5 min read
Also: PerimeterX, PX, Press & Hold challenge, Press and hold captcha, HUMAN Bot Defender, HUMAN Challenge, _px3 cookie, HUMAN Security
HUMAN Security (PerimeterX)
Quick answer
PerimeterX, now HUMAN Security's Bot Defender, is a bot-protection service known for its Press & Hold challenge and for cookies starting with _px, such as _px3. If a scraper or automated browser keeps getting the challenge or a 403, read why anti-bot systems block scrapers and what actually helps.
PerimeterX, now HUMAN Security's Bot Defender after a 2022 merger, is a bot-protection service that scores every request and challenges suspicious visitors with its 'Press & Hold' button, the HUMAN Challenge.
Last verified
What people do with HUMAN Security (PerimeterX)
- Understand why your scraper gets blocked
How HUMAN, Cloudflare and DataDome score traffic, and the legitimate options.
- Fix 403 Forbidden on a protected site
What a 403 from a bot-protection layer means and what to check.
- Fix 429 Too Many Requests
Slow down before rate limits turn into Press & Hold challenges.
- Compare PerimeterX with DataDome
Another bot-protection vendor with its own challenge page.
- Compare PerimeterX with Cloudflare Bot Management
Bot scores, challenges and how they differ.
- Complete a Press & Hold yourself mid-run
Take over the live browser when an automation meets a challenge.
Key facts
| Owner | HUMAN Security (merged with PerimeterX in July 2022; HUMAN was formerly White Ops) |
|---|---|
| Product name today | HUMAN Bot Defender, part of the HUMAN Defense Platform |
| Challenge | HUMAN Challenge, a 'Press & Hold' button that also runs proof-of-work checks on the device |
| Telltale signs | Cookies prefixed _px (e.g. _px3, _pxhd, _pxvid); 'Please verify you are a human' block page |
| Deployment | Client-side JavaScript sensor or mobile SDK plus a server-side enforcer at the edge |
| Pricing model | Enterprise, quote-based |
What is HUMAN Security (PerimeterX)?
PerimeterX was a bot-protection company best known for its "Press & Hold" challenge: instead of a picture puzzle, the page asks you to press and hold a button until it fills up. In July 2022 PerimeterX merged with HUMAN Security (the ad-fraud and bot-detection company formerly called White Ops), and the combined company operates under the HUMAN name. The former PerimeterX product is now sold as HUMAN's Bot Defender, part of the HUMAN Defense Platform, alongside account-takeover, fraud and client-side code protection products.
People still search for "PerimeterX" far more than for "HUMAN Bot Defender", partly because many of the technical traces the product leaves (cookies, script paths, block pages) kept their original PerimeterX names after the merger. You will find it on large retail, travel, real-estate and ticketing sites, typically protecting the whole site rather than one form.
How it works
Bot Defender combines a client-side sensor with server-side enforcement:
The challenge is the HUMAN Challenge, the press-and-hold button, which HUMAN describes as the default verification for Bot Defender. HUMAN's documentation says that while the visitor holds the button, the challenge runs proof-of-work tests on the device and collects additional signals. Passing it updates the session's cookies so the visitor can continue browsing. Cookies with names beginning _px (for example _px3, _pxhd and _pxvid) are the usual sign that a site uses this product; the names were kept for compatibility after the rebrand. Block pages typically read "Please verify you are a human" or "Access to this page has been denied" and include a reference ID.
Why it appears in automation
HUMAN's customers deploy Bot Defender specifically to stop scraping, scalping, credential stuffing and fake account creation, so automated access is what it is designed to catch:
requests, curl, a no-code HTTP step, Google Sheets IMPORTXML) never runs the sensor, so it has no valid session.The honest options
A site that runs HUMAN Bot Defender has chosen to keep automated clients out. If you need its data or need to act on it at scale:
Read the site's terms and robots.txt, and see is web scraping legal? for the general picture. This page deliberately does not describe ways to evade the product.
HUMAN, PerimeterX and Autonoly
Autonoly's agent drives a real, headed Chromium browser, so pages run their JavaScript as they would for you. That does not make it undetectable, and Autonoly does not solve the HUMAN Challenge or use proxies or IP rotation. When a Press & Hold page or a HUMAN block page appears, the agent pauses and gives you the browser through live browser control. You can complete the hold yourself and hand control back. If a site blocks repeatedly, use an official data source rather than retrying.
Why It Matters
Many large retail, travel and real-estate sites use HUMAN Bot Defender. Recognizing the Press & Hold page and the _px cookies tells you a failed run is a deliberate bot block, not a selector problem, and points you to an API, permission or a human step instead of endless retries.
How Autonoly Solves It
Autonoly does not solve the HUMAN Challenge and has no proxies or IP rotation. Its agent uses a real headed Chromium browser; when a Press & Hold or block page appears, it pauses and hands you the live browser so you can complete it or stop.
Learn moreExamples
A listing-monitor script receives 403 responses with a _pxhd cookie and a 'Please verify you are a human' page on every request
An agent browsing a retail site meets a Press & Hold button; it hands control to the user, who completes the hold and returns control
A team that kept hitting HUMAN blocks signs up for the retailer's partner data feed instead of scraping
Frequently Asked Questions
Is PerimeterX the same as HUMAN Security?
Yes, in practice. PerimeterX merged with HUMAN Security in July 2022 and the combined company uses the HUMAN name. The former PerimeterX bot-protection product is now HUMAN Bot Defender.
What is the 'Press & Hold' challenge?
It is the HUMAN Challenge, the default verification for HUMAN Bot Defender. Instead of a picture puzzle, you press and hold a button. HUMAN says that during the hold it runs proof-of-work tests on the device and collects extra signals to decide whether you are human.
How can I tell if a site uses PerimeterX?
Look for cookies whose names start with _px, such as _px3, _pxhd or _pxvid, a block page reading 'Please verify you are a human' or 'Access to this page has been denied' with a reference ID, and a Press & Hold button.
Why do I keep getting Press & Hold as a normal user?
VPNs, privacy or ad-blocking extensions, unusual browsers and shared IP addresses can lower your score. Completing the hold usually clears it; disabling the VPN or extension often stops it recurring. If you stay blocked, contact the site with the reference ID.
Can I scrape a site protected by HUMAN Bot Defender?
The site has deliberately chosen to block automated clients, so evading it raises contractual and possibly legal risk. Use an official API or data feed, ask for access, or keep the task small enough that a person can handle any challenge.
Can Autonoly get past PerimeterX?
No. Autonoly does not solve the HUMAN Challenge and does not use proxies. When one appears, the agent hands you the live browser so you can complete it yourself.
Further reading
Related terms, automations and guides
Where this concept shows up in practice.
Stop reading about automation.
Start automating.
Describe what you need in plain English. Autonoly's AI agent builds and runs the automation for you — no code required.