Use case

Proxies for CVS: ExtraCare Deals by ZIP, Store Stock, and a Shrinking Store Map

Proxies for CVS: reading weekly ads and ExtraCare deals by ZIP, store-level stock and prices, clinic availability, and a store map that lost about 1,200 rows since 2022, which proxy type fits, why cvs.com refused our German server, and what a proxy cannot do.

HProxy Team··9 min read
HProxy.Use case

Free proxies won't hold up here.

Shared datacenter IPs get flagged and dropped fast. When it has to hold, gaming, streaming, accounts, you need mobile and residential IPs that read as a real device, from $0.44/GB, pay as you go.

See plans & pricing

CVS refused our server before it looked at anything else. On 24 August 2026 a request to cvs.com from a datacenter server in Germany, sent with a normal browser user-agent, returned HTTP 403 through Akamai with no page at all. The same request through 20 US proxies from our free list loaded the real homepage on 6 of them, with 13 never connecting and 1 refused. So the first thing a proxy does for CVS, for anyone outside the United States, is exist inside it. Inside the country, the reasons are the per-store ones every pharmacy chain shares, plus a coupon economy of its own: a weekly ad served by ZIP, ExtraCare deals and ExtraBucks that deal sites read every week, store-level stock and prices, and clinic availability.

The map underneath it keeps shrinking. In November 2021 CVS said it would close about 900 stores over the following three years, roughly a tenth of the 10,000 or so it ran at the time (CNBC, 18 November 2021), and its annual report filed in February 2025 said 271 more would close in 2025 (Newsweek, 28 May 2025). A location dataset that loses hundreds of rows a year is a dataset that gets re-read on a schedule.

We run US residential traffic for jobs like these, and the numbers above come from our own test the same evening we measured the delivery marketplaces and the other pharmacy chain.

Which proxy type fits CVS?

A US residential proxy exit pinned to the state, and where possible the metro, of the stores you read, driving a real browser, with one sticky session per store. Anything logged in runs on a static ISP proxy, one account per address. A US datacenter exit passes the country gate, which we confirmed, and it is exactly what Akamai's scoring is built to catch on the pages after it, so it is a false economy for a sweep.

What CVS is as a target

CVS is a retail pharmacy chain whose website is organized around a chosen store and a ZIP. Product pages show price and pickup availability for that store. The weekly ad is served by ZIP and differs between regions. ExtraCare is the loyalty program: coupons and ExtraBucks rewards attached to a card and a phone number, with 2 percent back in ExtraBucks on qualifying purchases, in-store yellow-tag sale prices that rotate about every two weeks, and deals that deal communities preview and post every week (CVS ExtraCare overview). MinuteClinic schedules clinic visits and vaccines per location. And pharmacy pages handle prescriptions, which are not a data job under any tool.

For a monitoring job that produces a clear map. Ads, deals, stock, prices, clinic availability and locations are public, per store or per ZIP, and have no public API, so they are read from the site. Everything behind an ExtraCare login or a pharmacy login stays there.

Jobs a proxy is the right tool for

  • Weekly ad and ExtraCare deal research by ZIP. The ad and the deals differ by region and change weekly. Coupon and deal sites read them per ZIP; brands check that the promotion they paid for ran where it was sold.
  • Store-level stock and price monitoring. Consumer brands want their shelf price and in-stock status across stores; deal sites and resellers watch clearance and restocks. Both mean the same product pages read for many stores on a schedule.
  • Clinic and vaccine availability. Open-or-not per location, shown to people looking for a slot, the way the 2021 pharmacy scrapers did during the vaccine rollout. Availability only, displayed rather than booked.
  • Location data. With about 1,200 closures since 2022, the store list changes constantly. Site-selection analysts, competitors and mapping projects re-read the locator to keep up.
  • Watching from outside the country. For anyone not in the United States, this is the whole game: without a US exit, cvs.com serves nothing.

Jobs a proxy is not the tool for

Prescriptions and health records. Not a scraping job under any tool.

ExtraCare across accounts. The program attaches to a card and a phone number, and creating accounts to stack offers runs against CVS' terms. None of those links is the IP address.

Booking bots. Showing that a clinic slot is open is a service to humans; a bot that grabs slots is a different thing, and against the terms.

The front door, measured

Two observations on 24 August 2026, both from one server, each proxy sending a single request for cvs.com with a normal browser user-agent and a short timeout.

Direct, from Germany: HTTP 403 through Akamai, with no page body. Through 20 elite HTTP proxies from our free proxy list filtered to the United States: 6 loaded the real homepage, 13 never completed a connection, and 1 was refused with the same 403. So the gate at the door is the country of the address, and a US address opens it. Akamai's bot manager sits behind that gate; we saw its marker on the refusal and its _abck sensor cookie on the sister chain the same evening (see proxies for Walgreens). The homepage is served to nearly anyone in the country, and the client is scored on the sensor data it sends back on the pages after it. A bare HTTP client sends none, a shared datacenter address arrives with a poor reputation, and a product-page sweep on either ends in Akamai's Access Denied page with a reference number. We did not measure how many pages that takes, and it depends on the client more than the address.

The practical answer is a US residential exit, which passes the country gate and carries a real reputation, driving a real browser, which produces the sensor data Akamai expects. Scraping past Akamai and how the _abck cookie works cover the mechanism.

CVS has two doors
  1. Non-US address

    403, no page

  2. US address

    homepage loads

  3. Akamai scoring

    real browser passes

  4. Store session

    ad, stock, price, clinic

Source: HProxy, 24 August 2026: German server refused; 6 of 20 US free proxies loaded the homepage

Which proxy type fits, by job

CVS jobProxy typeWhy
Weekly ad and ExtraCare deal research by ZIPRotating US residential, state-pinnedThe ad is served per ZIP; passes the country gate and the scoring
Store-level stock and price monitoringRotating US residential, state or metro pinned, sticky per storeReads as a nearby customer across a sweep
Clinic and vaccine availability displayRotating US residential, sticky per location, slow pacingPer-location checks on a schedule, shown to humans
Locator and location dataUS residential, slow pacingPaged coordinate queries from one address is the metered pattern
Any loginUS ISP (static residential)One fixed, trusted location per account
A single manual look from abroadUS datacenter, or a fresh US free proxyOpens the country gate; not for repeated reads

Why the two address types are treated so differently is explained in datacenter vs residential proxies, and free USA proxy explains why US exits are the most common free proxies and why they still die in minutes.

Free versus paid for CVS

Free proxies do their one honest job here: a fresh US exit from our free proxy list can open the country gate for a single manual look at one store's page, which is more than they manage against the delivery marketplaces. Thirteen of the 20 in our test could not complete a request, which is the normal lifespan of free, and the six that loaded the homepage were shared datacenter addresses that Akamai scores badly the moment they read product pages on a schedule. Verify any free proxy in the proxy checker first, and read when free proxies are fine for the line. For a sweep, our US residential proxies start at $0.44/GB, pay as you go, no KYC, and pin to the state or metro.

How to set it up

  1. Get a US exit before anything else. Nothing renders otherwise. Pin the residential exit to the state, and where possible the metro, of the stores or ZIPs you plan to read.
  2. Drive a real browser and keep its cookies. Playwright or Puppeteer with the proxy set at launch, a current user-agent, and the Akamai sensor cookie retained for the session, because that cookie is the session's standing. A launch config to copy is in the Puppeteer proxy guide.
  3. One sticky session per store or ZIP. Choose the store or enter the ZIP, read the ad or the product pages you need, record the store number and the timestamp, then rotate to a fresh exit. Rotating mid-session resets the sensor history. See sticky vs rotating proxy sessions.
  4. Read the ad on its cycle. The weekly ad changes on a fixed day; read each ZIP once per cycle and diff against last week rather than re-reading daily.
  5. Pace and watch for the Access Denied page. Vary the gaps between requests, skip images, and treat the first Access Denied response from an exit as the instruction to retire it. Avoiding IP bans while scraping has the longer list.

How many IPs

Size by ZIPs, stores and products, not by the size of the catalog.

Weekly ad across 300 ZIPs plus 150 products in 100 stores, weekly:
  ZIP sessions per cycle       300, one ad read each
  store sessions per cycle     100, 150 product pages each, paced
  sessions per exit per day    3-4
  exits in rotation            ~20-25 US residential across the states

Residential is billed by traffic. Ad pages and product pages with
images blocked are small, so the sweep, not the exit count, sets the
bill.

Under pay-as-you-go pricing a weekly cycle runs for a quarter and stops, with no subscription to unwind.

Where a proxy stops

Past the country gate, the proxy has done its part. A real browser supplies the sensor data Akamai scores, prescriptions and ExtraCare accounts stay untouched, and CVS' terms prohibit scraping no matter which address asks. What remains is the legitimate version of the job: a US residential exit reading public ads, deals, stock, prices, availability and locations the way customers in each store's neighborhood read them, one store or ZIP per session, at a human pace, with an eye on the block rate.

The other national pharmacy chain has an open door and a developer API for some jobs; see proxies for Walgreens. For the general method behind any scheduled read of retail prices, see proxies for price monitoring, and for a retailer with a much harder challenge in front of store-localized prices, proxies for Walmart.

Sources

  • CNBC, 18 November 2021, CVS to close about 900 stores over three years (roughly a tenth of about 10,000 stores): cnbc.com
  • Newsweek, 28 May 2025, CVS to close 271 stores in 2025 per its annual report filed in February 2025, after about 900 closures in 2022 to 2024: newsweek.com
  • CVS, ExtraCare savings and rewards overview (2 percent ExtraBucks, weekly-ad deals and two-week yellow-tag pricing): cvs.com
  • HProxy measurement, 24 August 2026: cvs.com from a German datacenter server (HTTP 403 through Akamai) and through 20 US elite free proxies from our free proxy list (6 homepage, 13 no connection, 1 refused).

Frequently asked questions

What proxy type works for CVS?
US residential proxies pinned to the state or metro of the stores you are reading, driving a real browser, with one sticky session per store. cvs.com refused our German datacenter server outright with a 403 through Akamai, while 6 of 20 US free proxies loaded the real homepage, so the first gate is the country of the address and the scoring comes after it. For any login, a static ISP proxy per account.
Why does cvs.com return 403 from outside the United States?
Because the site checks the country of the connecting address before serving anything. On 24 August 2026 our server in Germany got HTTP 403 with no page, and US exits, even shared free ones, got the homepage. A US residential exit removes that gate; Akamai's bot scoring then applies to the pages you read after it, which is why the exit should be residential and the client a real browser.
How many CVS stores are closing, and why does that matter for data?
CVS announced in November 2021 that it would close about 900 stores between 2022 and 2024, roughly a tenth of the 10,000 or so it ran at the time, and its annual report filed in February 2025 said 271 more would close in 2025. A store dataset losing hundreds of rows a year has to be re-read on a schedule, which is the exact pattern one address cannot sustain.
Can a proxy help with ExtraCare across several accounts, or with pharmacy records?
No, and the second is off-limits under any tool. ExtraCare attaches to a card and a phone number, creating accounts to stack offers runs against CVS' terms, and prescriptions and health records are not a data job at all. The proxy jobs on CVS are public data jobs: weekly ads, deals, stock, prices, clinic availability and locations.
Do free proxies work on cvs.com?
US ones can open the door: 6 of 20 loaded the homepage in our test, 13 never connected, 1 was refused. That is enough for one manual look at one store from abroad. A sweep is another matter, because free proxies are shared datacenter addresses that die within minutes and score badly with Akamai once they read product pages on a schedule.

Proxies that don't die mid-job

Residential, ISP, datacenter and mobile, verified by the same engine that runs tens of millions of checks. They read as a real device and hold up under load. Pay as you go, and your balance never expires. $0.44/GB is the 2,000 GB+ rate; a single gigabyte is $0.50/GB, with no minimum order.

129M+ proxy checks run · 100+ countries · HTTP / HTTPS / SOCKS · re-checked every few minutes · no signup