Skip to content

Walmart

Retail

Serves a CAPTCHA page on a 200 OK, so status-code-only detection records a successful fetch of a page containing no product data.

Walmart is the cleanest example of why status codes cannot be trusted alone. A plain request returns HTTP 200, with all the headers of a healthy response, and a body that is a CAPTCHA page. Every layer of a typical pipeline reports success, and the data that lands in the database is a challenge page.

This failure mode is worse than a block. A 403 stops your pipeline and tells you to fix something. A 200 with no content quietly fills your storage with junk, and you find out weeks later when someone asks why the price history has gaps.

Walmart runs a layered stack at the edge, and the composition has changed over time, so attribution matters less than the behaviour: validate the body.

What is in front of it

  • Akamai Bot Manager: Denies with a 403 Access Denied page carrying a reference number, and is unusual in offering operators a deliberately ambiguous 200 response and a tarpit that never answers at all.
  • HUMAN Security: The former PerimeterX. Blocks with a 403 that often carries an explicit x-px-blocked header, and answers blocked AJAX calls with JSON instead of an HTML challenge page.
  • Reported to run Akamai Bot Manager at the edge, with additional bot management layers on sensitive paths.
  • The 200-with-CAPTCHA behaviour is consistent with Akamai's alternate-content response actions, which return a substitute page on a success status.

Status codes

200 CAPTCHA page on a success status

Deceptive. Observed behaviour.

The status line reports success and the body is a bot challenge rather than the requested page.

What triggers it

  • A client identity that does not match a real browser.
  • Data centre address ranges.
  • Access to product and search paths without having loaded the site's client-side scripts.

How to confirm it

  • A body containing CAPTCHA markup where product markup should be.
  • A response noticeably smaller than a genuine product page.
  • Absence of the structured product data the real page always carries.

What to do about it

  • Assert on content, not on status. Pick a required element of the real page and fail the request when it is missing.
  • Add a size floor. A product page that comes back as a few kilobytes is not a product page.
  • Walmart operates partner and affiliate APIs for catalogue data, which return structured data and do not silently degrade.

Notes

  • Any monitoring built on HTTP status will report this site as fully healthy while collecting nothing.
  • This pattern appears across several large retailers, so the defensive habit generalises.

See also