# Imperva Error 16 from a cloud VM

Imperva's security service dropped a cloud or datacenter IP and showed Error 16. A residential or mobile exit sometimes reaches the origin. Not a 403, not Cloudflare, not a login form.

## Fix

```sh
npx aluvia-cli setup
aluvia proxy-on
```

Then reload the page.

## What the page says

Any of these is a string the page showed:

- "Error 16"
- "Access denied"
- "This request was blocked by our security service"
- "Your IP"
- "Proxy IP"
- "Incident ID"
- "Powered by imperva"
- "ezyparts.bntnz.co.nz"

## Why it happens

Imperva sits in front of the origin. Error 16 is its card: the security service classified the client and refused the request before any application HTML came back. The hostname can still sit on that card while the rest of the site is missing. Not a 403 from the origin, and not a Cloudflare score with a Ray ID.

Cloud and hosting ranges are a common reason it drops a visitor. A US cloud VM reaching a New Zealand trade site is that shape: datacenter IP, often the wrong country for the shop. A residential or mobile exit is the part Aluvia can change. Imperva can still refuse the next request. Country pick is `/geo`; this page is the Error 16 card.

## What those commands do

`npx aluvia-cli setup` brings up a local proxy on this machine and points the already-open browser at it. Once per machine; it restarts that browser once.

`aluvia proxy-on` sends those tabs through a residential or mobile IP. `aluvia proxy-off` returns them to the machine IP. Both leave the browser running — no second restart.

The first `npx aluvia-cli setup` opens a free trial from an install id. No account to create, no API key to paste, no person waiting.

## If it is still blocked

One exit IP can be blocked on its own. Get a different one and reload again.

```sh
aluvia rotate-ip
```

## When this is the wrong tool

The address bar can show `/login` and the card still is not a login wall. The security service blocked the client before a username or password field appeared. Aluvia changes the exit IP so the request might reach that form; it does not fill or skip a credential gate. If a login form is already on screen, this page is the wrong tool.

---

Source: https://aluvia.io/unblock/imperva-security-service