We are Geonode and we sell proxies. We are not selling them for automated purchasing, and the reason is practical as well as ethical: an IP address is not the constraint here. Foot Locker's US site is behind Cloudflare, whose own documentation describes bot detection built on machine learning over request features, header-order analysis and JavaScript-based headless detection — none of which change when your address does. A residential proxy in front of a client that still looks automated buys you a clean address attached to an unchanged problem. There is a genuine and much smaller set of jobs where proxies are the right tool, and those are covered properly below.
What We Actually Found
Checked directly in September 2026, rather than repeated from other articles.
footlocker.com/robots.txt returns 404. Not a redirect, not an empty file — a WebContentNotFound error. Under RFC 9309, a 4xx response means the file is unavailable and "the crawler MAY access any resources on the server". So the US site imposes no robots.txt restrictions, because there is no robots.txt.
That is not permission to do anything. robots.txt is one signal among several, and the RFC itself states that its rules "are not a form of access authorization". Terms of service and technical protection both apply regardless.
footlocker.co.uk/robots.txt exists and is instructive. Last modified 21 July 2025, it disallows Baiduspider entirely, and for all other crawlers disallows a specific list:
Disallow: /account/*
Disallow: /cart
Disallow: /wishlist/
Disallow: /shoppingcart/
Disallow: /checkout
Disallow: /checkout/*
Disallow: /account/details
Disallow: /account/orders
Disallow: /account/payment/new
Disallow: /quickview/
Disallow: /paygate/ccn
Read that list. Every path a purchasing tool would need is on it — cart, checkout, account, payment. Product and category pages are not disallowed; the transactional flow is. That is a clear statement of what the site is asking crawlers not to touch, and it happens to be precisely the part a sneaker bot exists to use.
The US terms page sits behind a Cloudflare challenge. Requesting footlocker.com/help/terms-of-use.html with an ordinary client returns a "Just a moment..." interstitial with challenges.cloudflare.com in its content security policy — the standard Cloudflare bot-protection response.
The site is protected. That is worth knowing before planning anything, and it is why the next section matters more than any proxy comparison.
Why Proxies Are Not the Constraint
The honest technical assessment, from the protection vendor's own documentation.
Cloudflare's bot score runs from 1 to 99, with 1 meaning "Cloudflare is quite certain the request was automated". It is produced by several engines. Machine learning accounts for most detections, using a "supervised machine learning methodology" over "request features like headers and browser signals". JavaScript detections identify headless browsers through "lightweight, invisible client-side JavaScript injection". And detection IDs are static rules — Cloudflare's own example is identifying when "a client sends headers in a different order than what its claimed browser would use".
Note what appears in that list and what does not. Header composition and ordering, browser signals, machine-learned request features, JavaScript execution characteristics. The client IP address is not how a Python or Node client gets identified as automated.
Address reputation is certainly an input to the overall decision — a shared datacentre range with a poor history will not help you. But if you are being flagged because your request does not look like the browser it claims to be, no address changes that, and we would rather say so than sell bandwidth for it.
There is a second reason worth knowing. Cloudflare also offers AI Labyrinth, which serves crawlers generated content instead of blocking them — pages that are "real and related to scientific facts, just not relevant or proprietary to the site being crawled". A scraper can therefore appear to succeed indefinitely while collecting nothing. Everything returns 200; the data is worthless. We covered that pattern in honeypot traps.
Why Draws Change the Maths
The other reason automated purchasing does not work the way people expect, and it is mechanical rather than technical.
Limited releases are increasingly allocated by draw rather than by speed. An entry window opens, everyone who enters is pooled, and winners are selected. Selection is not by arrival order, so entering at second one and at minute nine are equivalent.
For a draw, "more entries from more addresses" is not a speed advantage. It is an attempt to enter multiple times, which is exactly what the controls are designed to catch — and those controls key on payment method, shipping address, account age, purchase history and device profile as much as on address. Distributing across addresses changes the least significant of those while leaving the rest correlated.
Where a release is genuinely first-come-first-served, speed does matter. Even then, the constraint is more often the queue system and the account signals than the number of addresses available.
The Jobs That Are Actually Legitimate
Narrower than the search volume implies, and worth doing well.
Regional availability and pricing research. Foot Locker operates separate storefronts by country — the .com and .co.uk domains behave differently, as their robots.txt files demonstrate — with different catalogues, prices and release calendars. Comparing them requires a viewpoint in each, and that is a genuine proxy use case. It is also low volume and touches only product and category pages, which the UK robots.txt does not disallow.
Resale market analysis. Secondary marketplaces are entirely different sites with their own terms, and several offer APIs or tolerate modest research use. Understanding what a release trades at across markets is ordinary market research and does not involve the retailer at all.
Brand and counterfeit monitoring. If you work for a rights holder, tracking where product appears across regional marketplaces is a real job with a real reason to need regional viewpoints.
Ad and campaign verification. Checking that your own advertising is delivered in the regions you paid for. You are inspecting your own spend.
Notice the shape: low volume, publicly visible pages, geography as the actual requirement, and — in two of four cases — not touching the retailer's site at all.
Proxy Types for Those Jobs
| Job | Type | Why |
|---|---|---|
| Regional pricing and availability | Residential | The point is to see what an ordinary visitor in that country sees |
| Release calendar monitoring | Residential | Same, and the pages are region-specific |
| Resale marketplace research | Datacentre first | Cheaper; escalate only if actually blocked |
| Ad verification | Residential | Delivery decisions are made on consumer-network signals |
Residential where the answer depends on looking like a consumer somewhere specific. Datacentre where you simply need requests distributed against a tolerant target, at a fraction of the cost.
Two technical realities regardless of type. These sites are client-rendered, so your fetching layer needs to handle JavaScript, which multiplies bandwidth by roughly an order of magnitude. And geolocation must be verified by outcome — if a page fetched through a German exit shows the same prices as your desk, the targeting is not landing where it matters, whatever an IP lookup reports.
Doing the Regional Research Properly
Since regional comparison is the one job here that genuinely warrants proxies, it is worth doing well rather than approximately.
Set locale and time zone alongside the proxy. A German exit address paired with en-US language headers and a London time zone is a combination no real visitor produces, and many retail sites use locale independently of address to decide what to serve. Configure all three together or you are testing something other than what you intended:
const context = await browser.newContext({
proxy: { server: proxyFor("DE") },
locale: "de-DE",
timezoneId: "Europe/Berlin",
});
Verify by content, not by IP lookup. Take the page and look at it. If a capture through a German exit shows the same currency and the same prices as your desk, the targeting is not landing regardless of what any lookup service reports. Screenshots are unusually good at catching this because a human sees it instantly.
Compare like with like. Regional storefronts differ in more than price — catalogue, sizing conventions, availability and release timing all vary. A price difference that looks dramatic may be a different product, or the same product in a different size run. Match on a manufacturer code rather than on a product name.
Watch the frequency, because it drives the cost. Checking eight regional pages every fifteen minutes is roughly 3,000 requests a day; hourly is 200. For a release calendar that changes weekly, hourly is already generous, and the difference is a factor of fifteen on your bandwidth bill. Frequency, not coverage, is what costs money.
Skip the browser where you can. If the data you need appears in the initial HTML or in a JSON payload the page fetches, a plain HTTP request costs a fraction of a rendered page. Check the network tab before assuming you need to render — this is the single largest saving available in any proxy-metered workload.
And record what you collected and when. Regional pricing research is only useful as a time series, and a dataset without timestamps and source regions is a snapshot you cannot compare against anything.
What We Charge, and When Not to Buy
From our pricing page, checked September 2026.
Residential traffic starts at $0.79/GB, falling to $0.50/GB above 100 GB and $0.27/GB above 1 TB. Datacentre starts at $0.14/GB, billed by traffic rather than per IP. New accounts receive 1 TB of residential traffic free. ISP addresses are $1.25/IP.
Now the reasons not to buy:
If you want to automate purchases or draw entries, we are not your vendor. The mechanism does not work as advertised, the site is behind active protection, and the transactional paths are disallowed in the site's own robots.txt.
If your monitoring is low frequency, the free tier covers you. Checking a handful of regional pages a few times a day is a few gigabytes a month. Use the trial and never pay us anything — that is a legitimate outcome.
If your workload is concentrated — high volume through few addresses — we are the expensive option. Per-IP pricing fits that shape and we do not offer it for residential. Buy from someone who does.
If your usage is bursty around release cycles, our traffic expiry will cost you. Unused traffic does not carry over month to month, and release monitoring is seasonal by nature. Look for a provider whose traffic does not expire.
If you have not built the monitoring yet, do not buy bandwidth. Build against a small sample and buy for measured volume.
What Actually Improves Your Odds
Since the technical route is both obstructed and less effective than advertised, here is what is left. None of it is our business and none of it requires buying anything.
Account history matters. Where retailers allocate exclusive access, they do it on engagement and purchase history rather than on speed. An account used normally over time is in a different category from one created for a release.
Enter every draw you are eligible for. Because draws are randomised, participation is the variable you control. Entering more draws legitimately improves expected outcomes; entering one draw more times does not.
Widen beyond the flagship. Regional storefronts, local retailers, boutique stockists and physical store raffles frequently allocate the same product with far smaller entry pools. A local raffle with two hundred entrants offers better odds than a global draw, and it costs nothing but attention.
Get the administrative details right. Payment method saved and valid, shipping address correct, notifications enabled, the app updated. A meaningful share of failed entries are administrative rather than competitive.
And run the resale numbers before building anything. For anyone approaching this commercially, the spread on most releases is thinner than the discourse suggests once fees, shipping, returns and holding time are counted. A plan that only works at scale usually also only works if nothing goes wrong.
People Also Ask
Do proxies help you buy limited releases at Foot Locker?
Not in the way people expect. The US site is behind Cloudflare bot protection, whose detection is built on request features, header ordering and JavaScript signals rather than on the client address. Where releases are allocated by draw, more addresses is not a speed advantage either.
Does Foot Locker have a robots.txt?
The US domain returns a 404 — there is no file, which under RFC 9309 means no crawler restrictions from that source. The UK domain does have one, last modified in July 2025, and it disallows the cart, checkout, account and payment paths for all crawlers.
Is scraping Foot Locker allowed?
The UK robots.txt explicitly disallows the transactional paths while leaving product pages open, and the US site is behind Cloudflare protection. Terms of service apply independently of both. robots.txt is not authorisation — the RFC says so directly — and this is not legal advice.
What are Foot Locker proxies used for legitimately?
Comparing regional pricing, availability and release calendars, which genuinely differ between country storefronts and can only be seen from a viewpoint in each. Also resale marketplace research and brand monitoring, both of which happen on entirely different sites.
Will a residential proxy get me past Cloudflare?
Only if address reputation was specifically why you were flagged. Cloudflare's own description of its bot score covers machine learning on request features, heuristics, header-order rules and JavaScript detections — none of which change with your address. Anyone promising otherwise is overselling.
How many proxies do I need for release monitoring?
Fewer than most people buy. For regional checks, one working exit per region is usually enough, because frequency rather than address count drives everything. Measure where rate limiting actually starts on your targets and size from that.
Are sneaker bots illegal?
Automated purchasing generally breaches retailer terms, which is contractual rather than criminal in most places, and enforcement is typically order cancellation and account closure. Some jurisdictions have legislated in adjacent areas such as event ticketing. This varies and is not legal advice.
Why does my scraper get a 200 response with no useful data?
You may have reached a tarpit rather than a block. Cloudflare's AI Labyrinth serves crawlers coherent generated content that is simply irrelevant to the site, so everything succeeds while you collect nothing. It is designed to cost you more than it costs them.
Wrapping Up
We went to look at Foot Locker rather than repeat what other articles say, and the three findings shape the whole answer. The US domain has no robots.txt at all. The UK domain has one that disallows precisely the cart, checkout, account and payment paths. And the US storefront sits behind Cloudflare's bot protection.
That combination tells you the site is not ambiguous about automated purchasing, and the protection vendor's own documentation tells you why address rotation is not the lever people think it is — detection rests on request features, header ordering and browser signals, and an IP address changes none of them.
What remains is genuine and modest. Regional pricing, availability and release calendars really do differ between country storefronts, and seeing them really does require a viewpoint in each. The volumes involved are small, the pages concerned are not disallowed anywhere, and a free trial may well be all you ever need.
For everything else, the unglamorous advice is the effective advice: use the account, enter every eligible draw, look beyond the flagship retailer, and get the administrative details right. None of that is something we can sell you, which is rather the point.