What does Imperva set on a website?

Imperva sets visid_incap (1-year, session validation token), incap_ses (session duration, active security token), and nlbi (1-year, load balancing and bot score caching). These cookies are strictly necessary for distinguishing validated human visitors from bots on every subsequent request.

How does ConsentStack handle Imperva?

ConsentStack classifies Imperva as essential, so its cookies load without requiring visitor consent. This ensures WAF enforcement, DDoS mitigation, and bot detection remain fully operational. ConsentStack accurately reflects the strictly necessary status in your consent records.

What tracker domains does Imperva use?

ConsentStack has catalogued tracker domains for Imperva including areyouahuman.com, yjyztmj.x.incapdns.net and k2pf5eb.x.incapdns.net, among 48 in total. These are the network destinations Imperva's scripts contact, which a consent platform blocks until a visitor agrees.

What cookies does Imperva set?

Imperva sets cookies such as visid_incap_ and incap_ses_. ConsentStack identifies these and classifies them so they can be blocked or allowed based on the visitor's consent choice.

Imperva (areyouahuman.com) - Essential Service Consent Info

Q: Does Imperva require consent?

No. Imperva provides essential web application security through WAF, DDoS protection, and bot detection. Its cookies are strictly necessary for the security layer to function. The ePrivacy Directive exempts security cookies from consent, and GDPR covers the processing under legitimate interest.

Back to Vendor Library

Overview

Imperva (formerly Incapsula, acquired by Thales Group in 2023) is a cybersecurity company providing Web Application Firewall (WAF), DDoS protection, bot management, CDN, and API security services. It is used by financial institutions, e-commerce platforms, healthcare organizations, and government agencies to protect web applications from automated attacks, application-layer DDoS, SQL injection, cross-site scripting, and credential stuffing. Imperva's architecture operates as a reverse proxy — all traffic to the protected website routes through Imperva's network before reaching the origin server, allowing threat detection and mitigation at the edge.

What This Script Does

Imperva's client-side presence serves security verification purposes: detecting automated browsers, bots, and scripted attacks that reach the website.

JavaScript challenge execution:

Imperva injects a JavaScript challenge that browsers must execute to prove they are a legitimate browser environment
The challenge tests for capabilities that headless browsers (Puppeteer, Playwright, PhantomJS) and automation frameworks typically lack or simulate poorly
Challenge results are evaluated server-side; legitimate browsers receive a session validation cookie; suspicious clients are blocked or presented with a CAPTCHA

Device fingerprinting data collected:

User agent string and parsed browser/OS/version details
Screen resolution, color depth, and pixel ratio
Installed browser plugins and fonts (via canvas fingerprinting)
WebGL renderer and vendor strings
Timezone offset and language settings
JavaScript engine performance timing (used to detect virtual environments)
Network connection type if available via the Network Information API

Behavioral signals analyzed:

Mouse movement patterns and velocity (distinguish human from scripted input)
Keystroke timing patterns
Touch event characteristics on mobile devices
Scroll behavior

Cookies set:

visid_incap_<site-id> — first-party persistent cookie, 1-year expiry, stores Imperva's visitor session validation token that grants access to the protected site; required to pass the security check
incap_ses_<port>_<site-id> — session-scoped cookie, stores the active security session token for the current browser session
nlbi_<site-id> — first-party persistent cookie, load balancing and bot score caching, 1-year expiry
These cookies are strictly necessary for the security service to function; without them, the protection layer cannot distinguish validated humans from bots on subsequent requests

Consent & Compliance

Imperva's cookies and data collection fall under the essential consent category. Under ePrivacy Directive Article 5(3), the exemption for cookies "strictly necessary" for a service explicitly requested by the user extends to security services that protect the integrity of the requested website. The EDPB and national DPAs have confirmed that security cookies used for bot detection, DDoS protection, and fraud prevention qualify as strictly necessary and are exempt from consent requirements.

Under GDPR, Imperva's processing of device fingerprinting and behavioral signals for security purposes is covered by legitimate interest under Article 6(1)(f) — the legitimate interest being the protection of the website and its users from cyberattacks and fraud. This is a well-established legitimate interest that consistently passes the balancing test.

Under CCPA, data collected for security purposes is not sold or used for advertising and does not trigger opt-out rights. Imperva is headquartered in San Mateo, California; EU data is processed through Imperva's EU infrastructure and covered by SCCs.

Should You Block This Without Consent?

No. Imperva provides essential security services. Its cookies (visid_incap_*, incap_ses_*, nlbi_*) are strictly necessary for the security layer to function — blocking them would disable bot protection, WAF enforcement, and DDoS mitigation, leaving the website unprotected. These cookies and data collection activities are exempt from consent requirements under ePrivacy and covered by legitimate interest under GDPR.

Is Imperva GDPR compliant?

Imperva typically loads marketing trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Imperva can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Imperva, not on Imperva itself.

Visit website

Consent Categories

Essential

Also Known As

ImpervaIncapsulaWAF bot protectionDDoS protectionImperva CDN

Industries

Computer SecurityComputers Electronics and Technology

Tracked Domains (48)

Imperva's trackers are rarely seen, seen on a small share of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

areyouahuman.comMarketing

areyouahuman.com is a marketing domain operated by Imperva, used to serve ads, build audiences, and measure ad conversions. Seen on a small share of scanned sites.

yjyztmj.x.incapdns.netEssential

yjyztmj.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

k2pf5eb.x.incapdns.netEssential

k2pf5eb.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

a7fug.x.incapdns.netEssential

a7fug.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

a3rx86v.x.incapdns.netEssential

a3rx86v.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

73iibbb.x.incapdns.netEssential

73iibbb.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

afmroz9.x.incapdns.netEssential

afmroz9.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

rq7cuf9.x.incapdns.netEssential

rq7cuf9.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

6xqnd8u.x.incapdns.netEssential

6xqnd8u.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

z9n3yzg.x.incapdns.netEssential

z9n3yzg.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ks4pdkw.x.incapdns.netEssential

ks4pdkw.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

p4hb75p.x.incapdns.netEssential

p4hb75p.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ug55z8o.x.incapdns.netEssential

ug55z8o.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ezvhzv6.x.incapdns.netEssential

ezvhzv6.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

7eb5opl.x.incapdns.netEssential

7eb5opl.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

evj3x.x.incapdns.netEssential

evj3x.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

fwbzswe.x.incapdns.netEssential

fwbzswe.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

gpxjedw.x.incapdns.netEssential

gpxjedw.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

gx85csa.x.incapdns.netEssential

gx85csa.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

l5dykax.x.incapdns.netEssential

l5dykax.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ze2e5pr.x.incapdns.netEssential

ze2e5pr.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

2ty7q3s.x.incapdns.netEssential

2ty7q3s.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

36wi5hm.x.incapdns.netEssential

36wi5hm.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

3exvfbh.x.incapdns.netEssential

3exvfbh.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

4jjom9f.x.incapdns.netEssential

4jjom9f.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

5iqik.x.incapdns.netEssential

5iqik.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

5kbz76q.x.incapdns.netEssential

5kbz76q.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

5t48cjc.x.incapdns.netEssential

5t48cjc.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

7v2agdo.x.incapdns.netEssential

7v2agdo.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

7xjpy4d.x.incapdns.netEssential

7xjpy4d.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

838ovnu.x.incapdns.netEssential

838ovnu.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

982gl.x.incapdns.netEssential

982gl.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

avgu9hk.x.incapdns.netEssential

avgu9hk.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

bp5os9q.x.incapdns.netEssential

bp5os9q.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

c4sxz.x.incapdns.netEssential

c4sxz.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

unjv837.x.incapdns.netEssential

unjv837.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

vc24x.x.incapdns.netEssential

vc24x.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

vhob6qi.x.incapdns.netEssential

vhob6qi.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

wex83ti.x.incapdns.netEssential

wex83ti.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

ybi7tpc.x.incapdns.netEssential

ybi7tpc.x.incapdns.net is an essential domain operated by Imperva, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

+ 8 more tracked domains, shown by how common they are across scanned sites.