AWS WAF Bypass & Captcha Solver

AWS WAF Unblocker is an Apify Actor that bypasses AWS WAF captcha protection and generates valid tokens to access protected pages.

🎯 Why bypass AWS WAF?

Use cases:

• Web Scraping - Access data from AWS WAF protected websites that block traditional scrapers
• API Access - Reach API endpoints secured by AWS WAF challenge pages
• Automated Testing - Test your own AWS WAF protected pages without manual intervention
• Research - Collect data from protected sources for market research or competitive analysis

✨ What can AWS WAF Unblocker do?

This Actor allows you to:

• Solve AWS WAF Challenges - Automatically bypasses captcha and challenge pages without a headless browser
• Generate Valid Tokens - Returns the aws-waf-token cookie for subsequent authenticated requests
• Fetch Protected Content - Optionally retrieves the HTML of the target page using the solved token
• Process Multiple URLs - Handle batch requests with parallel processing for increased throughput

Features

• Lightweight & Fast - No headless browser required; runs directly in Node.js on as little as 128MB of memory
• Browser Fingerprinting - Simulates a browser environment (DOM, Navigator, WebGL) to pass challenge checks
• Automatic Token Handling - Extracts the aws-waf-token upon successful solution
• Concurrency Support - Parallel processing of multiple URLs for increased throughput

🚀 How to bypass AWS WAF?

1. Make a free Apify account here: https://console.apify.com/sign-up
2. Click on "Try for free"
3. Enter the URLs of pages protected by AWS WAF
4. Optionally enable "Fetch Page with Token" to retrieve the page content
5. Click "Start" and wait for the Actor to complete
6. Download your data in JSON, CSV or Excel format

💡 What data will you receive?

AWS WAF Unblocker provides solution results for each URL:

Field	Description
url	The URL that was processed
domain	The domain extracted from the URL
hasWafProtection	Whether AWS WAF protection was detected
token	The generated aws-waf-token (if challenge was solved)
generatedAt	Timestamp when the token was generated
success	Whether the token generation succeeded
error	Error message if the process failed
pageHtml	The page content (only if fetchPage is enabled)

Output example

{
    "url": "https://www.binance.com/en/price/bitcoin",
    "domain": "www.binance.com",
    "hasWafProtection": true,
    "token": "abc123...",
    "generatedAt": "2024-12-10T12:00:00.000Z",
    "success": true,
    "error": null
}

📥 Input

The Actor accepts these input parameters:

• urls (array, required): List of URLs to generate AWS WAF tokens for. Each URL should be a page protected by AWS WAF.
• fetchPage (boolean, optional, default: false): If enabled, re-fetches each URL using the generated token and includes the page HTML in the output.

Input example

{
    "urls": [
        "https://www.binance.com/en/price/bitcoin"
    ],
    "fetchPage": true
}

Using the Token

You can use the generated token in two ways:

1. Automatic Content Retrieval: Set fetchPage: true to have the actor automatically fetch the protected page after solving the challenge. The HTML content will be available in the pageHtml output field.

2. Manual Token Usage: Use the generated aws-waf-token yourself to bypass the WAF on subsequent requests. Simply include it as a cookie in your headers:

   Cookie: aws-waf-token=<YOUR_TOKEN_HERE>
   

💰 How much does it cost?

This actor is extremely cost-effective. Check the "Pricing" tab for more details.

With Apify's free tier, you get $5 of platform credits monthly for free, which you can use to test this actor for free.

Do you need more capacity? Upgrade to a paid plan which includes more platform credits and discounted pricing.

Tips:

• Provide multiple URLs in your input, that way you only pay the actor start cost once.
• If you are doing a large run, consider increasing the RAM used per run to process faster. When doing a small run decrease the RAM used to reduce the actor start costs.
• Upgrade to a higher plan to get discounted pricing. Link: https://apify.com/pricing

🔗 Integrate with your workflows

This Actor integrates seamlessly with:

• Automation platforms - Build no code workflows with Make.com, n8n, and Zapier
• Webhooks - Trigger actions when processing completes through webhooks
• Schedulers - Refresh tokens periodically with Apify's Scheduler
• API - Start runs and access data programmatically with the Apify API
• Google Sheets - Export directly to spreadsheets

👥 Who made this Actor?

Gordian is a specialised Apify web scraping agency founded by Louis Deconinck.

Louis is a top 1% Apify developer, Oxford University IT graduate, and creator of 70+ scrapers used by 1,000+ data professionals every month. He has scraped 10,000,000+ pages bypassing the most advanced anti-scraping protections.

• Apify AI Agent Hackathon Winner
• 300+ contributions in Apify Discord
• Former senior data engineer in EU banking

Looking for a custom data solution? Get in touch.

❓ FAQ

Is this legal?

This tool is designed for legitimate purposes such as accessing your own AWS WAF protected pages, automated testing, or accessing publicly available data. Always ensure your use case complies with the target website's terms of service.

For more information on web scraping legality, read this blog post: Is web scraping legal?

Can I export data to CSV or Excel?

Yes, Apify supports exporting dataset results in multiple formats: JSON, CSV, Excel (XLSX), HTML, XML and RSS.

What if the page returns 200 OK without a challenge?

If the target URL returns a 200 status code immediately (no WAF challenge triggered), the actor marks the request as successful without generating a token, as no token was necessary.

How long are the tokens valid?

AWS WAF tokens have a limited validity period set by the target website. For best results, use the token immediately after generation.

How do I get started?

Make a free Apify account to claim your free $5 usage and start bypassing AWS WAF today by clicking "Try for free".