> For the complete documentation index, see [llms.txt](https://docs.takionapi.tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.takionapi.tech/datadome.md).
# Datadome
{% hint style="info" %}
Check our example bundles in order to validate your implementation against our validate ones, with correct headers order, TLS and flow from our [**Github repo**](https://takionapi.tech/examples)
{% endhint %}
## **What is Datadome?**
DataDome is an application-layer (layer 7) bot-management system that protects sites against scraping, credential stuffing, and DDoS. It scores every request on signals like TLS fingerprint and HTTP header order, and when something looks automated it issues a challenge. Because its detection is so sensitive, a working bypass has to replicate a real browser's request shape precisely. The TLS signature and the exact order of headers both matter.
A rotating proxy pool is recommended: IP bans are common, and rotating IPs keeps disruption low.
## How Datadome Works
On first visit, or after a number of requests, a protected site challenges you and, once solved, issues a **`datadome`** cookie that grants access for a set period. If a site sets a **`datadome`** cookie, it is running DataDome.
There are two main challenge types:
### Datadome challenges
#### **GeeTest (Sliding Captcha)**
This requires solving a sliding puzzle before access is granted
Based on the website configuration the puzzle resolution could be omitted, asking only for a swipe, the flow is the same.
#### **Interstitial Device Check**
This newer challenge verifies a user’s device, sometimes displaying a blank page or a "Verify your device" message.
***
## **Detecting Datadome Websites**
When you hit a DataDome-protected page you often get a `403` with an unusual HTML body. The key part is the `dd` object, which is used to build the challenge URL:
```html
footlocker.com
Please enable JS and disable any ad blocker
```
The `rt` field tells you which challenge you are facing before you even start:
* `i`: interstitial
* `c`: captcha slider
{% hint style="warning" %}
Some sites ship a custom implementation and may return JSON or a different HTML shape. Detect on the `datadome` cookie and the `dd` object rather than on an exact page layout.
{% endhint %}
***
## Some websites using Datadome
Most of the tickets websites are using Incapsula to protect their website. Here are some examples of websites using Incapsula and the cookies/challenge they require:
| Website |
| -------------------------------------------------------------------- |
| [footlocker.com](https://www.footlocker.pt/) (and all other domains) |
| [uefa](https://euro2024-sales.tickets.uefa.com/) |
| [hermes.com](https://www.hermes.com/) |
| [ticketing.liverpoolfc.com](https://ticketing.liverpoolfc.com/) |
| [ticketing.manutd.com](https://ticketing.manutd.com/) |
| [tickets.mancity.com](https://tickets.mancity.com/) |
| [seatgeek.com](https://www.seatgeek.com/) |
| ... |
## Our API
Takion automates the whole challenge flow and returns the `datadome` cookie, so you can access protected sites without solving anything yourself. Continue to the reference