IP rotation means the proxy changes the outgoing IP address it uses on your behalf — on every request, after a set time, or when you ask — so that your activity is spread across many addresses instead of piling up on one. It exists because almost every defence a website has against automation is per IP: rate limits, request budgets, ban lists. Rotate correctly and each IP stays below every threshold; rotate wrongly and you break your own logins. This guide covers the mechanics and the trade-offs.
The problem rotation solves
A site sees one IP make 5,000 requests in an hour and concludes, correctly, that it is a script. It answers with a CAPTCHA, a 429 Too Many Requests, or a silent block. The same 5,000 requests from 500 IPs — ten each — look like 500 people who each glanced at a few pages. Nothing about the traffic changed except its distribution across addresses.
Rotation is therefore not a disguise; it is load balancing your reputation. Each IP carries a budget of goodwill with a given site, and rotation lets you spend a little from many budgets instead of exhausting one.
How rotating proxies actually work: backconnect gateways
You do not receive a list of 10,000 IPs and cycle through them yourself. Instead the provider gives you a single endpoint — something like gate.provider.com:7777 — called a backconnect or gateway proxy. You always connect to that one address. Behind it, the provider's system picks an exit IP from its pool for each connection according to rules you set through the username or a special header.
A typical credential looks like:
user-country-de-city-berlin-session-a1b2c3-sessTime-10:passwordEvery hyphenated segment is an instruction to the gateway: use a German IP in Berlin, keep the same exit for the session named a1b2c3, and let that session live for 10 minutes. The exact syntax varies by provider, but the model is universal: one endpoint, parameters in the login, exit chosen per session.
The advantages are practical. Your application never needs to know which IP it got; dead IPs are swapped out invisibly; and geo-targeting is a string change rather than a new purchase.
Rotating vs sticky sessions
These are the two modes every gateway offers, and picking the wrong one is the most common rotation mistake.
| Rotating (per request) | Sticky (session) | |
|---|---|---|
| IP changes | On every new connection | Held for a set time (1–30 min typical, some providers up to hours) or until you release it |
| Cookies / logins | Break — the site sees a new visitor each time | Survive — the site sees one visitor across a flow |
| Best for | Stateless fetches: product pages, search results, public listings | Multi-step flows: login → browse → checkout; form submissions; anything with a session cookie |
| Risk | None from rotation itself; risk is per-request fingerprint | Long sessions accumulate activity on one IP |
| How to select | Omit the session parameter | Pass a session ID; reuse it for continuity, change it to rotate |
The rule: if the site needs to remember you between requests, use sticky; if each request stands alone, rotate. Scraping 10,000 product pages — rotate. Logging in and adding to cart — sticky for the duration of that user's flow, then a new session for the next user.
The trap: rotating in the middle of a session
Anti-fraud systems specifically watch for a logged-in session whose IP jumps between countries or ASNs mid-flow. A real person on a phone might change IP once when leaving Wi-Fi for 4G; they do not become a Brazilian at step three of a German checkout. If your session breaks unexpectedly, check that the sticky window did not expire underneath you.
Rotation strategies
- Per request. Maximum spread, zero continuity. The default for scraping.
- Timed. New IP every N minutes. Good for tasks that need short continuity — paginating through results, following a redirect chain.
- On demand. Your code decides when to rotate — typically after a 403/429, a CAPTCHA, or when a per-IP counter hits a threshold. The most efficient, because you rotate only when needed and keep good IPs working.
- Per target. Different rotation rules for different sites: fast for aggressive targets, slow for tolerant ones. Mature scraping setups do this per domain.
- Manual / mobile reconnect. With a mobile modem, forcing a reconnect requests a new IP from the carrier. Used deliberately between accounts or after warm-up steps.
How to choose a rotation interval
There is no universal number; the right interval is set by the target's per-IP tolerance and your throughput. Work it out from three questions:
- How many requests per IP does the site tolerate before it reacts? Measure it: send requests from one IP at your intended pace until you see a CAPTCHA, a 429, or degraded responses. Call that N. Rotate at well under N — half is a comfortable margin.
- How many requests per minute do you need overall? Divide by your per-IP pace to get how many IPs must be active concurrently. Your plan's concurrency limit must cover it.
- Does any part of your flow need continuity? If yes, that part must run on a sticky session at least as long as the flow takes, then rotate.
Practical starting points, to be adjusted by measurement:
| Task | Starting rotation |
|---|---|
| Public page scraping, tolerant site | Rotate every 50–100 requests or per request if pool is large |
| Public page scraping, aggressive anti-bot | Per request; add delays and human-like ordering |
| Search-engine result pages | Per request; SERPs are the most heavily rate-limited surface online |
| Login + a few actions | Sticky 10–30 min per user session, then rotate |
| API with documented per-IP limit | Rotate exactly when the counter approaches the limit; no earlier |
| Long-lived account (seller, ad account) | Do not rotate — use a static IP; rotation itself is the red flag here |
That last row is important enough to repeat: rotation is for anonymity of volume, not for accounts you keep. A marketplace seller account that logs in from a different IP every day looks stolen. Give persistent identities a persistent address — an ISP proxy or a dedicated mobile port — and reserve rotation for throwaway traffic. Our proxy types comparison covers which types offer static IPs.
Rotation and geo-targeting
Rotation happens within a target you specify. Rotating across a whole country pool is fine for “anywhere in Germany.” If your task is “a shopper in Munich,” constrain rotation to that city, or each request will land in a different place and any location-aware site will see a visitor teleporting. Providers expose this through the credential string, as in the example above; see also our note on country rotation.
What rotation cannot fix
Rotating IPs while sending the same cookies, the same browser fingerprint and the same TLS signature does not create many visitors; it creates one visitor with a suspicious habit of changing address. Sites that fingerprint will link the sessions regardless. Rotation must be paired with fresh session state — new cookie jar per identity, consistent User-Agent per session, and for browser automation an antidetect profile per identity. IP is one dimension of identity; rotate it in step with the others.
Frequently asked questions
What is a backconnect proxy?
A single gateway address the provider gives you that forwards each connection to a different exit IP from its pool. You configure one host and port; the rotation happens on the provider's side. Almost all residential and mobile proxy services are sold this way.
What is a sticky session?
A mode where the gateway keeps the same exit IP for a named session for a set period, so cookies and logins survive across requests. You select it by passing a session identifier in the proxy username; changing the identifier gives you a new IP.
How often should I rotate for web scraping?
Often enough that no IP exceeds roughly half of the target's observed per-IP tolerance. For most protected sites that means per request; for tolerant ones every few dozen requests. Measure the tolerance rather than guessing — it differs by site and changes over time.
Does rotating IPs prevent bans?
It prevents per-IP bans from volume. It does not prevent bans triggered by fingerprint, behaviour or credentials, and rotating mid-session can itself trigger anti-fraud checks. Rotation is one control among several.
Should I rotate the IP for my accounts?
Generally no. Accounts you intend to keep should live on a stable IP that matches their claimed location. Rotate only between different accounts, never within one, and never share one IP between accounts on the same platform.
Is rotating or sticky more expensive?
Usually the same on per-GB plans; the pool is the same, only the assignment rule differs. Some providers price dedicated static IPs (the extreme of “sticky”) separately and higher.