---
id: wafer-py
version: "0.4.9"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# wafer-py — Anti-detection HTTP client for Python

License: permissive · Maintenance: active · Downloads: 213.8K/mo

## What it is and what it does

wafer-py is an HTTP client built on wreq (a Rust + BoringSSL library) designed to evade bot detection and WAF challenges. It handles TLS fingerprinting to mimic browser identities, detects and solves common WAF challenges, manages cookies with RFC 6265 scoping, retries failed requests with backoff, enforces rate limiting per hostname, and supports proxies and DNS pinning. It offers both synchronous and asynchronous session APIs, plus one-shot module-level convenience functions.

The package is explicitly experimental and not recommended for production. It targets developers building web scrapers, API clients, or tools that need to work around anti-bot protections. Responses expose a requests/httpx-compatible interface with metadata on retries, rotations, challenge types, and whether the body is a client-rendered shell. Configuration covers timeouts, retry limits, fingerprint pools, embed mode for iframe/XHR impersonation, and optional browser-based challenge solving.

Use it for:

- Scrape websites protected by Cloudflare, AWS WAF, or other bot-detection layers without triggering blocks.
- Build a resilient API client that automatically rotates TLS fingerprints and solves WAF challenges on 403 responses.
- Test web applications' anti-bot defenses by simulating diverse browser fingerprints and handling challenge flows.
- Fetch data from sites that require cookie persistence and rate-limit compliance across multiple requests.
- Embed HTTP requests in iframe or XHR contexts to impersonate browser-initiated traffic.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

An anti-detection HTTP client that handles TLS fingerprinting, WAF challenge detection and solving, cookie caching, retries, rate limiting, and proxy support to bypass bot detection on protected websites.

Yes, with conditions. Install if you need to bypass WAF detection and accept the experimental status—the package is actively maintained, has no known vulnerabilities, and low install friction. Do not install for production systems without thorough testing; the authors explicitly warn against production use and expect breaking changes. Suitable for development, testing, and research on protected endpoints.

## Install

pip install wafer-py
uv add wafer-py
poetry add wafer-py

## Installing wafer-py

Before you install: Low install friction—a pure Python wheel with a single runtime dependency (wreq). Actively maintained with a recent release (4 days old) and no known vulnerabilities, though the project explicitly states it is experimental and not intended for production use.

License in practice: Apache-2.0 (permissive): you can use, modify, and distribute this package freely in commercial and private projects, provided you include a copy of the license and note any changes you make.

Quickstart:

pip install wafer-py

import wafer

resp = wafer.get("https://example.com")
print(resp.status_code, resp.text)

with wafer.SyncSession() as session:
    resp = session.get("https://example.com")
    print(resp.json())

Requires Python 3.12 or later; wreq (the underlying Rust + BoringSSL HTTP library) is a compiled dependency bundled in the wheel.

Verify before relying:

- Stability and breaking-change frequency: the project is marked as experimental proof-of-concept; real-world production reliability is unclear.
- Performance characteristics under high concurrency or large response sizes compared to standard HTTP clients.
- Whether the WAF challenge solvers (ACW, Amazon, TMD, Reddit) remain effective as WAF vendors update their detection.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 213.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

anti-detection http client, bypass waf detection, tls fingerprint rotation, web scraping with bot detection, http client with challenge solving, proxy and fingerprint management, cookie caching http session, web-scraping, anti-detection, waf-bypass

[View on SkillFed](https://skillfed.io/packages/wafer-py) · [View on PyPI](https://pypi.org/project/wafer-py/)