Proxies for Petco meet two bot vendors on the same request. On 24 August 2026 we sent petco.com a plain request from a home connection and from a datacenter server, and both came back HTTP 403 carrying both Cloudflare's __cf_bm cookie and cf-ray header and DataDome's datadome cookie and x-datadome headers. So the door is layered: Cloudflare in front and DataDome doing the bot decision, and a bare client failed the pair from either address. A real browser is required, and the residential IP keeps the session trusted once DataDome's challenge is solved.
Petco is a national pet retailer, and it is the natural comparison to Chewy: both push repeat-delivery subscriptions that make the real price a subscription price, and Petco adds store-level stock and a paid membership on top. The subscription economics are covered from the Chewy side in proxies for Chewy; this page is the Petco counterpart, with a Cloudflare-plus-DataDome door.
What proxies work best for Petco?
US rotating residential proxies behind a real browser, region-matched to the store you read. A static ISP proxy for a logged-in account with a subscription. Datacenter proxies get the 403 on contact.
Two vendors, one 403
DataDome is the bot decision here, and Cloudflare is the CDN and reputation layer in front of it. DataDome scores every request on device fingerprinting, the TLS handshake and header order, and serves a 403 with a JavaScript challenge to anything that looks automated, usually on the first request; solving it in a real browser earns the datadome cookie that grants access for a period (how to get around DataDome). Cloudflare adds reputation scoring and its own fingerprint read on top (how to scrape past Cloudflare, what is JA3/JA4 fingerprinting). The practical result is that the setup order is browser first, then residential exit, then region matching, and the browser has to actually solve DataDome's challenge, not just present a residential IP. Anthropologie and AutoZone run DataDome too, so a pipeline that clears one clears Petco's bot layer with Cloudflare's reputation gate added (proxies for AutoZone).
Subscriptions and a paid membership make the price a subscription
Petco pushes repeat-delivery subscriptions with a discount off the one-time price, and its paid membership adds perks and rewards. As with Chewy's Autoship, there are two prices for a product: the one-time price and the subscribed price, and they differ by a meaningful margin. A benchmarking dataset has to record which state it captured, because comparing Petco's one-time price to Chewy's Autoship price, or the reverse, compares two different things. The subscribed price usually shows in a subscription-selected or logged-in view, which is an account job on a static ISP address.
Stock is the second axis. Petco keys availability to a selected store for pickup and same-day delivery, so a read that ignores the store blends stores together. Pin the store, match the exit to its region, and record it.
- Cloudflare
- DataDome
- One-time price
- Subscription price
Clear both defenses with a browser, then capture both price states
Which proxy type fits which job
| Petco job | Proxy type | Why |
|---|---|---|
| One-time price and stock monitoring | US rotating residential, region-matched, behind a browser | Cloudflare plus DataDome gate the request |
| Subscription price capture | Static ISP, logged-in | The subscribed price shows in an account context |
| Store-level stock, region by region | Sticky residential per store | Availability keys to the store |
| Category and catalog collection | Rotating residential | Volume across a pool |
| Membership account, cart | Static ISP | The session must keep one address past DataDome |
| Parser tests against saved HTML | Datacenter or free | The live site refuses bare clients |
Rotating residential IPs let a browser session survive the layered scoring, and ISP proxies hold one address for a subscription account. The two differ as explained in rotating vs static residential proxies.
Setup
Lead with a real browser so DataDome's challenge has a client to run against, keep the datadome and __cf_bm cookies, and hold one exit per session (proxies for Playwright). Set the store, match the exit to its region, and record the store with every row. Capture the one-time and subscription prices separately, logging in on a static ISP address for the subscribed view. Pace like a shopper.
Sizing
Size by request rate: find how many pages one residential session sustains before DataDome re-challenges, and add exits, with a sticky exit per store. Budget browser-level bandwidth (headless browser proxy bandwidth cost). Accounts are one static ISP address each, and our pricing is pay-as-you-go with a balance that does not expire.
Free versus paid for Petco
The test settles it: a datacenter client with no browser got the 403 on both IPs. Free proxies confirm the pipeline forwards traffic and an address is alive, which our free proxy list and proxy checker cover. Reading Petco needs paid residential, from $0.44/GB pay-as-you-go with no KYC, behind a browser that satisfies DataDome. The line is in datacenter vs residential proxies.
Staying unblocked
- Do not retry the 403 without a browser. DataDome will keep refusing; the fix is the challenge.
- Keep both the datadome and Cloudflare cookies. They are the session's passport through the layered door.
- Set the store and match the exit. A blended-store price is a wrong number.
- Capture both price states. A one-time price labeled as the real price is misleading.
- Watch the 403 rate. A rising share means slow down or widen the pool. The full list is in avoiding IP bans while scraping.
What a proxy does not do here
A proxy gives a browser a clean, region-correct address and keeps accounts apart. It does not solve DataDome's challenge, does not set the store, and does not turn the one-time price into the subscription price. Scraping petco.com runs against its terms of use, a risk that stays with you regardless of the IPs. What a residential exit does is let a browser that has cleared both defenses look like a local shopper, after which capturing both price states correctly is the work. Test with the free proxy list, then read one-time and subscription prices with residential and ISP from $0.44/GB, and compare against Chewy on the same price state.
Sources
- DataDome, bot protection: the bot-decision layer behind our 403.
- Cloudflare, bot management: the CDN and reputation layer in front.
- Cloudflare, JA3/JA4 TLS fingerprinting: the handshake signal both layers read.
- HProxy test on 24 August 2026: plain GET requests to petco.com from a residential connection and a datacenter server, both returning HTTP 403 carrying both Cloudflare (
__cf_bm,cf-ray) and DataDome (datadome,x-datadome) markers.