Incapsula Incident ID Error

What Imperva is doing when this page appears

Imperva runs as a reverse proxy ahead of the site, so every request meets its checks before the website does. Imperva’s own overview of bot management describes three ways such systems judge a visitor: static analysis of headers and requests known to correlate with bad bots, challenges that test whether the client accepts cookies and runs JavaScript, and behavior analysis that compares activity with known patterns. Imperva says its product uses all three.

The challenges usually run silently. Imperva’s CAPTCHA explainer says it uses a visible CAPTCHA only as a last line of defense, when the other identification methods fail. The “Request unsuccessful” page sits past that point: the request was refused rather than challenged.

Ownership explains the branding you may meet in documentation. Thales completed its acquisition of Imperva on December 4, 2023, and Imperva’s documentation and community pages now redirect to Thales domains. The Incapsula wording on the block page remains.

What usually triggers it

Imperva does not publish a visitor-facing list of block reasons, and each site sets its own policy. The groups below follow from the checks Imperva describes:

What the incident ID number means

The incident ID usually has two parts joined by a hyphen. A post on Imperva’s community site about incident ID 0 explains that a first part of 0 marks a session-less incident: the request was halted on Imperva’s side before a session existed, and such incidents cannot be traced by ID in the console. They show up only in the site’s log export, if the site has one configured. The same post shows block pages carrying an extra detail code that describes the failure.

Two practical consequences follow. Copy the whole string exactly, both parts. And if your ID starts with 0, tell the owner so, because their usual search will come up empty and they will need their exported logs and the time of the request.

What to send the site owner

Contact the website, not Imperva. Use its contact form, support email or social account. If the block covers the whole site, contact it from another device or connection.

URL: https://example.com/checkout
Time: 2026-10-30 14:05 UTC
Message: Request unsuccessful. Incapsula incident ID
Incident ID: copy the full string from the page
Public IP at the time: send privately if asked
Browser and version:
What I was doing: submitting the delivery address form

This is an illustrative format, not a real incident. Note your public IP on What is my IP before switching networks; afterwards you may not be able to tell the owner which address was refused.

Fixes on your side

1. Wait a minute and reload once. Repeated reloads add to the pattern that caused the block.
2. Open a clean browser profile with no extensions. If the page loads, an extension or a setting in your usual profile is the cause.
3. Allow cookies and JavaScript for the site. Imperva’s silent checks need both.
4. Update the browser. Old or unusual builds fail static checks more often.
5. Pause any VPN or proxy and compare. If the site works without it, the exit address or its range is what the policy refused.
6. On a work or school network, ask the network team. Shared office addresses can be refused because of someone else’s traffic.
7. Stop and report if the block continues. The owner can add an exception that no change on your side can.

For scrapers and proxy users

An Imperva block is the site telling you its policy. Check the terms and use an API or data feed where one exists. If collection is permitted, keep the cookies Imperva sets for the whole session so a passed check is reused, keep concurrency low, and treat this page as a stop signal rather than a response to retry.

Address sharing is a real cause of false positives. The IETF’s RFC 6269 explains that when many users share one IPv4 address, blocking that address for abuse also blocks everyone else behind it. Carrier networks share addresses this way. On Coronium mobile proxies each line is one physical device with its own SIM, rented to one customer, so other customers’ traffic does not land on your address while you hold it. A carrier address can still carry history from before, so test a line before relying on it, and if you rotate, do it between sessions rather than inside one.

For a wider diagnosis, read IP ban checks and practical diagnosis and the guide to IP reputation, fraud scores and blocklists.

Frequently asked questions