Proxy Error Codes Explained: 407, 403, 429 and What to Do

When a request through a proxy fails, the status code tells you which side broke — the proxy or the target site. Getting that distinction right saves hours, because the fixes point in opposite directions.

407 Proxy Authentication Required

The proxy rejected you. Your credentials never arrived, or they were wrong. The target site was never contacted.

This is the most common proxy error and almost always a client-side mistake:

• Credentials omitted. Some HTTP clients drop the userinfo part of a URL. Pass them explicitly instead of embedding them.
• Special characters unescaped. A password containing @, : or / breaks http://user:pass@host:port parsing. URL-encode it: @ becomes %40.
• Wrong auth method. If the proxy is set to IP authentication, sending a username and password may be rejected outright. Check which mode the proxy is in.
• Your IP changed. With IP-based authentication, a new home IP address means you are no longer on the allowlist.

Test authentication in isolation:

curl -x http://USER:PASS@HOST:PORT https://api.ipify.org

If that returns an IP address, authentication works and the problem is elsewhere.

403 Forbidden

The target site rejected you, and the proxy did its job. The request arrived; the destination refused to serve it.

Causes, in rough order of likelihood:

• The IP is flagged. Datacenter ranges are widely published and many sites block them by default. This is the single most common reason and the fix is a different proxy type, not a different proxy.
• You look like a bot. No User-Agent, no Accept-Language, a TLS fingerprint that does not match the browser you claim to be.
• Geographic blocking. The content is not served in the proxy’s country.
• Rate history. The IP was used aggressively before you got it.

If the same request succeeds from your own connection but 403s through the proxy, the IP is the problem. Move to residential or ISP proxies, which come from ranges assigned to real consumer connections and carry far more trust.

429 Too Many Requests

You went too fast. The target is rate-limiting you, and unlike 403 this is usually recoverable without changing anything about your setup except pacing.

• Honour Retry-After. If the response includes that header, it tells you exactly how long to wait. Ignoring it is how a temporary limit becomes a permanent ban.
• Back off exponentially. Retry after 1s, then 2, 4, 8. Immediate retries make things worse.
• Spread across more IPs. Rate limits are usually per-IP. Ten proxies at a modest pace beat one proxy hammering.
• Slow down overall. If you hit 429 across every IP, the limit may be per-account or per-fingerprint rather than per-IP.

See how many proxies you need for sizing this properly.

502, 503 and connection timeouts

These usually mean the proxy itself is unreachable or overloaded, not the target.

• Connection refused — wrong port. HTTP and SOCKS5 listen on different ports on the same IP. Check you are using the right one for the protocol.
• Timeout with no response — the proxy host is down, or a firewall is dropping traffic on that port.
• 502 from the proxy — the proxy reached the target and got nothing usable back. Often the target itself is failing.

A quick decision table

Code	Who rejected you	First thing to try
407	The proxy	Re-check credentials and auth mode
403	The target site	Switch to residential or ISP IPs
429	The target site	Back off, honour Retry-After, add IPs
502/503	The proxy or target	Verify host, port and protocol
Timeout	Network or proxy	Check port and firewall

The pattern worth internalising

4xx codes starting with 40 tell you who said no. A 407 is the proxy talking to you. A 403 is the destination talking to you through the proxy. Once you know which conversation failed, the fix is usually obvious — and you stop rotating IPs to solve authentication problems, which is the most common wasted afternoon in this work.

If you are seeing 403s consistently on a target that matters, the proxy type is almost certainly wrong. Our pricing page lists what each type costs, and ISP proxies are the usual answer when datacenter IPs get refused.