Anti-Bot Vendor Market Share in 2026: Who Guards the Sites You're Trying to Reach

One vendor sits in front of roughly a fifth of the public web. Every other name in this category — DataDome, Akamai, HUMAN, Imperva, Kasada — is fighting over a single-digit slice of anti-bot vendor market share.

Six weeks. 220 target domains. One column in a spreadsheet: who threw the block.

I started it because I was tired of guessing. Someone in a scraping channel would say "DataDome is everywhere now" and someone else would say "nah, it's all Akamai," and neither had counted anything. So I counted. Response headers, cookie names, challenge fingerprints, script hosts.

Tedious doesn't cover it. And about eighty domains in I noticed I'd been logging the challenge type in the vendor column, which meant redoing a third of the sheet on a Sunday night. My own fault entirely.

What I expected: a rough four-way split between the big commercial names.

What I got: Cloudflare, Cloudflare, Cloudflare, Cloudflare, then a long tail of everything else — and a surprising number of sites running two vendors stacked on top of each other.

That's the whole finding, really. But the shape of the distribution matters more than the headline, and the sector-level breakdown is where it stops being trivia and starts being operationally useful. If you already know what signals each vendor actually weights, this is the other half of the picture: not how they detect, but how often you'll meet them.

Nobody publishes this data.

Not one bot-management vendor discloses customer counts or deployment share in a form you can audit, and the analyst firms covering the category (Forrester's bot management research, Gartner's WAAP coverage) rank vendors by capability, not by footprint. Which bugs me. An industry that sells seeing what nobody else can see is the least measurable corner of infrastructure I've ever tried to count. So every figure below is an estimate assembled from public trackers plus my own sample.

Sources, specifically:

W3Techs — tracks reverse proxy and CDN usage across a large crawled sample. This is the anchor for Cloudflare's share because Cloudflare shows up in the proxy layer whether or not the site bought bot management.
BuiltWith and Wappalyzer — technology detection by script host, cookie name, and header signature. Good for challenge widgets and script-injected vendors. Weaker for edge-only products that leave no client-side trace until you trip them.
HTTP Archive's Web Almanac — the annual crawl-based dataset. Slow to update, but the closest thing to a neutral census the web has.
Vendor press and investor material — customer logos, acquisition disclosures (HUMAN absorbed PerimeterX in 2022, Thales owns Imperva).
My own 220-domain sample — hand-classified across e-commerce, ticketing, travel, classifieds, SaaS marketing sites, and news.

Three caveats before the table:

Detection undercounts edge-only products. A site can run Akamai Bot Manager and look clean from the outside until you send it a request it doesn't like. Client-side trackers miss this constantly — my sample caught vendors BuiltWith didn't flag, purely because I was actively poking.

CDN presence is not a bot-management purchase. The single biggest error in every "Cloudflare owns bot detection" take. More below.

220 domains is a sample, not a census. Directional, not audited. I picked domains that interested me, which is textbook selection bias — a real methodologist would take one look at my sheet and quietly close the tab. Use the shape, not the decimals.

Estimated share of the top 10,000 sites, as of mid-2026:

Vendor	Est. share of top 10k	Primary evidence	Confidence
Cloudflare (proxy layer, incl. Turnstile)	18-24%	W3Techs proxy share, cf-ray headers	Medium-high
Google reCAPTCHA (challenge only)	9-14%	Script host detection	High
Akamai Bot Manager	3-6%	_abck / bm_sz cookies, customer disclosures	Medium
hCaptcha	2-4%	Script host detection	Medium
DataDome	1-3%	datadome cookie, challenge page	Low-medium
HUMAN Security (PerimeterX)	1-2%	_px cookies, script paths	Low
Imperva (Thales)	1-2%	incap_ses / visid_incap	Low
Kasada	Under 1%	Observed blocks, press	Low

Those don't sum to 100% and they're not supposed to. Some sites run nothing. Plenty run two vendors at once. And the reCAPTCHA row isn't the same product category as the rows around it — challenge widget, not scoring engine — but leaving it out would misrepresent what you actually hit.

Insight 1: Cloudflare's footprint isn't Cloudflare's bot-management footprint

Here's the deal. Cloudflare fronts something like a fifth of the web. That number gets quoted constantly, and it's roughly right for the proxy layer.

It is badly wrong as a bot-management number.

Full Bot Management — the ML scoring, the device fingerprinting, the bot score you can write firewall rules against — is an Enterprise-tier product. The vast majority of Cloudflare sites sit on Free or Pro. What they get is Bot Fight Mode, basic rate limiting, and Turnstile if the operator bothered to add it. That's a real filter, and it will absolutely stop naive Selenium. It is not the system a large retailer on an Enterprise contract is running.

In my sample, Cloudflare-fronted domains that behaved like they had real Bot Management — challenge escalation tied to fingerprint quality, not IP reputation alone — were maybe a fifth of the Cloudflare total. Call it 4-5% of everything. That puts Cloudflare's serious deployment in roughly the same band as Akamai's, not five times above it.

Almost nobody separates these two numbers out, and every time I see the fifth-of-the-web stat recycled as a bot-detection stat I have to sit on my hands. This is the most useful line here. If you skim the rest, keep this one.

Insight 2: the specialists own the sectors you actually target

Web-wide anti-bot vendor market share is the wrong denominator for an operator. You don't hit "the web." You hit twelve sites in one vertical, over and over.

Sector concentration from my sample, plus what people report in the scraping channels:

Ticketing, sneakers, limited-drop retail — DataDome and Kasada well above their web-wide share. If you're in this space, DataDome feels like it's 40% of the market because in your slice it roughly is.
Banking, airlines, large enterprise portals — Akamai and Imperva. Both attach to an existing CDN relationship, which is exactly why they're concentrated in industries that bought CDN a decade ago.
Classifieds and marketplaces — DataDome and HUMAN, with a lot of stacking.
SaaS marketing sites and mid-market e-commerce — Cloudflare, overwhelmingly. Usually the cheap tier.
News and publishing — thin. Often nothing beyond a WAF rule and reCAPTCHA on the comment form.

So the honest answer to "which vendor should I prepare for" is: go look at your twelve targets. The aggregate table tells you what the industry looks like. It tells you almost nothing about your Tuesday.

Insight 3: stacking is now normal, and it changes the math

Roughly one in six domains in my sample ran two detection layers. Cloudflare at the edge plus DataDome in the application. Akamai plus hCaptcha on login. Imperva plus reCAPTCHA on checkout.

Newer than people think. Three years ago stacking was rare and mostly accidental — a leftover from a migration. Now it's deliberate, because the layers catch different things: the edge filters on network signals before JavaScript runs, the application layer scores behavior after.

The operational consequence is genuinely irritating. Passing one layer doesn't get you through. A profile with a clean canvas fingerprint and perfect CreepJS and Pixelscan results still eats a block if the TLS handshake doesn't match the claimed browser — the edge layer never gets far enough to look at your canvas, so all that fingerprint work sits there unread, like a cover letter.

I lost most of a week to this once. Kept tuning the client-side profile, kept getting 403s, never once considering the block fired before my JavaScript ran.

(This is also why "I tested it on BrowserLeaks and it passed" is such a weak claim. BrowserLeaks tests one layer.)

Insight 4: the challenge layer went free, and that reshaped the long tail

Turnstile going free is, I'd argue, the most consequential thing that happened to this category in three years — more than any enterprise product launch.

Before, a small site had two options: run reCAPTCHA and hand Google your visitor data, or run nothing. Most ran nothing. Now there's a free, privacy-flavored, drop-in alternative, and long-tail adoption climbed fast.

That doesn't threaten DataDome or Akamai — different buyer, different problem. But the floor moved. Sites that had zero detection in 2023 now have something, and "something" stops unsophisticated automation. The easy targets got harder while the hard targets stayed about the same.

Insight 5: TLS fingerprinting is the default first filter now

Every vendor in the table above weights TLS handshake analysis, and most run it before a single byte of your JavaScript executes. JA4+ went from a 2023 curiosity to table stakes in about eighteen months.

This is what quietly kills extension-based and wrapper-based antidetect tools. They spoof at the application layer — canvas, WebGL, fonts, navigator — because that's the only layer an extension can reach. The handshake happens underneath all of it, negotiated by whatever browser binary is actually running, and no amount of JavaScript on top can change what already went out on the wire. Our JA4+ fingerprint breakdown covers which fields get hashed and why a wrapper can't touch them.

ClickzProtect's TLS fingerprinting adoption data tracks the same shift from the defender's side — how fast IP blocklists gave way to handshake analysis. Steeper curve than most operators assume.

What to do with this

Fingerprint your targets before you build. One curl with -I, one look at the cookie jar, five minutes. Facing Akamai rather than DataDome changes where the money goes — network-layer correctness versus behavioral synthesis.

Budget for the layer, not the vendor. Cloudflare-Free-tier SaaS targets? You're overspending on behavioral tooling. DataDome ticketing? You're underspending on everything.

Assume stacking. A setup validated only on a client-side fingerprint checker will fail in production and you won't know why.

Watch IP quality more than IP type. Vendor share barely matters if your proxy subnet is already burned across every threat feed. ClickzProtect's residential proxy market stats cover how much of that supply gets recycled between providers — more than the vendors admit.

The contrarian read

Here's where people push back on me.

The consensus view is that detection is winning — vendors improve every quarter, budgets grow, the arms race tilts toward defense. I don't think the anti-bot vendor market share data supports that.

What it shows is a category that's broadening rather than deepening. More sites have some detection than ever, which is real progress against script kiddies with stock Puppeteer. But the count of sites running genuinely hard, multi-layer, behaviorally-scored detection is still small — plausibly under 5% of the top 10,000, and that figure hasn't moved much in two years. Enterprise bot management is expensive, it creates false positives that cost revenue, and most companies do the math and decide a challenge widget is enough.

So detection got wider and shallower. Roughly the opposite of what the vendor marketing suggests.

I could be wrong. My sample skews toward domains interesting enough for me to test, which over-represents the hard end, and I've been confidently wrong about this category before — I spent most of 2024 telling anyone who'd listen that IP reputation was the whole game. It wasn't. If someone has better numbers, I'd genuinely like to see them.

Prediction for 2027: consolidation. Kasada and the smaller specialists get acquired by CDN or WAAP vendors, because standalone bot management is hard to run at scale when the CDNs bundle a decent version for free.

Frequently Asked Questions

Cloudflare, by a wide margin. Public technology trackers like W3Techs and BuiltWith put Cloudflare in front of roughly a fifth of all websites as a reverse proxy, and Turnstile pushed its challenge layer further into the long tail after it went free. No other bot-management vendor is close on raw footprint. The important caveat: Cloudflare's proxy share is not the same as its Bot Management share, since full Bot Management is an Enterprise add-on and most Cloudflare sites never buy it.

What percentage of websites use dedicated bot management software?

Estimates for the top 10,000 sites cluster in the 25-35% range once you count every layer — full bot-management products, standalone challenge widgets like reCAPTCHA and hCaptcha, and WAF rules that do lightweight bot scoring. Dedicated enterprise bot management from a specialist vendor is much rarer, likely under 10% of the top 10k. Across the whole web the number drops sharply, because most small sites run nothing beyond whatever their CDN gives them by default.

Is DataDome bigger than Akamai Bot Manager?

No, not on deployment count. Akamai has a far larger installed base because bot management attaches to an existing CDN relationship with banks, airlines and large retailers. DataDome's estimated share of the top 10,000 sites sits in the low single digits, below Akamai's. DataDome punches above its share in specific sectors — ticketing, sneakers, classifieds, travel metasearch — where operators run into it constantly even though its web-wide footprint is small.

How do I tell which anti-bot vendor protects a specific site?

Check response headers and cookies before anything else. Cloudflare returns a cf-ray response header and sets a __cf_bm cookie. DataDome sets a datadome cookie and returns a distinctive challenge interstitial. Akamai sets _abck and bm_sz. HUMAN and PerimeterX leave _px cookies and px script paths. Imperva sets incap_ses or visid_incap. If headers are inconclusive, look at the challenge page itself and at which third-party script hosts the page loads.

Try JustBrowser

Native Chromium engine with C++ integration — not an extension, not a wrapper. 40+ identity parameters (canvas, WebGL, audio, fonts, screen, timezone, navigator, hardware) come from the engine rather than getting patched on top. Recorded results: CreepJS 0% stealth / 0% headless, Whoer 90-100%, IPHey Trust Good, BrowserLeaks WebRTC no leak. REST API + CDP for Playwright, Puppeteer and Selenium. $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles.

Get started → · How it differs from Multilogin / GoLogin / AdsPower