Common Proxy Errors and How to Fix Them

Start by asking: proxy or target?

Every proxy error comes from one of two places: the proxy (your connection to it, your authentication, or its connection onward) or the target website (blocking or rate-limiting you). The fastest way to tell is to run the same request through curl -v and see whether the error happens at the CONNECT stage or after. See curl proxy.

Error reference

407 in depth

1. Typos and spaces in username or password.
2. Special characters not URL-encoded (@ → %40, : → %3A, # → %23).
3. The client isn't sending credentials (Chrome's --proxy-server flag ignores them).
4. Your plan has expired or run out of traffic.
5. You're using a whitelisting port with credentials or vice versa.
6. Your public IP changed and isn't whitelisted.

See proxy authentication methods and Puppeteer proxy authentication. Our Puppeteer proxies guide covers the full setup.

Connection refused vs timeout

• Refused: something actively rejected the connection: wrong port, nothing listening, or a protocol mismatch (HTTP to a SOCKS port).
• Timeout: packets aren't getting through: firewall, wrong IP, or the proxy is down.

nc -vz gate.example.com 7777

403 and 429: it's the target

The proxy is working; the target doesn't like the request. Fixes:

• Use a more trusted IP type. See residential vs datacenter proxies.
• Slow down per domain. See rate limiting and proxies.
• Fix headers and TLS fingerprints. See browser fingerprinting and proxies.
• Rotate to a fresh IP after a block.

See avoiding IP bans when scraping.

502/504: exit node problems

With residential and mobile proxies, exit devices can be slow or drop. Retry with a new session ID. If errors persist in one country or ASN, try broader targeting or contact the provider.

SSL errors

• If you use a web unblocker that re-encrypts traffic, install the provider's CA certificate or disable verification for that client only.
• If you see certificate errors through an ordinary proxy, be suspicious: something may be intercepting your traffic.

Language-specific gotchas

• Python requests: dict keys must be "http" and "https"; install requests[socks] for SOCKS. See Python requests proxies.
• Node axios: use https-proxy-agent with proxy: false for HTTPS targets. See Node.js proxies.
• curl: lowercase http_proxy only. See curl proxy.
• Selenium/Chrome: no credentials in the flag. See Selenium proxies.

A step-by-step diagnostic flow

1. Can you reach the proxy? nc -vz host port. If not: host, port, firewall.
2. Does authentication work? curl -v -x ... https://api.ipify.org. A 407 means credentials or whitelist.
3. Does a simple HTTPS site work? If not: CONNECT blocked or provider restriction.
4. Does your target work? If not: target blocking; check IP type, rate and fingerprint.
5. Does it work in curl but not your code? Library configuration issue.

The exact messages, by tool

Error text varies by tool, which makes searching for help harder. Here's how the most common problems actually appear:

Two tips make any of these faster to solve:

1. Reproduce with curl -v. If curl shows the same failure with the same proxy, the problem is the proxy or your network, not your code.
2. Copy the full message when asking for help, with the tool and version. "It doesn't work" can't be searched; (56) CONNECT tunnel failed, response 407 can.

For credentials problems in depth, see proxy authentication methods. For language specifics, see Python requests proxies and Node.js proxies, and for curl itself, curl proxy.

If errors persist on every setting, the IPs themselves may be the problem. Compare providers in our guide to the best proxies in 2026, or try residential proxies if 403 blocks dominate.

Webshare users can follow Webshare Proxy Not Working? How to Fix the Most Common Errors for a step-by-step version of this, including plan sizing and common errors.

If you're weighing Rayobyte as well, Rayobyte Troubleshooting explains which of its products fits, and Rayobyte vs Geonode vs Webshare puts it side by side with Geonode and Webshare.

FAQ

How do I know if the proxy or the website is blocking me?

If the error occurs before the tunnel is established (407, connection refused, tunnel failed), it's the proxy. If you get a response from the site (403, 429, CAPTCHA), it's the target.

Why do errors happen only at certain times?

Residential pools fluctuate with time zones, and targets may tighten protection at peak times.

Sources and further reading

Independent references that back up the points above, from standards bodies, governments, universities and non-profits. They open in a new tab.

• 403 Forbidden (MDN Web Docs (Mozilla)): What a 403 Forbidden response means.
• RFC 6585: Additional HTTP Status Codes (429 Too Many Requests) (IETF / RFC Editor): Defines status 429, the code sites send when you make too many requests.
• Retry-After header (MDN Web Docs (Mozilla)): The header that tells clients how long to wait before retrying.
• RFC 7617: The Basic HTTP Authentication Scheme (IETF / RFC Editor): The scheme most proxy providers use for username and password authentication.
• RFC 1929: Username/Password Authentication for SOCKS V5 (IETF / RFC Editor): How SOCKS5 proxies check a username and password.