Protected Website Scraper (Cloudflare, DataDome, Akamai, PerimeterX, Kasada)

Give it a list of URLs and get back the page HTML or clean structured data, including from sites behind Cloudflare, DataDome, Akamai, PerimeterX and Kasada. Each URL becomes one row in the dataset, with the site's HTTP status, the engine that fetched it, and the credits it cost.

The Actor runs your requests through the StealthASF scraping API. You do not need an Apify proxy, browser settings or captcha setup. Blocked requests are not charged.

Tested on real protected sites

On 2026-10-08 our production tests returned real pages for:

Protection	Sites
PerimeterX	Zillow, Walmart, StockX
Akamai	Nike, Lowe's, Home Depot
DataDome	Tripadvisor, Allegro
Cloudflare	Glassdoor, WhoScored
Kasada	Hyatt, realestate.com.au

What you need

A StealthASF API key. Sign up at stealthasf.com: you get 200 free credits, no card needed. Copy your key from the dashboard and paste it into the StealthASF API key field. The key is stored encrypted by Apify.

How to use it

1. Paste your API key.
2. Add the URLs you want, one per line, or upload a text file with one URL per line.
3. Leave Engine on Auto unless you know the site needs a specific mode.
4. Pick an Extract option if you want structured data instead of raw HTML.
5. Start the run and download the results as JSON, CSV, Excel or HTML from the Output tab.

Engines

Engine	What it does	Base credits
auto (default)	Starts with a plain request and steps up to protected mode only when the site blocks it. Remembers sites that needed protected mode. You pay only for the engine that succeeded.	depends on the result
http	Plain HTTP request	1
browser	Renders JavaScript	5
stealth	Protected request for anti-bot sites	25
ultra	Our strongest mode, for the hardest protected sites	50

Use browser when a page loads its content with JavaScript and auto returns an empty page shell.

Extract options

Value	Returns in data
none	Nothing extra; use includeHtml to get the page
links	Every link with its text
text	Clean readable page text
meta	Title, description and Open Graph tags
images	Image URLs with alt text
headings	H1 to H3 outline
table	The first data table on the page

Input example

{
    "apiKey": "YOUR_STEALTHASF_API_KEY",
    "urls": [
        { "url": "https://www.example.com/" },
        { "url": "https://www.example.com/products" }
    ],
    "engine": "auto",
    "extract": "meta",
    "includeHtml": false,
    "maxConcurrency": 3
}

Field	Type	Default	Notes
apiKey	string	required	Your StealthASF API key
urls	array	required	URLs, or a link to a text file with one URL per line
engine	string	auto	auto, http, browser, stealth, ultra
extract	string	none	none, links, text, meta, images, headings, table
country	string	empty	Two-letter country code such as US or de. Pro and Scale plans
includeHtml	boolean	false	Store the full HTML in each row
maxConcurrency	integer	3	1 to 20 URLs at a time

Output example

One dataset item per URL:

{
    "url": "https://www.example.com/",
    "ok": true,
    "status": 200,
    "engine": "http",
    "creditsCharged": 1,
    "jobId": "cm2x8k1q40001",
    "data": {
        "kind": "table",
        "columns": ["field", "value"],
        "rows": [["title", "Example Domain"]]
    },
    "error": null
}

Field	Meaning
url	The URL you asked for
ok	true when the page was fetched
status	The site's own HTTP status (for example 200 or 404)
engine	The engine that produced the result
creditsCharged	Credits this URL cost; 0 when it was blocked or rejected
jobId	The job ID, also visible in your StealthASF dashboard
data	Structured result when extract is set
html	Full page HTML, only when includeHtml is on
error	What went wrong, when ok is false

A page the site blocked looks like this and costs nothing:

{
    "url": "https://www.example.com/",
    "ok": false,
    "status": null,
    "engine": null,
    "creditsCharged": 0,
    "jobId": "cm2x8k1q40002",
    "data": null,
    "error": "HTTP 422: blocked by the target's anti-bot protection (not charged)"
}

At the end of the run the log and the run status show a summary: pages fetched, pages blocked, credits used and the balance left on your account.

Credits and pricing

Credits come from your StealthASF account. Apify bills only its normal platform usage for the run, which stays low because the Actor only sends API requests and waits for the answers.

What	Credits
HTTP request	1 (+1 per 2 MB of response)
Browser request	5
Stealth request	25
Ultra request	50
Transfer beyond the first MB (browser, stealth, ultra)	+10 per MB
Blocked request	0

Every row shows the exact creditsCharged, so you always see what each page cost.

Plans start at $17/month, and one-time credit packs start at $12. See stealthasf.com for all plans.

Good to know

• Out of credits: the run stops with a clear message and keeps every row already saved. Top up and run again.
• Invalid API key: the run stops at the first rejected request instead of repeating the same error for every URL.
• Concurrency: each StealthASF plan has its own limit of parallel requests. If maxConcurrency is higher, the Actor lowers it to your plan's limit automatically and retries. Requests over the limit are never charged.
• Rate limits: when the API asks the Actor to slow down, it waits and retries up to 3 times.
• Large pages: a page bigger than the Apify dataset item limit keeps its row and data, but html is left out. Use an extract option for those pages.

Use it from code

The Actor works with the Apify API, scheduler, webhooks and integrations like any other Actor. If you would rather call the scraping API directly from your own code, the same features are available at stealthasf.com.