Residential Web Unlocker for sites that block scrapers
Web Unlocker · residential exits · forward proxy and REST
A residential web unlocker sends your request from a residential IP under a real browser TLS fingerprint, retries on a fresh exit when the site refuses it, and opens the page in a real browser when a JavaScript challenge appears. Use it when plain residential proxies still return 403, a security check or "Just a moment".
- 88.9% of calls returned the real page
- 4.1 s median time to the page (p50)
- 27 anti-bot protected targets, 3 runs each
Measured on 2026-11-11 by our own canary: 72 of 81 calls. Captcha demo pages are run but left out of the count, because interactive captchas are not solved.
What the residential tier adds over a plain residential proxy
A residential proxy changes only the IP address. Modern anti-bot systems also read the TLS handshake of your client and run JavaScript before they serve the page, so a Python or Node.js client on a clean residential IP can still be refused. The residential unlocker keeps the residential IP and fixes the other two layers.
Each request goes out under a real browser TLS fingerprint. If the site refuses it, the unlocker retries on a fresh residential exit with another fingerprint family, up to three TLS attempts. When the answer is a JavaScript challenge, the same request is replayed in a real browser, and the page it gets is checked again before it reaches you.
- Residential exits with country, state and city targeting
- Browser TLS fingerprints rotated on every retry
- Real browser escalation for JavaScript challenges (GET requests)
- POST and other non-GET methods are sent exactly once, never retried
Tested: where a plain proxy is enough and where the unlocker is not optional
On 29 September 2026 we fetched the same pages three ways from a US exit: a plain request from a cloud server, a plain request through a residential proxy, and a request through the residential unlocker. The table below lists what each client received. Glassdoor and Indeed refused both plain clients with a security check, and the unlocker returned the real page: Indeed on the first TLS attempt, Glassdoor after switching to the browser.
The same test shows where the unlocker is not needed: Zillow and Leboncoin refused the cloud server but served a plain residential proxy, and static sites such as books.toscrape.com served everything. Route the pages that refuse your client through the unlocker; the block class in every answer tells you which ones they are.
Blocked pages are reported, never returned as a silent 200
When a page is still a challenge after every attempt, the forward proxy relays the origin's status with the header x-qp-unlocker-blocked, and names the reason in x-qp-block-class: js_challenge, captcha, access_denied, rate_limited, fingerprint, geo or timeout. The REST endpoint returns the same verdict in JSON next to the page, or a 424 target_blocked when you set fail_on_block.
That matters more than it sounds. A scraper that stores a challenge page as data poisons the dataset for days before anyone notices. Here a refusal is an error your code can count, retry later or route to another tier.
Sticky sessions and clearance reuse
Pin a session with the x-qp-session header to keep one residential exit for 3 to 1440 minutes. When the browser has to clear a challenge, the clearance cookies it earned are kept for that session and reused on the next request to the same site, so the browser does not start again on every page.
Use a new session value per job or per logical user. Reusing one session across unrelated targets gains nothing and concentrates your traffic on one IP.
Three ways to connect: REST, forward proxy or direct mode
The REST endpoint POST /api/v1/scraper/unlock takes the request as JSON (url, method, headers, body, country, session_id) with your API key and returns status, headers, body, the attempt log and the unlocker verdict. It is the simpler option when you can change your code, for serverless functions and for AI agents.
The forward proxy at unlock.quantumproxies.io:9000 works with any client that accepts an HTTP proxy: curl, Python requests, Node.js, Scrapy or Playwright. HTTPS is re-encrypted by the unlocker, so install the unlocker CA once, downloaded from the API with your key. Targeting goes in the username, for example -country-us. Direct mode, where the request goes to http://unlock/ and the target in the x-qp-url header, needs no certificate at all.
What it does not do
It does not log in for you or bypass paywalls; pass your own cookies or headers when you are entitled to the content.
For the strictest sites, the Mobile Web Unlocker sends the same request from 4G/5G carrier IPs.
Success rate by anti-bot system
Generated from the canary run of 2026-11-11, 3 runs on the same targets. Interactive captcha pages are excluded.
| Anti-bot system | Success | Median time | Calls |
|---|---|---|---|
| Cloudflare | 100% | 8.9 s | 9 |
| DataDome | 91.7% | 10.4 s | 12 |
| Akamai | 75% | 2.4 s | 12 |
| PerimeterX / HUMAN | 100% | 1.8 s | 9 |
| Kasada | 100% | 16.1 s | 6 |
| F5 BIG-IP | 100% | 3.4 s | 6 |
| Imperva | 83.3% | 7.4 s | 6 |
| AWS WAF | 66.7% | 14.3 s | 6 |
| Amazon | 66.7% | 4.1 s | 3 |
| 66.7% | 7.5 s | 3 | |
| Other sites | 100% | 2.0 s | 6 |
| 100% | 1.7 s | 3 |
Measured on 29 September 2026 (US exit)
| Page | Cloud server, plain request | Residential proxy, plain request | Residential Web Unlocker |
|---|---|---|---|
| Glassdoor company reviews | 403, captcha page | 403, "Enable JavaScript and cookies" | 200, real page (browser, 17.2 s) |
| Indeed job search | 403, captcha page | 403, security check | 200, real page (2.6 s) |
| Walmart search | 307 redirect | 307 redirect | 200, real page (4.8 s) |
| Best Buy laptops | no response | no response | 200, real page (6.3 s) |
| Zillow city listings | 403, PerimeterX | 200, real page | 200, real page (2.7 s) |
| Leboncoin search | 403, captcha page | 200, real page | 200, real page (1.4 s) |
| books.toscrape.com | 200 | 200 | 200 |
Frequently Asked Questions
Should I buy residential proxies or use a web unlocker?
Use the residential unlocker for the sites that answer with 403, a security check or a JavaScript challenge; in our 29 September test that was Glassdoor, Indeed, Walmart and Best Buy. Plain residential proxies are the right buy when your client already passes and you only need another IP, as Zillow and Leboncoin showed in the same test.
Why does my scraper work locally but get blocked in the cloud?
Cloud servers use datacenter IP ranges that anti-bot systems score as automated, while your home connection is a residential IP. In our test Zillow and Leboncoin refused a cloud server and served the same request through a residential proxy. If a residential IP is still refused, the TLS fingerprint or a JavaScript challenge is the next layer.
Can I keep the same IP across several requests?
Yes. Send the same x-qp-session value on each request and the unlocker keeps one residential exit for that session, from 3 to 1440 minutes. Browser clearance cookies earned in that session are reused on the next request to the same site.
Can I send POST requests?
Yes, with your own headers and body, through the forward proxy or the REST endpoint. A POST is sent exactly once: the unlocker never retries non-GET methods, because a response means the target already received the request.
Is there a free trial?
Creating the account is free, and the Web Unlocker page of the dashboard has a Test a URL box that shows status, attempts, time and cost of a call; what the first test calls cost is written next to it. Unlocker GB are prepaid per tier from 1 GB, with the live price per GB shown before you buy. The free residential trial, once per person after an SMS verification, covers plain residential proxies, not the unlocker.
When should I use the mobile tier instead?
When a site keeps answering access_denied on the residential tier. The Mobile Web Unlocker sends the same request from 4G/5G carrier IPs shared by many real phones.
Sources
- RFC 9110: HTTP Semantics (status codes)
- RFC 8446: TLS 1.3 (the handshake a fingerprint is read from)
- MDN: 403 Forbidden
- Cloudflare: challenges documentation
Related
- Web Unlocker: how it works
- Mobile Web Unlocker on 4G/5G carrier IPs
- Web Unlocker status and measured success rate
- Scrape Cloudflare protected sites with the Web Unlocker
- DataDome web scraping with the Web Unlocker
- PerimeterX web scraping and the Press & Hold page
- Residential proxies without the unlocker
- Extract API: pages as Markdown or JSON
- Free residential proxy trial
- Web Unlocker API tutorial in Python and Node.js
- Cloudflare "Just a moment" in Python
- Web unlocker vs residential proxy, tested
- All Web Unlocker
If you're an AI agent
Skip the marketing. QuantumProxies.io publishes a machine-readable site map, Markdown for every page, a free MCP server, and APIs billed from the same balance as your proxies.
- Site index for LLMs — /llms.txt — products, APIs and country pages. Full text: /llms-full.txt
- This page as Markdown — Append .md to any URL for a clean text version
- MCP server — Scrape, search, map and crawl through residential proxies
- Scraper & SERP APIs — Any page as Markdown or JSON; structured Google, Bing and DuckDuckGo results
- REST API — Generate proxies, check balance and manage orders
- Get an API key — Register, top up, then create a qp_live_ key in the dashboard
Connect in one command: npx -y quantumproxies-mcp