Proxy rotation changes the IP address your requests leave from, on every request or after a set time. A site that counts requests per IP then sees each address only a few times. No single address reaches the site's limit or its ban. Rotation does nothing about what a site reads in the request itself: the TLS fingerprint, the cookies and the pace. On October 22, 2026, we read how four firewall services count requests and measured how fast free proxies stop answering.
What is proxy rotation?
Proxy rotation is the practice of sending requests through a changing set of exit IP addresses instead of one. The arithmetic is the whole idea. Spread 10,000 requests over 2,000 addresses, and each address sends five.
Proxy rotation
a technique
Sending requests through a changing set of exit IP addresses, on every request or after a set time, so a site that counts per IP sees each address only a few times.
Rotation is a way of using addresses, so any proxy type can rotate: residential, ISP, mobile or datacenter. A rotating proxy is the product that does it for you. Rotation is the technique underneath.
How does proxy rotation work?
There are two places to do it. You can hold a list of proxies and pick a different one in your own code for each request. Or you connect to one gateway address, and the seller's gateway picks an exit for each request or each session.
With a list, you own the upkeep: finding addresses, testing which still answer and dropping the dead ones. With a gateway, one host, one port and one login stay the same while the exits change behind them. That gateway is what people call a backconnect proxy. It is also why a tool that knows nothing about rotation still gets the benefit.
Your requests
one host, one port, one login
Gateway
picks an exit per request or session
Exit IPs
a different address each time
Target site
counts per IP, sees each one rarely
At Oxylabs, a residential line rotates on every request by default, its documentation says. Ours does the same. Leave out the session setting, and every request through the line can exit from a different residential IP. Your code stays the same in both modes, because the line decides:
import requests
proxy = "http://YOUR-LOGIN:YOUR-PASSWORD@premium.hproxy.com:10000"
for _ in range(3):
# requests.get opens a new connection on every call
r = requests.get("https://icanhazip.com", proxies={"http": proxy, "https": proxy}, timeout=30)
print(r.text.strip())
The new connection matters. For an https page, your client asks the proxy for a tunnel with the CONNECT method. RFC 9110 says the proxy then forwards data "until the tunnel is closed". Every request inside one tunnel leaves from the same exit. A browser, or any client that keeps its connection open, can therefore send many requests through one address.
Rotate on every request or keep a sticky session?
Per-request rotation suits jobs where each page stands alone: product pages, search results and prices. A sticky session holds one exit for a set time, so a login, a cart or the next page of results keeps one address. Sites have a reason to care. OWASP tells developers to bind a session to properties such as the client IP address. It calls a change in the middle of a session "a very good indicator of session manipulation".
Sellers document their windows. Oxylabs and Decodo hold a sticky session for 10 minutes by default, and Massive for 15. Seven of the ten sellers we read on October 22, 2026, allow up to 24 hours. Two of them end a session early: Oxylabs and Decodo after 60 seconds without a request.
Our Residential Premium takes any length from 3 to 1,440 minutes. Residential Lite holds its address for as long as you keep using the line. Each sticky line keeps its own session, and an address can still change early if its home device leaves the network.
| Mode | Use it for | The IP changes |
|---|---|---|
| Per request | Pages that stand alone | On a new connection |
| Sticky | Logins and carts | When the window ends |
| Your switch | Retries, long crawls | When your code asks |
The third row is a sticky session you end yourself, on a timer or after a block. Our page on sticky vs rotating proxy sessions compares the ten sellers' windows in full.
What does rotation defeat?
Rotation beats any rule a site keys to the IP address. The classic one is the rate limit: count the requests from each IP over a window and refuse the excess. The refusal is often 429 Too Many Requests. RFC 6585 defines it for a user who "has sent too many requests in a given amount of time". Cloudflare uses 429 as its default answer.
Four large firewall services document how they count:
| Service | Counts by | Time window |
|---|---|---|
| AWS WAF | The IP by default | 1, 2, 5 or 10 min |
| Cloudflare | IP or another key | 10 s to 1 hour |
| Cloud Armor | IP or another key | 10 s to 1 hour |
| Azure Front Door | Each socket IP | 1 or 5 minutes |
AWS WAF counts by the request IP unless told otherwise. Its lowest limit is 10 requests, and its default window is five minutes. Google Cloud Armor offers a default security policy when a site creates a load balancer. That policy allows 500 requests a minute. Cloudflare can hold its action against a client for up to one day, depending on the plan. Azure Front Door counts per socket IP, which it notes can be a proxy server's address.
The sum is simple. At AWS WAF's lowest setting, a job that sends 1,000 requests in five minutes needs at least 100 exits to keep each under 10. AWS says it enforces near the limit you set, without promising an exact match, so plan for headroom.
Bans work the same way. A banned address stops mattering once the next request leaves from another. Our guides on 429 errors and IP bans cover the retry side.
What does rotation not fix?
Rotation changes one thing, the source IP. The same firewalls can count by other keys. AWS WAF, Cloudflare and Cloud Armor all accept a cookie, a header or a JA3 or JA4 fingerprint as the key. Cloudflare calls those fingerprints "a stable identifier" of the client software. Rotate the IP, and a rule keyed to your fingerprint still adds every request to one counter.
AWS WAF and Cloudflare can also count by network. A rule keyed to the ASN treats every address of one internet provider as one client. The ASN is the number of the network an address belongs to. Rotating inside one provider then helps little.
Detection that reads the requests themselves ignores the IP as well. Cloudflare wrote in June 2024 that IP rotation lets attackers bypass "IP reputation and IP rate limiting". In the same post, its model classified more than 17 million unique IPs an hour taking part in residential proxy attacks. In one case, it caught 95% of the requests in a distributed residential proxy attack. Our guide to how websites detect proxies covers those signals.
Sessions set another limit. A login bound to an IP breaks when the next request arrives from another address, which is why sticky sessions exist. Rotation also cannot clean an address. An IP reputation check flagged 99.1% of the 7,082 working free proxies we track on October 22, 2026. Our page on anonymous proxy detected errors has the details.
One cost hides behind rotation. A blocked request costs little when the next one leaves from a new address. A job can then retry a large share of its requests for weeks. You still pay for that traffic. Log your block rate even when rotation keeps the blocks out of sight.
Can you rotate free proxies yourself?
You can, and the list is the hard part. Our checker tests every working address on our free proxy list every 15 to 20 minutes. At 06:32 UTC on October 22, 2026, 5,195 addresses had passed their latest check. Three in four of them had passed every check in a row for less than an hour.
In the 24 hours before that reading, 33,987 addresses that had been answering stopped, and none of them had answered again. A list rotator has to test its addresses all day, or it spends requests on dead ones.
The same list, followed for five days, shows how few addresses last. Take the 12,477 free proxies that answered between 04:00 and 05:00 UTC on October 17. Half of them answered in the same hour a day later. Five days later, 46% did. Only 28% had answered in that hour on all five days.
A group that answered on October 19 did a little better, with 64% back the next day. A free list loses between a third and a half of its working addresses within a day. A gateway moves that upkeep to the seller: you keep one address while the seller's system chooses the exits.
What does proxy rotation cost?
We bill rotating and sticky lines the same way, per GB of traffic. Residential Lite costs $0.50 per GB for one GB and $0.44/GB at 2,000 GB+. Residential Premium costs $1.49 per GB for one GB and $1.00/GB at 1,000 GB+. Generating lines costs nothing; only traffic draws on the balance, and the balance does not expire.
Per-GB billing suits rotation, because a bursty job pays only for the traffic it moves. Our residential proxies target by country or, on Residential Premium, down to the city, and residential pricing lists every tier. Check which address a line exits from with our proxy checker, or drive rotation from code through the API documentation.
What this page could not check
- No rotation tests. We did not test any seller's rotation, ours included. Nothing here measures how often a gateway changes IP or how long a sticky session really holds.
- Settings, not sites. The firewall figures are what each service documents. A site picks its own limits and keys, and those cannot be seen from outside.
- Our checker's view. The free list figures cover the public proxies our checker collects. A timeout on our side counts as a failed check, so some short runs partly reflect our checker. The survival read uses one hour a day.
- Dated figures. Cloudflare's model figures date from June 2024.
- Check by January 22, 2027. Seller session windows and firewall settings change.
Sources
- RFC 6585: Additional HTTP Status Codes. IETF, April 2012.
- RFC 9110: HTTP Semantics, section 9.3.6, CONNECT. IETF, June 2022.
- Rate-based rule high-level settings, and Aggregating rate-based rules. AWS WAF Developer Guide, read October 22, 2026.
- Rate limiting rule parameters, and JA3 and JA4 fingerprints. Cloudflare developer documentation, read October 22, 2026.
- Rate limiting overview. Google Cloud Armor documentation, read October 22, 2026.
- What is rate limiting for Azure Front Door? Microsoft Learn, updated February 25, 2026.
- Residential proxy bot detection using machine learning. Cloudflare blog, June 24, 2024.
- Session Management Cheat Sheet. OWASP Cheat Sheet Series, read October 22, 2026.
- Residential session control (Oxylabs), sticky and rotating sessions FAQ (Decodo) and sticky sessions knowledge base (Massive), read October 22, 2026.
- Plans and line generation. HProxy API documentation, read October 22, 2026.
- HProxy free proxy checker database, read October 22, 2026, at 06:32 UTC.
