When the site ties your session to an IP
Plenty of sites bind a session to the IP that created it. Login once from IP A, then hit an API from IP B with the same cookie, and you get kicked — soft logout, challenge page, or a hard block.
From a scraping seat, that means rotation and session persistence are opposites for a while. You pick one strategy per active session.
Pattern that works
Checkout a sticky proxy for the life of the session. Do login / warm-up / scrape on that IP only. When the job (or the session TTL) ends, release the proxy and take a new one for the next session. Rotate between sessions, not inside them.
What breaks if you ignore it
- Cookies suddenly “invalid” with no HTML change on the site.
- CSRF or auth tokens that only work from the original address.
- Rate limits that look random because you're splitting one logical user across many exits.
When rotation still helps
High-volume public pages with no login and weak IP binding. There, short-lived sessions and broad rotation can be fine. The mistake is copying that approach onto authenticated or cart-like flows.
If you're not sure whether a site binds IP to session, test it: create a session, switch proxy, retry one authenticated request. The response usually answers in one round trip.