "PROXY_PASS"
    };

    // 2) Open the site and collect Imperva cookies
    const browser = await chromium.launch({
        headless: true,
        proxy: {
            server: `${proxy.proxyType}://${proxy.proxyAddress}:${proxy.proxyPort}`,
            username: proxy.proxyLogin,
            password: proxy.proxyPassword
        }
    });

    const page = await browser.newPage();
    await page.goto(TARGET_URL, { waitUntil: "networkidle" });

    const cookies = await page.context().cookies();
    const impervaCookiesString = cookies
        .filter(c => c.name.startsWith("visid_incap_") || c.name.startsWith("incap_ses_"))
        .map(c => `${c.name}=${c.value}`)
        .join("; ");

    console.log("Imperva cookies from the current page:", impervaCookiesString);

    await browser.close();

    // 3) Solve the Imperva challenge
    const cmcClient = CapMonsterCloudClientFactory.Create(
        new ClientOptions({ clientKey: API_KEY })
    );

    const impervaRequest = new ImpervaRequest({
        websiteURL: TARGET_URL,
        userAgent: "USER_AGENT_STRING",
        metadata: {
            incapsulaScriptUrl: "_Incapsula_Resource?example_param",
            incapsulaCookies: impervaCookiesString
        },
        proxy
    });

    const result = await cmcClient.Solve(impervaRequest);
    console.log("Solution:", result);

    // 4) Substitute the received cookies
    const domain = new URL(TARGET_URL).hostname;
    const solutionCookiesObj = result.solution.domains[domain].cookies;

    const solutionCookies = Object.entries(solutionCookiesObj).map(([name, value]) => ({
        name,
        value,
        domain: ".your-domain",
        path: "/",
        secure: true,
        httpOnly: false
    }));

    // 5) Setting cookies and opening the page
    const browser2 = await chromium.launch({
        headless: false,
        proxy: {
            server: `${proxy.proxyType}://${proxy.proxyAddress}:${proxy.proxyPort}`,
            username: proxy.proxyLogin,
            password: proxy.proxyPassword
        }
    });

    const context2 = await browser2.newContext();
    await context2.addCookies(solutionCookies);

    const page2 = await context2.newPage();
    const resp2 = await page2.goto(TARGET_URL, { waitUntil: "networkidle" });

    // Outputting the final page status (optional)
    // console.log("Final page status after setting cookies:", resp2?.status());

    // …or final screenshot
    // await page2.screenshot({ path: "final_page.png" });

    console.log("Page loaded with applied Imperva cookies.");
}

main().catch(console.error);

How to connect Imperva Incapsula to your site
To confidently navigate captcha operation on your site, understand its verification logic, reconnect or reconfigure, we recommend studying this section. It describes the protection connection process — this will help you quickly understand all the nuances.

1. Create an account (use your work email for registration) and go to the Imperva Cloud Security Console.

2. Confirm your email. After logging in, you will be taken to the control panel (you can learn more about working with the Security Console in the documentation).

3. Open the Websites section and enter the real domain of your site.

HowTo Connect image 1

Imperva will automatically:

  • detect your DNS provider,
  • check SSL,
  • start scanning DNS records.

4. Configure DNS records. If Imperva shows the step:

Point dev.mysite.com DNS records to Imperva

Do the following:

  • Go to the DNS panel of your registrar or hosting.
  • Create or update the record:


Type: CNAME
Name: dev (subdomain you are connecting)
Value: <your_imperva_host>.ng.impervadns.net

Example:

dev.mysite.com > CNAME > xivaxeo.ng.impervadns.net

Optional: enable support for Non-SNI clients

If Imperva shows the notification:

If you expect Non-SNI traffic…

This applies to legacy clients and specific integrations. If your site is standard, this step can be skipped.

If needed, enable:

CDN > Delivery > Support Non-SNI clients

5. Wait for DNS verification. Imperva will activate protection and SSL.

When DNS connects, Imperva will automatically:

  • deploy CDN,
  • activate WAF (Web Application Firewall),
  • create an HTTPS certificate,
  • enable protection against DDoS and bots.

6. Restrict direct access to your server (recommended)

To ensure traffic goes only through Imperva, on your server you should:

  • allow access only from Imperva IP addresses,
  • block direct connections (except for your own IPs),

You can learn more in the Create Rules section.

7. Check site operation. After activation

  • open your subdomain/domain in a browser,
  • or use curl:

curl -I https://dev.mysite.com

The headers should contain lines like:


HTTP/1.1 403 Forbidden
Content-Type: text/html
Cache-Control: no-cache, no-store
Connection: close
Content-Length: 1234
X-Iinfo: 00-00000000-0 0NNN RT(1234567890 0) q(0 -1 -1 1) r(0 -1) B16(0,0,0) U24
Strict-Transport-Security: max-age=31536000
Set-Cookie: visid_incap_00000000000000000000000000000000=ABCDEFG1234567890TESTCOOKIE; expires=Wed, 11 Nov 2026 23:41:40 GMT; HttpOnly; path=/; Domain=.example.com; Secure; SameSite=None
Set-Cookie: incap_ses_0000_00000000=TESTSESSION1234567890; path=/; Domain=.example.com; Secure; SameSite=None

This means that traffic is passing through Imperva.

Background
Possible errors and debugging
Bug Icon
Invalid domain or rule — Challenge is not shown.
Check that the Security Rule is bound to the correct domain and path, and that there are no conflicts with IncapRules or ACL.
Bug Icon
Page loading or verification timeout.
The browser might not wait for the Imperva response. Increase timeouts in tests and ensure the backend responds quickly enough.
Bug Icon
Expired Imperva-cookies.
Outdated visid_incap, incap_ses, nlbi cause a repeated Challenge or blocking.
Bug Icon
Excessively sensitive rules.
Strict signatures may block real visitors to your site.
Bug Icon
Incorrect configuration.
Incorrect settings or rules that do not take into account site specifics cause erroneous blocks and false positives.
Protection resilience checks
After integration, make sure the system really protects the site from automated actions.
Security and optimization tips
Configure WAF and Security Policies according to risk level. Use Managed Rules, Bot Protection, and custom rules for more precise control.
Log security events and WAF triggers to identify false positives and analyze blocking reasons.
For transparency, add links to the <span class="font-bold">Privacy Policy</span> and <span class="font-bold">Terms of Use</span>. This is important for transparency and compliance with security requirements.
Conclusion

If you’ve taken over a website that already has a captcha or another protection system installed, but you don’t have access to the code, don’t worry! It’s quite easy to identify which technology is being used. To verify that everything works correctly, you can use the CapMonster Cloud recognition service in an isolated test environment to make sure that the token processing mechanism and the validation logic are functioning properly.

In the case of Imperva Incapsula, it’s enough to detect the system, observe its behavior, and confirm that the protection is working correctly. In this article, we showed how to identify Imperva Incapsula and where to find instructions on how to integrate or reconfigure it, so you can confidently maintain the protection and keep its operation under control.

Conclusion
Helpful links
DocIconImperva Incapsula DocumentationDocIconLogin to Cloud Security ConsoleDocIconCapMonster Cloud Documentation (working with Imperva Incapsula)

Frequently Asked Questions about Imperva Incapsula

The official JavaScript and Python SDK libraries allow you to simplify integration instead of handling low-level API polling manually.

Their general logic includes the following steps:

  1. Create an ImpervaRequest with websiteURL and a metadata object. That metadata must include:
    • incapsulaScriptUrl — Name of the Incapsula JS file.
    • incapsulaCookies — The cookies from Incapsula. They can be obtained on the page using document.cookie or in the request header Set-Cookie: "incap_ses_=...; visid_incap_=..."
    • reese84UrlEndpoint (optional) — The name of the endpoint where the reese84 fingerprint is sent; can be found among the requests and ends with ?d=site.com
  2. For the JavaScript/Node.js client, use Solve() to wait for a ready solution.
  3. The returned solution contains valid cookies.

Python follows the same overall workflow.

  1. Create an Imperva account
  2. Open the Cloud Security Console
  3. Add your site in the Websites section

Imperva then provides the DNS target you should use, typically as a CNAME for the subdomain you are connecting.

Once the DNS connection is verified, Imperva activates the CDN/WAF layer and routes traffic through its infrastructure before forwarding requests to your origin.

To confirm the setup, complete a header-only request such as curl -I https://dev.mysite.com.

If traffic is passing through Imperva correctly, the example response includes 403 Forbidden and Set-Cookie headers such as visid_incap_* and incap_ses_*.

Most Imperva Incapsula integration errors are caused by proxy, cookie, timing, or rule configuration issues. Check these first:

  • Error 16: Your proxy geolocation does not match the required region. Use a proxy from the correct country or region.
  • Invalid domain or rule configuration: Verify the target domain, WAF rule binding, and integration settings.
  • Verification timeout: Some challenge parameters expire quickly, so collect fresh page data and submit it right away.
  • Expired Imperva cookies: Refresh cookies before retrying the request.
  • Proxy or browser mismatch: Use your own proxy and send the current Windows browser userAgent for the task.
  • Repeated checks or failed verification: Review cookies, proxy region, rule sensitivity, and timeout settings before assuming the payload is wrong.

Dynamic parameters visid_incap_* and incap_ses_* are short-lived. Using expired ones results in Imperva issuing a repeated challenge or blocking the request outright. The fix is to re-collect fresh cookies from the page and immediately submit a new task to CapMonster Cloud with the updated incapsulaCookies inside the metadata object.

Imperva Incapsula is described as a cloud-based protection layer that uses secure reverse proxies and a Web Application Firewall deployed on CDN infrastructure.

In that model, site traffic is routed through Imperva servers, where requests can be inspected and malicious activity can be filtered before traffic reaches the origin.

To make that architecture effective, we also recommend restricting direct access to your server and allowing traffic only from Imperva IP ranges where appropriate.