@@ -45,6 +45,7 @@ import {
   EDGE_OPTIMIZE_PROXY_BASE_URL_DEFAULT,
   PRIVATE_HOST_RE,
   WAF_PROBE_TIMEOUT_MS,
+  ADOBE_PROBE_USER_AGENT,
   classifyProbeResponse,
 } from './utils/waf-probe-utils.js';
 
@@ -1339,11 +1340,18 @@ class TokowakaClient {
   }
 
   /**
-   * Checks if Edge Optimize is enabled for a specific page path
-   * Follows one level of redirect and retries on failures
+   * Checks if Edge Optimize is enabled for a specific page path. Retries on failures.
+   *
+   * Fetches the customer's own domain directly (no proxy) and checks the response for
+   * BOTH the routing signal (x-tokowaka-request-id / x-edgeoptimize-request-id header)
+   * and a WAF/bot-block (via classifyProbeResponse, on the same fetched response — no
+   * second request). `edgeOptimizeEnabled` folds both together: it is only `true` when
+   * the request-id header is present AND the response isn't classified as blocked —
+   * routing alone is not sufficient.
+   *
    * @param {Object} site - Site entity
    * @param {string} path - Path to check (e.g., '/products/chair')
-   * @returns {Promise<Object>} - Status result with edgeOptimizeEnabled flag
+   * @returns {Promise<Object>} - `{ edgeOptimizeEnabled, blocked, statusCode? }`
    */
   async checkEdgeOptimizeStatus(site, path) {
     if (!isNonEmptyObject(site)) {
@@ -1362,15 +1370,15 @@ class TokowakaClient {
     }
 
     const defaultProbeHeaders = {
-      // eslint-disable-next-line max-len
-      'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Tokowaka-AI Tokowaka/1.0 AdobeEdgeOptimize-AI AdobeEdgeOptimize/1.0',
+      'User-Agent': ADOBE_PROBE_USER_AGENT,
       'fastly-debug': '1',
     };
     const customHeaders = currentConfig?.getScraperConfig?.()?.headers ?? {};
     const probeHeaders = { ...customHeaders, ...defaultProbeHeaders };
 
     const baseURL = getEffectiveBaseURL(site);
     const targetUrl = new URL(path, baseURL).toString();
+    const targetHost = new URL(targetUrl).host;
 
     this.log.info(`[edge-optimize-status] Checking edge optimize status for ${targetUrl}`);
 
@@ -1393,21 +1401,30 @@ class TokowakaClient {
 
         this.log.info(`[edge-optimize-status] Response status: ${response.status} for ${targetUrl}`);
 
-        const edgeOptimizeEnabled = response.headers.get('x-tokowaka-request-id') !== null
+        const requestIdPresent = response.headers.get('x-tokowaka-request-id') !== null
           || response.headers.get('x-edgeoptimize-request-id') !== null;
 
-        this.log.info(`[edge-optimize-status] Edge optimize headers found: ${edgeOptimizeEnabled} for ${targetUrl}`);
+        this.log.info(`[edge-optimize-status] Edge optimize headers found: ${requestIdPresent} for ${targetUrl}`);
+
+        // Classify the same response already fetched above for a WAF/bot-block — no second
+        // request. edgeOptimizeEnabled folds both signals together: routing alone isn't
+        // enough if the customer's own WAF is blocking us.
+        // eslint-disable-next-line no-await-in-loop
+        const { blocked, statusCode } = await classifyProbeResponse(response, targetHost, this.log);
+        const edgeOptimizeEnabled = requestIdPresent && !blocked;
 
         return {
           edgeOptimizeEnabled,
+          blocked,
+          statusCode,
         };
       } catch (error) {
         const isTimeout = error?.code === 'ETIMEOUT';
 
         if (isTimeout) {
           // eslint-disable-next-line max-len
           this.log.warn(`[edge-optimize-status] Request timed out after ${REQUEST_TIMEOUT_MS}ms for ${targetUrl}, returning edgeOptimizeEnabled: false`);
-          return { edgeOptimizeEnabled: false };
+          return { edgeOptimizeEnabled: false, blocked: null };
         }
 
         attempt += 1;
@@ -1442,8 +1459,9 @@ class TokowakaClient {
   }
 
   /**
-   * Probes whether a WAF or Bot Manager is blocking AdobeEdgeOptimize/1.0 traffic
-   * for the site.
+   * Probes whether a WAF or Bot Manager is blocking Adobe Edge Optimize traffic for the
+   * site, via Adobe's own edge-optimize proxy (not a direct fetch to the customer — see
+   * checkEdgeOptimizeStatus for the direct-fetch WAF check used alongside routing status).
    *
    * Probe outcomes:
    * - Hard block: HTTP 401/403/406/429/503 → `{ reachable: false, blocked: true }`
@@ -1476,7 +1494,7 @@ class TokowakaClient {
 
       const response = await tracingFetch(EDGE_OPTIMIZE_PROXY_BASE_URL_DEFAULT, {
         method: 'GET',
-        headers: { 'x-forwarded-host': targetHost },
+        headers: { 'x-forwarded-host': targetHost, 'User-Agent': ADOBE_PROBE_USER_AGENT },
         signal: AbortSignal.timeout(WAF_PROBE_TIMEOUT_MS),
       });
 
 
@@ -17,6 +17,13 @@ export const PRIVATE_HOST_RE = /^(localhost$|127\.|10\.|192\.168\.|172\.(1[6-9]|
 
 export const WAF_PROBE_TIMEOUT_MS = 15000;
 
+// Single, shared, Adobe-identifying UA for every Edge Optimize probe (routing check and
+// WAF check alike) so a customer only ever needs one allowlist rule to cover all of them,
+// and so the two checks can never drift into sending different UAs again.
+export const ADOBE_PROBE_USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) '
+  + 'AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 '
+  + 'Tokowaka-AI AdobeEdgeOptimize-AI Spacecat/1.0';
+
 // Soft-block detection: vendor-specific technical identifiers that only appear in
 // WAF-generated challenge pages, never in real page content. Broad natural-language
 // terms ('challenge', 'captcha', 'access denied') are intentionally excluded — they
@@ -25,7 +32,11 @@ export const WAF_PROBE_TIMEOUT_MS = 15000;
 export const BOT_CHALLENGE_KEYWORDS = [
   'cf-chl-widget', // Cloudflare challenge widget CSS class
   'completing the challenge', // Cloudflare-specific challenge phrase
-  '_incapsula_resource', // Imperva/Incapsula JS artifact — only in WAF-generated pages
+  // '_incapsula_resource' removed: Imperva/Incapsula injects this fingerprinting/RASP
+  // script into every page it fronts, blocked or not — false-positived real pages
+  // (e.g. hyundaicanada.com's genuine homepage). Imperva hard blocks are still caught
+  // via HARD_BLOCK_STATUS_CODES (403/429/etc.). Same fix already applied to the
+  // vendored copy in spacecat-import-worker's waf-probe.js.
   'errors.edgesuite.net', // Akamai error page domain
   'errors.edgekey.net', // Akamai edge key domain
 ];
@@ -36,14 +47,17 @@ export const BOT_CHALLENGE_KEYWORDS = [
 export const HARD_BLOCK_STATUS_CODES = new Set([401, 403, 406, 429, 503]);
 
 /**
- * Classifies an already-fetched Tokowaka-proxied response into one of four probe outcomes:
+ * Classifies an already-fetched response into one of four probe outcomes. Used both for
+ * responses fetched through the Tokowaka proxy (checkWafConnectivity) and for responses
+ * fetched directly from the customer's own domain (checkEdgeOptimizeStatus) — the
+ * classification logic itself doesn't care which vantage point the response came from:
  *   - Hard block  : HTTP status in HARD_BLOCK_STATUS_CODES → { reachable: false, blocked: true }
  *   - CF challenge: cf-mitigated: challenge header         → { reachable: false, blocked: true }
  *   - Soft block  : 2xx HTML body with vendor keywords     → { reachable: false, blocked: true }
  *   - Clean pass  : 2xx with real content                  → { reachable: true,  blocked: false }
  *   - Other       : unexpected status (e.g. redirect)      → { reachable: false, blocked: false }
  *
- * @param {Response} response - Fetch response from the Tokowaka proxy.
+ * @param {Response} response - Already-fetched response to classify.
  * @param {string} targetHost - Customer hostname, used only for log messages.
  * @param {Object} log - Logger with an `info` method.
  * @returns {Promise<Object>} Classification result.