Proxy tier benchmark › Targets

Does the Virginia Department of Health Professions site need a proxy?

Professional licensing boards · minimum viable tier: no proxy needed · measured 2026-08-18

Not for the page that was measured. dhp.virginia.gov/ returned the expected content on 60 of 60 requests — 100% on every one of the six configurations, including unproxied. The licence lookup itself was not measured: the path recorded in the target list timed out during reconnaissance. Measured 2026-08-18.

What was measured
URL https://www.dhp.virginia.gov/
Content assertion Health Professions
Arms 6
Rounds per arm 10
Requests 60
Measured 2026-08-18, 15:38–18:09 UTC
Benchmark host DigitalOcean droplet, New York (nyc3)

A request counts as a success only if the expected content is present. An HTTP 200 carrying a challenge page, an empty body or the wrong page is a failure, because it is not a page you can use.

This measures whether a tier works, not long-run stability under sustained load. Ten requests per arm, at a two-second floor, never approach a per-IP rate limit — which is the thing a rotating pool exists to defeat.

Results by arm

Arm Success p50 p95 Bytes per success Outcomes
direct (no proxy) 100% 162 ms 173 ms 26,534 success 10
datacenter, one pinned exit 100% 551 ms 3,209 ms 26,534 success 10
datacenter, rotating exit 100% 860 ms 3,078 ms 26,534 success 10
anti-detect, one pinned exit 100% 1,403 ms 3,798 ms 26,534 success 10
anti-detect, rotating exit 100% 1,280 ms 4,069 ms 26,534 success 10
residential, rotating exit 100% 1,971 ms 2,459 ms 26,534 success 10

What protects this target

Nothing, on the homepage. A clean sweep: no challenge, no 403, no soft block, no transport error in 60 requests, with the fastest median in the licensing group at 162 ms unproxied.

And a signal the benchmark then declined to follow. The intended URL was dhp.virginia.gov/lookup/. The reconnaissance probe recorded a ConnectTimeout against it after 30 seconds, so the site root was substituted. A connection accepted and never answered is the tarpit signature that PROTECTION-CENSUS.md flags on five other state hosts, and it is exactly the behaviour that a status-code-only measurement records as nothing at all.

So the honest reading of this page is: the department's homepage is undefended, and the one observation the study holds about the lookup endpoint is a 30-second timeout that was never followed up.

robots.txt status

The URL measured is allowed by the host's robots.txt.
Status allowed
File https://www.dhp.virginia.gov/robots.txt
Crawl-delay not declared
Fetched as the benchmark's own User-Agent
Note robots.txt 1000 bytes via benchmark_ua

Limits of this result

  • The URL measured is the department homepage. The licence lookup path timed out during reconnaissance and was excluded from the run, so this result says nothing about licence data collection.
  • Ten rounds per arm in a single three-hour window on 2026-08-18. Anti-bot behaviour drifts; a result older than a few months is a historical record, not a current one.
  • One exit geography. Every request left from a US datacenter host or a US exit, so nothing here describes how this target answers traffic from elsewhere.
  • The unproxied arm ran from a clean, previously unused cloud IP with no accumulated reputation. It is a best case a production scraper will not sustain.

Run date: 2026-08-18 · Full benchmark report · Harness and raw data · All 32 targets

The 60 rows behind this page are in results/six-arm/raw.csv; filter them with grep '^[^,]*,us_va_dhp_lookup,' raw.csv.

Test your own target

The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.

Test your target See plans