UTMVC

UTMVC is an Incapsula / Imperva protection that runs a script and sets a ___utmvc cookie (three underscores) before granting access to the site.

A site is using UTMVC when its HTML loads an /_Incapsula_Resource?SWJIYLWA=... script. The flow is: fetch that script, generate a cookie from it via our API, set the ___utmvc cookie, then hit a submit path to activate it.

The cookie name is ___utmvc, three underscores.

Implementation Steps

Step 1: Parse the script path

Extract the UTMVC script path from the page HTML. You can use the regex below, or the SDK helper (ParseUtmvcScriptPath in Go, parse_utmvc_script_path in Python, parseUtmvcScriptPath in JS/TS):

src="(/_Incapsula_Resource\?[^"]*)"

Step 2: Fetch the script content

Make a GET request to the script path from Step 1 and store the full response body. Our API needs the script contents to generate a valid cookie.

Step 3: Generate & set the cookie

Generate the cookie via our API (GenerateUtmvcCookie / generate_utmvc_cookie / generateUtmvcCookie), then set the returned value as the ___utmvc cookie in your jar. The input requires:

• UserAgent: the same Chrome User-Agent you use for every request.

• SessionIds: the value of each cookie whose name starts with incap_ses_.

• Script: the script body from Step 2.

The request body is large, compress it (gzip, br, or deflate) and set the content-encoding header. The SDKs auto-compress bodies over 1000 bytes.

Step 4: Submit to activate the cookie

Make a GET request to the submit path to activate the cookie:

/_Incapsula_Resource?SWKMTFSR=1&e=<random>

e is a random 64-bit float (for example 0.14896897949050825). The SDK helpers build this path for you: GetUtmvcSubmitPath() / get_utmvc_submit_path() / generateUtmvcScriptPath(). If the ___utmvc cookie is valid, the server responds by setting the cookie to the value "a" with a max-age of 0.

Step 5: Make your real requests

With the ___utmvc cookie in place, retry the request that was blocked.

Notes

• The ___utmvc cookie name has three underscores, a common source of bugs.

• Use consistent headers, User-Agent, and TLS fingerprint across all requests.

• See the API Reference if you want to call /utmvc directly instead of using an SDK.