Proxy Error 407, 403, 502 and Timeouts: Causes and Fixes

When a proxy fails, it usually tells you why in a three-digit code, and the code points at the fix. Browsers show these in friendlier words, such as ERR_PROXY_CONNECTION_FAILED or ERR_TUNNEL_CONNECTION_FAILED, but the cause is the same. Run the failing proxy through the proxy checker first, because it shows the exact code the proxy returns.

407 Proxy Authentication Required

The proxy wants a username and password and either did not get them or did not accept them. This is the most common error with paid proxies.

• Check for typos and for extra spaces copied from a dashboard.
• Use the right username format. Many providers build targeting into the username, such as a country or a session ID, so the plain account name is not enough. Copy the full string the dashboard generates.
• Encode special characters when you use the user:password@host:port form. An @ in a password becomes %40 and a colon becomes %3A, otherwise the address is split in the wrong place.
• Check the authentication method. If the provider authenticates by IP address instead of by password, requests from any other address are refused. Add your current public IP in the provider's dashboard. Our IP checker shows it.
• Check the plan. An expired plan, used-up traffic, or a product that was never activated (for example residential access on an account that only has datacenter proxies) can look like a login failure.

403 Forbidden

The proxy understood you and refused. Typical causes are an IP address that is not on the allow-list, a destination the provider restricts, or an account that has not completed a verification step the provider requires for certain sites. Try an ordinary destination first. If that works, the block is specific to your target, and you should ask the provider whether that site is allowed on your plan.

502 Bad Gateway and 504 Gateway Timeout

The proxy accepted your request but could not get an answer from the next hop. On residential and mobile networks the exit device may have gone offline, so retrying, which usually picks a new exit, often works. If every request fails, the provider may have an outage, or your chosen location may have no available IPs at that moment.

429 Too Many Requests

Either the provider or the website is rate limiting you. Slow down, spread requests across more IPs, or use a rotating pool instead of a single address. If the checker shows 429 only when you test a specific website, the website is the one limiting you.

Timeouts and connection refused

• Connection refused means nothing is listening on that host and port. Re-check both, and check whether SOCKS5 uses a different port from HTTP.
• Timeout means packets are being dropped. The proxy may be offline, or a firewall in between may block the port. Test the port from another network, and see our guide to checking if a port is open.
• The server closes the connection without answering often means you chose the wrong protocol. Try SOCKS5 if you tried HTTP, or the other way round. HTTP vs SOCKS5 explains the difference.

TLS and certificate errors

If the tunnel opens but the secure connection to the website fails, the proxy may be intercepting HTTPS traffic with its own certificate. That is normal for some corporate proxies and a red flag for a proxy you bought, because it means the operator could read what you send.

A quick way to narrow it down

Run the same proxy in the checker and in cURL, then change one thing at a time: the protocol, the port, the credentials, the destination. The first change that turns a failure into a success is your answer. If nothing helps, send your provider the exact code and the time you saw it.