What the web refuses to an agent that says what it is
An agent that says what it is gets turned away by a large share of commercial sites. Not a defect to fix — it is the finding.
This one is not a task. It is an observation that came out of doing the others, and it is the case where the honest answer is the least flattering.
Used respectfully — courtesy delays, page and action caps, no attempt to force past a real block — Diwall run against a range of commercial sites finds that a large share return an outright refusal. HTTP 403, or a request that never completes.
The measurement
A real campaign, 23 francophone commercial sites, ordinary purchase research — not a synthetic panel assembled to make a point. 39 % were blocked outright by a WAF. 8.7 % — two sites — returned their content, and both were server-rendered with no WAF in front of them.
The full breakdown, with the result it is missing →
Recorded 27 June 2026, Diwall v1.14.0, before –stealth
existed. Aggregate only — the individual sites were never logged, and no dated
block/no-block table naming platforms will be published here: it would go stale
faster than it informs, and it is not a scoreboard.
This is not a defect to fix
A site has every right to close its door.
Anti-bot posture is the site’s own choice, and Diwall does not try to defeat it. That is the whole content of declared identity: the agent says what it is, and accepts the answer.
Practically, for anyone planning shopping-comparison work against large platforms: expect a meaningful share of dead ends, and treat a block signal as information to route around — not an error to retry against. Retrying is both useless and rude.
One distinction worth holding
An interactive challenge — a checkbox, an image puzzle — is a question asked to a visitor, and it is legitimate to answer it honestly. An agent operating for a named person, from that person’s own address, is not the anonymous mass traffic the question was designed to stop.
An invisible verification screen that never resolves is different. It presents nothing to act on: no checkbox, no challenge, no door. From the agent’s side there is simply nothing to answer.
Getting past that one requires address rotation or fingerprint spoofing — pretending to be something else. That is outside what Diwall does, and the boundary is a choice rather than a missing feature.
Why publish this at all
Because it is the number that a page selling the tool would leave out, and because it is the one that lets you decide whether Diwall fits your case.
If your targets are your own infrastructure, a self-hosted panel, an interface you administer — none of this applies. If they are large commercial platforms, you now know the shape of what you are walking into, before writing a single scenario.