Scraping

Web Scraping Best Practices: How to Collect Data Without Harming the Sites You Scrape

Responsible web scraping: honor robots.txt, rate-limit, back off on 429s, cache, and scrape off-peak. Being a good citizen also gets you blocked far less.

Chris Collins

Chris Collins

July 27, 2026 · 8 min read

Most scraping guides optimize for one thing: getting the data without getting stopped. That is a fair goal, but it skips the part that decides whether your pipeline survives past the first month. A scraper that hammers a target as fast as it can is not just rude, it is fragile. It spikes the site’s load, trips every rate limit and anti-bot rule it has, and turns a source you wanted to read quietly into one that is actively trying to shut you out.

The counterintuitive part is that the responsible way to scrape and the durable way to scrape are the same thing. Behaving like a considerate client, one that respects limits, spreads load, and asks for only what it needs, is exactly the profile that stays under detection thresholds and keeps working. This is the etiquette side of the same coin as how to avoid getting blocked: that post is about not looking like a bot, this one is about not behaving like a harmful one. Do the second and the first mostly takes care of itself.

Here is what responsible, durable scraping actually looks like in practice.

Read robots.txt, and take it seriously

Every well-run site publishes a robots.txt at its root that states which paths automated clients should not touch and, sometimes, a Crawl-delay. It is not a legal contract and it is not a technical barrier, it is the site telling you its preferences in the one place built for the purpose. Ignoring it entirely is the clearest signal that you are not a good-faith visitor.

The practical stance: fetch robots.txt once at the start of a run, cache it, and honor its disallowed paths for the user-agent you present. If it specifies a crawl delay, treat that as a floor, not a suggestion. There are legitimate reasons some projects diverge from parts of it, but “I never looked” is not one of them. Reading it also tells you where the site keeps a sitemap, which is often a far cleaner way to discover URLs than crawling link by link.

Rate-limit yourself before the site has to

The single most harmful thing a scraper does is send requests as fast as the network allows. A target sized for human traffic can be pushed into degraded response times, or over, by one aggressive client. That harms real users, and it is the fastest way to get your whole IP range blocked.

Set a deliberate request rate and stay under it. A few requests per second per host is plenty for most jobs, and slower is safer on smaller sites. Add a small random jitter between requests rather than a fixed metronome interval, so your traffic does not look mechanically uniform. The goal is to be one modest visitor among many, not a spike on someone’s monitoring dashboard. If you need more total throughput, spread it across time and across a rotating pool rather than turning up the pressure on any single host.

Back off when the site says no

A 429 Too Many Requests or a 503 is the server explicitly telling you to slow down. The wrong response is to retry immediately, which is exactly what an overloaded server cannot handle. The right response is exponential backoff: wait, retry, and if it fails again wait longer, doubling the delay each time up to a ceiling. Honor a Retry-After header when the server sends one, it is telling you precisely how long to wait.

This is different from retrying a genuinely failed request. A dropped connection or a timeout is a broken attempt worth retrying promptly; a 429 is a working server asking for space. Treat them differently. Blindly retrying 429s in a tight loop is how a scraper turns a soft rate limit into a hard ban.

Cache aggressively and never fetch the same thing twice

The cheapest request is the one you do not send. Before scaling up, look hard at how much you are re-fetching. Caching responses, honoring ETag and Last-Modified with conditional requests, and deduplicating your URL frontier routinely cut real-world request volume by large margins. Every avoided request is load you did not put on the target, bandwidth you did not spend, and a block-risk event that never happened.

This overlaps directly with cost. The same discipline that makes you a lighter guest also cuts your proxy bandwidth bill: request only the pages you need, fetch only the fields you use, and skip assets like images and fonts when you only want the HTML. Politeness and efficiency are the same set of habits.

Scrape during off-peak hours

If you can control when a job runs, run it when the target is quiet. A batch that would be noticeable at midday is invisible against low overnight traffic in the site’s local timezone. This is the difference between adding load when the server can least afford it and borrowing capacity that would otherwise sit idle. For large recurring pulls, schedule against the target’s off-peak window, not yours.

Identify yourself honestly where you can

There is a real tension here, and it is worth being straight about. Good scraping etiquette traditionally means sending a descriptive User-Agent that names your bot and a way to contact you, so an administrator who notices your traffic can reach out instead of reaching for a block. Many serious, above-board crawlers do exactly this.

At the same time, sites increasingly block anything that self-identifies as automated regardless of behavior, which pushes scrapers toward presenting as an ordinary browser. Both stances are defensible depending on your use case. What is not defensible is impersonating a specific service you are not, or spoofing another company’s crawler. Pick an honest presentation for your situation and keep it consistent. If you are collecting data for a business, having a public page that explains what your crawler does and how to contact you costs nothing and defuses a lot of conflict.

Take only public data, and mind what is in it

Responsible scraping means public pages, reached without defeating an authentication wall or agreeing to terms you then ignore. Data behind a login is a different legal and ethical category, and whether the scraping itself is legal depends heavily on that line. Stay on the public side of it.

Be just as careful about what the data contains as where it came from. If pages include personal information, you inherit privacy obligations the moment you store it, and collecting personal data at scale pulls in GDPR and similar regimes. The cleanest posture is to scope personal data out of your collection unless you have a specific lawful reason to hold it, and to not retain what you do not need.

Where proxies fit, and why the good ones make you gentler

None of the above is an argument against proxies, it is an argument for using them the right way. A quality residential pool is what lets you spread a reasonable request rate across many IPs and geographies instead of concentrating pressure on a target from one address. Used well, it is a load-distribution and localization tool, not a way to hit a site harder.

The quality of the pool also decides how often you retry at all. Clean IPs with good reputation sail through where flagged ones get challenged, so a better pool means fewer failed attempts, fewer retries, and less total load you generate for the same data. Rotating sensibly, one identity per logical unit of work rather than a new IP mid-session (sticky vs rotating), keeps your footprint coherent and light. And keeping latency low means each request finishes and releases quickly instead of piling up.

A short checklist

  • Fetch and honor robots.txt; use the sitemap it points to.
  • Set a deliberate per-host rate with random jitter; a few requests per second is usually plenty.
  • Back off exponentially on 429/503; honor Retry-After. Do not confuse this with retrying a broken request.
  • Cache, use conditional requests, deduplicate. The cheapest request is the one you skip.
  • Fetch only the pages and fields you need; skip assets you will not use.
  • Prefer off-peak hours in the target’s timezone for large jobs.
  • Choose an honest, consistent identity. Never impersonate another company’s crawler.
  • Public data only. Scope out personal data you do not have a lawful reason to keep.
  • Use a clean residential pool to distribute load, not to intensify it.

The bottom line

The scrapers that keep running for years are not the most aggressive ones, they are the ones the target barely notices. Every practice here, rate limiting, backoff, caching, off-peak scheduling, honest identification, points the same direction: take what you need, leave the site healthy, and look like the considerate client you actually are. That is the ethical way to scrape, and it happens to be the way that does not get you blocked.

If you want infrastructure built for distributing load rather than concentrating it, our residential proxies run on a clean, rotating pool, and the pricing page has per-GB plans so lighter, smarter scraping actually costs you less.

Ready to get started?

Try Shifter's residential proxies, 205M+ IPs, 195+ countries, from $0.75/GB.

Get Started