Is this a block page?
Paste the body your provider returned with its 200. This runs proxlane's own detector and tells you which rule fires, if any, and what the gateway would have done next.
Nothing is sent anywhere. The detector is a few hundred lines of string matching and it runs in this tab, so the page works with the network off.
- cloudflare-blocked
- Cloudflare block pages carry cf-error-details / cf-wrapper markupconfirmed against 1 real capture (publishing), 2026-08-21
- cloudflare-challenge
- Cloudflare's interstitial injects /cdn-cgi/challenge-platform/ scriptsconfirmed against 2 real captures (bot-test-page, business-data), 2026-08-21
- datadome
- DataDome serves its captcha from geo.captcha-delivery.comconfirmed against 1 real capture (bot-vendor-site), 2026-08-21
- perimeterx
- PerimeterX block pages reference _pxhd / px-captchaconfirmed against 1 real capture (property-listings), 2026-08-21
- imperva-incapsula
- Imperva block pages FRAME /_Incapsula_Resource; ordinary pages script itno real capture yet
- akamai-bot-manager
- Akamai reference-id deny pages cite errors.edgesuite.net, with the dots HTML-encodedconfirmed against 1 real capture (retail), 2026-08-21
Why the status code is not the question
A 403 is easy. Your code already handles it, your provider already counts it as a failure, and nobody needs a tool to spot one.
The expensive case is the 200. The provider fetched something, called it a success and charged you, and what came back was a challenge page. Retry logic sees a 2xx and moves on. Whatever you wrote to disk is a captcha with your selectors returning nothing.
That is the only case proxlane treats differently, and it is the only case this page covers. Everything else the adapter already decided.
What the gateway does with it
A soft block is not a success. The request moves to the next provider, that provider gets a cooldown on the domain so the next caller does not walk into the same wall, and hosted billing does not charge for it.
The response carries what happened: x-outcome names the outcome and x-detect-rule names the rule that fired, so a block in production is a line in your logs rather than a mystery in your data.
The full list of outcomes lives in the outcome reference, and a 200 with a captcha in it covers the same problem from the debugging side.
The rules are thin, and we would rather say so
Every rule above is a documented signature: a script path, a cookie name, an asset host. None of them has been checked against a block page we captured ourselves, which is why each one says so.
That corpus is the thing this project needs most and has least of. If this page gets your page wrong in either direction, that is worth an issue.