Resolving Incapsula/Imperva 403 Errors
Incapsula (Imperva) uses device fingerprinting with reese84 and utmvc challenges. Cookies are bound to IP addresses and cannot be modified. MeshPrivacy generates valid session cookies by completing the fingerprint verification process from your IP.
Critical: IP-Bound Cookies
Incapsula cookies cannot be manually modified and are bound to your IP address. Cookies generated from a different IP will not work. Ensure consistent IP usage throughout your session.
Error Codes
| Code | Meaning | Resolution |
|---|---|---|
| 403 | Most common block response | Generate valid session cookies via API |
| 200 | Deceptive block page (Imperva HTML) | Detect and solve embedded challenge |
Cookies & Headers
incap_ses_* - Session tokenvisid_incap_* - Visitor device IDFormat: incap_ses_[site_id]=[token]
X-Iinfo - Incapsula infoX-CDN: IncapsulaCheck these headers to identify Incapsula protection.
Service Variants
Fingerprint sensor data submission. Collects browser and device characteristics for verification against Imperva's database.
Behavior tracking cookie challenge. Monitors user interactions and generates tracking tokens for session continuity.
Integration Example
// Submit Incapsula UTMVC task to MeshPrivacy
// Service variant: utmvc (primary Incapsula/Imperva challenge type)
const response = await fetch('https://api.meshprivacy.com/v1/tasks/submit', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-API-Key': API_KEY
},
body: JSON.stringify({
service: 'utmvc', // Incapsula UTMVC challenge service
script_url: 'https://target-site.com/_Incapsula_Resource?SWHANEDL=...', // Incapsula script URL
cookies: { 'visid_incap_123456': '...' }, // Existing Incapsula cookies (JSON)
proxy_config: 'http://user:pass@ip:port', // Your proxy - CRITICAL: use same IP throughout
user_agent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...'
})
});
const { task_id } = await response.json();
// Poll for result
const result = await fetch(`https://api.meshprivacy.com/v1/tasks/result/${task_id}`, {
headers: { 'X-API-Key': API_KEY }
});
const { cookies } = await result.json();
// Both incap_ses_* and visid_incap_* must be present in requestsFAQ
Imperva binds cookies to IP addresses as a security measure against token theft. If you change IPs mid-session, cookies become invalid and you'll receive 403 errors.
Check for Imperva metadata in HTML content, X-Iinfo headers, or challenge JavaScript. Valid responses contain your expected page content.
Incapsula cookies are session-based with no fixed expiration. They remain valid as long as you maintain the same IP and don't trigger behavioral anomalies.