The defences in the game, and how to beat them for real
Each level adds one of the defences real sites use against scrapers. Here is what each one does outside the game, and where to learn the fix.
Rate limits
Most sites cap how many requests a single IP can make in a given time, and answer with a 429 or a block once you go over. The limit applies per IP, not per scraper, so the fix is to slow down or spread your requests across more IPs. Our guide to rotating proxies shows how to run a pool in Python and Node.js and how to retire IPs that get flagged.
Header checks
HTTP libraries announce themselves. Python's requests sends a python-requests User-Agent, and a site can reject that on the first request. Sending the full set of headers a real browser sends gets you past the check, as long as your TLS fingerprint doesn't give you away instead. How to avoid getting blocked covers headers, TLS fingerprints and the other basics.
Network blocks
Sites can look up which network an IP belongs to and refuse whole hosting providers at once. Datacenter IPs are cheap and fast, but they are the first to go. Residential and mobile IPs belong to consumer ISPs and carriers, so they pass this check. Residential vs datacenter proxies explains when the cheaper option is enough.
JavaScript rendering
Some pages send an empty template and fill in the data with JavaScript. A plain HTTP request gets a 200 and no data. You need a headless browser, or the API the page calls behind the scenes. The Playwright in Python guide shows how to wait for the data before you read it.
Sessions
Checkouts, logins and other multi-page flows expect the same visitor throughout. If your IP or cookies change halfway, the site resets the flow. Sticky sessions keep one IP for the whole flow, and a cookie jar keeps the session alive. See sticky sessions in the rotating proxies guide.
Each fix has a cost, and the cheapest working setup changes from site to site. Our scraping cost calculator compares the bill for your own workload.
FAQ
Is this how real anti-bot systems work?
In outline. Real systems check the same things the game does, such as request rate, headers, the network an IP belongs to, JavaScript and session consistency, but they also weigh TLS and browser fingerprints, behaviour and IP history. The game keeps the rules simple so you can see cause and effect.
Where do the costs in the game come from?
From the same price file as our scraping cost calculator, which takes its figures from our provider reviews. The game turns a price per GB into a cost per 1,000 requests by assuming a 300 KB average page.
Why does mobile only get one star?
None of our reviews states a mobile proxy price yet, so the game can't score what a mobile run costs. Mobile still gets through the hardest level; once a reviewed price is added, it is scored like the other IP types.