CVS refused our server before it looked at anything else. On 24 August 2026 a request to cvs.com from a datacenter server in Germany, sent with a normal browser user-agent, returned HTTP 403 through Akamai with no page at all. The same request through 20 US proxies from our free list loaded the real homepage on 6 of them, with 13 never connecting and 1 refused. So the first thing a proxy does for CVS, for anyone outside the United States, is exist inside it. Inside the country, the reasons are the per-store ones every pharmacy chain shares, plus a coupon economy of its own: a weekly ad served by ZIP, ExtraCare deals and ExtraBucks that deal sites read every week, store-level stock and prices, and clinic availability.
The map underneath it keeps shrinking. In November 2021 CVS said it would close about 900 stores over the following three years, roughly a tenth of the 10,000 or so it ran at the time (CNBC, 18 November 2021), and its annual report filed in February 2025 said 271 more would close in 2025 (Newsweek, 28 May 2025). A location dataset that loses hundreds of rows a year is a dataset that gets re-read on a schedule.
We run US residential traffic for jobs like these, and the numbers above come from our own test the same evening we measured the delivery marketplaces and the other pharmacy chain.
Which proxy type fits CVS?
A US residential proxy exit pinned to the state, and where possible the metro, of the stores you read, driving a real browser, with one sticky session per store. Anything logged in runs on a static ISP proxy, one account per address. A US datacenter exit passes the country gate, which we confirmed, and it is exactly what Akamai's scoring is built to catch on the pages after it, so it is a false economy for a sweep.
What CVS is as a target
CVS is a retail pharmacy chain whose website is organized around a chosen store and a ZIP. Product pages show price and pickup availability for that store. The weekly ad is served by ZIP and differs between regions. ExtraCare is the loyalty program: coupons and ExtraBucks rewards attached to a card and a phone number, with 2 percent back in ExtraBucks on qualifying purchases, in-store yellow-tag sale prices that rotate about every two weeks, and deals that deal communities preview and post every week (CVS ExtraCare overview). MinuteClinic schedules clinic visits and vaccines per location. And pharmacy pages handle prescriptions, which are not a data job under any tool.
For a monitoring job that produces a clear map. Ads, deals, stock, prices, clinic availability and locations are public, per store or per ZIP, and have no public API, so they are read from the site. Everything behind an ExtraCare login or a pharmacy login stays there.
Jobs a proxy is the right tool for
- Weekly ad and ExtraCare deal research by ZIP. The ad and the deals differ by region and change weekly. Coupon and deal sites read them per ZIP; brands check that the promotion they paid for ran where it was sold.
- Store-level stock and price monitoring. Consumer brands want their shelf price and in-stock status across stores; deal sites and resellers watch clearance and restocks. Both mean the same product pages read for many stores on a schedule.
- Clinic and vaccine availability. Open-or-not per location, shown to people looking for a slot, the way the 2021 pharmacy scrapers did during the vaccine rollout. Availability only, displayed rather than booked.
- Location data. With about 1,200 closures since 2022, the store list changes constantly. Site-selection analysts, competitors and mapping projects re-read the locator to keep up.
- Watching from outside the country. For anyone not in the United States, this is the whole game: without a US exit, cvs.com serves nothing.
Jobs a proxy is not the tool for
Prescriptions and health records. Not a scraping job under any tool.
ExtraCare across accounts. The program attaches to a card and a phone number, and creating accounts to stack offers runs against CVS' terms. None of those links is the IP address.
Booking bots. Showing that a clinic slot is open is a service to humans; a bot that grabs slots is a different thing, and against the terms.
The front door, measured
Two observations on 24 August 2026, both from one server, each proxy sending a single request for cvs.com with a normal browser user-agent and a short timeout.
Direct, from Germany: HTTP 403 through Akamai, with no page body. Through 20 elite HTTP proxies from our free proxy list filtered to the United States: 6 loaded the real homepage, 13 never completed a connection, and 1 was refused with the same 403. So the gate at the door is the country of the address, and a US address opens it. Akamai's bot manager sits behind that gate; we saw its marker on the refusal and its _abck sensor cookie on the sister chain the same evening (see proxies for Walgreens). The homepage is served to nearly anyone in the country, and the client is scored on the sensor data it sends back on the pages after it. A bare HTTP client sends none, a shared datacenter address arrives with a poor reputation, and a product-page sweep on either ends in Akamai's Access Denied page with a reference number. We did not measure how many pages that takes, and it depends on the client more than the address.
The practical answer is a US residential exit, which passes the country gate and carries a real reputation, driving a real browser, which produces the sensor data Akamai expects. Scraping past Akamai and how the _abck cookie works cover the mechanism.
Non-US address
403, no page
US address
homepage loads
Akamai scoring
real browser passes
Store session
ad, stock, price, clinic
Which proxy type fits, by job
| CVS job | Proxy type | Why |
|---|---|---|
| Weekly ad and ExtraCare deal research by ZIP | Rotating US residential, state-pinned | The ad is served per ZIP; passes the country gate and the scoring |
| Store-level stock and price monitoring | Rotating US residential, state or metro pinned, sticky per store | Reads as a nearby customer across a sweep |
| Clinic and vaccine availability display | Rotating US residential, sticky per location, slow pacing | Per-location checks on a schedule, shown to humans |
| Locator and location data | US residential, slow pacing | Paged coordinate queries from one address is the metered pattern |
| Any login | US ISP (static residential) | One fixed, trusted location per account |
| A single manual look from abroad | US datacenter, or a fresh US free proxy | Opens the country gate; not for repeated reads |
Why the two address types are treated so differently is explained in datacenter vs residential proxies, and free USA proxy explains why US exits are the most common free proxies and why they still die in minutes.
Free versus paid for CVS
Free proxies do their one honest job here: a fresh US exit from our free proxy list can open the country gate for a single manual look at one store's page, which is more than they manage against the delivery marketplaces. Thirteen of the 20 in our test could not complete a request, which is the normal lifespan of free, and the six that loaded the homepage were shared datacenter addresses that Akamai scores badly the moment they read product pages on a schedule. Verify any free proxy in the proxy checker first, and read when free proxies are fine for the line. For a sweep, our US residential proxies start at $0.44/GB, pay as you go, no KYC, and pin to the state or metro.
How to set it up
- Get a US exit before anything else. Nothing renders otherwise. Pin the residential exit to the state, and where possible the metro, of the stores or ZIPs you plan to read.
- Drive a real browser and keep its cookies. Playwright or Puppeteer with the proxy set at launch, a current user-agent, and the Akamai sensor cookie retained for the session, because that cookie is the session's standing. A launch config to copy is in the Puppeteer proxy guide.
- One sticky session per store or ZIP. Choose the store or enter the ZIP, read the ad or the product pages you need, record the store number and the timestamp, then rotate to a fresh exit. Rotating mid-session resets the sensor history. See sticky vs rotating proxy sessions.
- Read the ad on its cycle. The weekly ad changes on a fixed day; read each ZIP once per cycle and diff against last week rather than re-reading daily.
- Pace and watch for the Access Denied page. Vary the gaps between requests, skip images, and treat the first Access Denied response from an exit as the instruction to retire it. Avoiding IP bans while scraping has the longer list.
How many IPs
Size by ZIPs, stores and products, not by the size of the catalog.
Weekly ad across 300 ZIPs plus 150 products in 100 stores, weekly:
ZIP sessions per cycle 300, one ad read each
store sessions per cycle 100, 150 product pages each, paced
sessions per exit per day 3-4
exits in rotation ~20-25 US residential across the states
Residential is billed by traffic. Ad pages and product pages with
images blocked are small, so the sweep, not the exit count, sets the
bill.
Under pay-as-you-go pricing a weekly cycle runs for a quarter and stops, with no subscription to unwind.
Where a proxy stops
Past the country gate, the proxy has done its part. A real browser supplies the sensor data Akamai scores, prescriptions and ExtraCare accounts stay untouched, and CVS' terms prohibit scraping no matter which address asks. What remains is the legitimate version of the job: a US residential exit reading public ads, deals, stock, prices, availability and locations the way customers in each store's neighborhood read them, one store or ZIP per session, at a human pace, with an eye on the block rate.
The other national pharmacy chain has an open door and a developer API for some jobs; see proxies for Walgreens. For the general method behind any scheduled read of retail prices, see proxies for price monitoring, and for a retailer with a much harder challenge in front of store-localized prices, proxies for Walmart.
Sources
- CNBC, 18 November 2021, CVS to close about 900 stores over three years (roughly a tenth of about 10,000 stores): cnbc.com
- Newsweek, 28 May 2025, CVS to close 271 stores in 2025 per its annual report filed in February 2025, after about 900 closures in 2022 to 2024: newsweek.com
- CVS, ExtraCare savings and rewards overview (2 percent ExtraBucks, weekly-ad deals and two-week yellow-tag pricing): cvs.com
- HProxy measurement, 24 August 2026: cvs.com from a German datacenter server (HTTP 403 through Akamai) and through 20 US elite free proxies from our free proxy list (6 homepage, 13 no connection, 1 refused).