How to Fix Proxy Errors: 407, 403, 429, Timeouts and SSL

Most proxy errors come from one of five causes: wrong or missing credentials (407), the target site refusing the request (403), sending requests too fast (429), a slow or unreachable route (timeouts, 502/504), or TLS set up wrong (SSL errors). Read the status code first. It tells you whether the problem is your setup, the proxy or the website, and that decides the fix. This guide covers each error with the cause, a quick test and the fix, plus copy-paste curl and Python checks.

If you're paying for proxies and spending hours on errors, the proxy is often part of the problem. Shared, recycled IPs with a bad history get 403s and CAPTCHAs on the first request. CleanProxies ISP proxies are 100% dedicated, 0-fraud-score IPs on Tier-1 US carrier ASNs, from $0.75/IP, so you can spend that time on your project.

TL;DR

• 407 Proxy Authentication Required: the proxy rejected your login. Check the username, password, port and auth mode (user:pass or IP whitelist). This one is always on your side and always fixable.

• 403 Forbidden: the website refused you. Usually it's IP reputation, a mismatched browser fingerprint or blocked access. Use clean dedicated IPs and send realistic headers.

• 429 Too Many Requests: you're too fast for that site. Slow down, honour Retry-After, spread load across more IPs and use backoff.

• Timeouts / 502 / 504: the route is slow or the upstream didn't answer. Test the proxy on its own, raise timeouts sensibly and pick low-latency IPs close to the target.

• SSL errors: wrong proxy scheme (https:// vs http://), an intercepting tool, or outdated CA certificates.

• The quickest win: start with clean IPs. CleanProxies ISP proxies run on 100Gbps ports with <20ms latency and 99.9% uptime, which removes most 403s and timeouts before you start debugging. Test 5 IPs for an hour with the $4.99 trial.

Proxy errors at a glance

Key stats: why sites refuse proxy traffic

• 51% of all web traffic in 2024 was automated, the first time in a decade bots passed humans, according to the Imperva 2025 Bad Bot Report.

• 37% of all internet traffic came from bad bots, up from 32% the year before (Imperva). That's why websites score every IP and limit request rates hard.

• 429 has its own status code and a Retry-After header that tells you exactly how long to wait (RFC 6585, section 4).

• 407 means the proxy itself wants credentials, sent in the Proxy-Authorization header, which is different from a website login (RFC 9110, section 15.5.8).

Because most traffic is automated, websites now decide fast: an IP with a bad history gets a 403 or a CAPTCHA right away, and a clean one gets the page. IP quality decides most outcomes before your code even matters. More on that in why clean IP quality matters.

Step zero: isolate the problem in 60 seconds

Before changing anything, find out which part is failing. Run one request through the proxy to a neutral endpoint:

curl -v -x http://USERNAME:PASSWORD@HOST:PORT https://api.ipify.org

• You get an IP back that matches your proxy: the proxy works. The problem is the target site (403/429) or your code.

• 407 or CONNECT tunnel failed, response 407: credentials or auth mode. Go to the 407 section.

• Hangs at Trying HOST:PORT...: network path or wrong host/port. Go to timeouts.

• SSL / certificate errors: go to the SSL section.

Then run the same request against your real target. If ipify works and the target returns 403 or 429, the proxy is fine and the site is pushing back. You can also paste your proxy list into the free CleanProxies proxy checker to test many at once, and confirm the exit IP with What is my IP.

How to fix 407 Proxy Authentication Required

A 407 comes from the proxy server, not the website. The proxy needs to know who you are and didn't accept what you sent. It's the easiest error to fix because everything is under your control.

Causes, most common first:

1. Typo or stale credentials. A copied trailing space, a regenerated password, or credentials from a different order.

2. Wrong auth mode. You whitelisted your IP but your request still sends user:pass (usually fine), or you use user:pass while the proxy is set to IP-only and your current IP isn't whitelisted.

3. Your public IP changed. Home and office IPs change. If you use IP whitelisting, a new ISP lease breaks every request.

4. Special characters not URL-encoded. A password with @, :, # or / inside a proxy URL breaks parsing. Encode it (@ becomes %40) or pass credentials separately.

5. The tool drops credentials on HTTPS. Some clients send credentials to plain HTTP but not inside the CONNECT tunnel. You see CONNECT tunnel failed, response 407.

6. Wrong port or protocol. Sending HTTP to a SOCKS5 port (or the reverse) can look like an auth failure.

Fix checklist:

• Re-copy host, port, username and password from your dashboard. Check the auth type set on that proxy list.

• If you use IP auth, check your current public IP on What is my IP and update the whitelist.

• URL-encode special characters, or use your client's separate auth option:

import requests
from urllib.parse import quote

user = "USERNAME"
password = quote("p@ss:word", safe="")  # encode special characters
proxy = f"http://{user}:{password}@HOST:PORT"

r = requests.get("https://api.ipify.org", proxies={"http": proxy, "https": proxy}, timeout=(10, 30))
print(r.status_code, r.text)

• Match the scheme to the port: http:// for HTTP proxies, socks5h:// for SOCKS5 (needs pip install requests[socks]). Not sure which you need? See SOCKS5 vs HTTP proxies.

• In an antidetect browser, put credentials in the proxy fields, not inside the host box. Our setup guides for AdsPower, Multilogin and GoLogin show each field.

On CleanProxies you can switch an ISP proxy list between IP:Port (whitelist), User:Pass and SOCKS5 from the proxy manager, and the new format is ready right away. If you're still stuck, 24/7 support will check the order with you.

How to fix 403 Forbidden through a proxy

A 403 means you reached the website and it chose to refuse you. The proxy did its job. Status codes are defined in RFC 9110, section 15.5.4: the server understood the request but won't fulfil it.

Why sites send 403 to proxy users:

• IP reputation. The IP is in a datacenter range, on a blocklist, or was abused by its previous user. Shared and recycled pools are the usual cause.

• Mismatched fingerprint. A US IP with a German timezone, a headless browser user agent, or a default python-requests/2.x user agent stands out right away.

• Geo rules. Some content is only served to certain countries or states.

• Account or permission rules. Sometimes the page really is private and needs a logged-in session you're allowed to use.

Fix checklist:

1. Check the IP's reputation. Run it through our DNSBL blacklist checker and IP lookup to see the ASN and whether it's listed. A datacenter ASN on a consumer site is a common 403 trigger.

2. Use a real ISP IP. ISP proxies are registered to consumer carriers, so sites see them as normal home connections. CleanProxies ISP IPs come from Tier-1 US carrier ASNs with a 0 fraud score, and they're 100% dedicated, so no one else's traffic damages them. Background: what is a static residential proxy.

3. Send realistic headers. Set a current browser User-Agent, Accept-Language and Accept. Check what you're sending with the user agent checker.

4. Keep the profile consistent. Match timezone, language and WebRTC to the IP's location. The WebRTC leak test shows if your real IP leaks around the proxy.

5. Keep one IP per account. Rotating IPs inside one logged-in session looks like account sharing. Use a static ISP IP or a sticky session (rotating vs sticky sessions).

6. Respect the site's rules. If a page needs a login you don't have or the site's terms forbid automated access, a different IP isn't the answer. Use an official API or get permission.

How to fix 429 Too Many Requests

A 429 is the site's rate limiter saying you're too fast. It's defined in RFC 6585, and servers often include a Retry-After header with the number of seconds to wait. The fix is to behave like a polite client, not to push harder.

Fix checklist:

• Read and honour Retry-After. If it's there, wait that long before the next request from that IP.

• Use exponential backoff with jitter for retries instead of instant re-sends:

import random, time, requests

def get_with_backoff(url, proxies, max_tries=5):
    for attempt in range(max_tries):
        r = requests.get(url, proxies=proxies, timeout=(10, 30))
        if r.status_code != 429:
            return r
        wait = int(r.headers.get("Retry-After", 0)) or min(60, 2 ** attempt)
        time.sleep(wait + random.uniform(0, 1))
    return r

• Lower concurrency per IP. A few requests per second per IP is a sane starting point for most sites. Measure, then raise slowly.

• Spread the load. With more IPs, each one sends fewer requests. CleanProxies includes unlimited bandwidth and threads on ISP proxies, and ISP pricing starts at $0.75/IP, so adding IPs is cheap. For large, varied crawls, rotating residential proxies from $0.63/GB rotate across 50M+ IPs.

• Cache and dedupe. Don't fetch the same page twice in a run, and skip pages that haven't changed.

• Check robots.txt and the site's terms. Stay within published crawl rates.

For a full rate-limiting setup for price tracking, see proxies for Amazon sellers and price monitoring.

How to fix proxy timeouts, 502 and 504 errors

Timeouts come in two kinds, and they need different fixes:

Fix checklist:

• Set separate connect and read timeouts. In Python timeout=(10, 30) means 10 s to connect and 30 s to read. A single short timeout causes false failures on heavy pages.

• Measure where time goes. curl -w breaks a request into steps:

curl -s -o /dev/null -x http://USERNAME:PASSWORD@HOST:PORT \
  -w "connect: %{time_connect}s  tls: %{time_appconnect}s  first byte: %{time_starttransfer}s  total: %{time_total}s\n" \
  https://www.example.com

A slow connect points at the proxy route. A slow first byte with fast connect points at the target site.

• Check the network behind the proxy. Oversold proxy servers on shared 1Gbps links slow down at peak hours. CleanProxies runs on 100Gbps network ports with <20ms latency and 99.9% uptime, so slow responses on our IPs nearly always come from the target, not the route.

• Pick IPs close to the target. US targets with US IPs. CleanProxies' ISP IPs are all in the United States.

• Don't hide errors behind endless retries. Log the error type per IP so you can drop a bad one instead of retrying it forever.

For a structured way to benchmark speed before you commit, use our proxy quality testing guide.

How to fix SSL and certificate errors with proxies

SSL errors through a proxy are almost always configuration, not the proxy.

• https:// in the proxy URL. Most HTTP proxies take a plain http:// connection and then tunnel HTTPS with CONNECT. Writing https://HOST:PORT makes your client attempt TLS to the proxy itself, which fails with wrong version number or similar. Use http://HOST:PORT for the proxy, even for https:// targets.

• Outdated CA certificates. Old Docker images and servers ship stale CA bundles. Update ca-certificates (Debian/Ubuntu) or pip install -U certifi.

• An intercepting tool in the middle. Debugging proxies, antivirus "web shields" and corporate firewalls swap certificates. Either trust their CA properly or turn them off while testing.

• Clock skew. A server clock that's days off makes valid certificates look expired. Sync with NTP.

• Don't switch verification off in production. verify=False hides the real problem and exposes your traffic. Fix the cause instead.

Other errors you'll see

• ERR_TUNNEL_CONNECTION_FAILED (Chrome): the browser couldn't open the CONNECT tunnel. Usually credentials or port, so treat it as a 407.

• ERR_PROXY_CONNECTION_FAILED: Chrome can't reach the proxy host at all. Check host, port and that your network allows outbound connections.

• SOCKS5 authentication failed / general SOCKS server failure: wrong credentials, or HTTP sent to a SOCKS port. In Python use socks5h:// so DNS resolves through the proxy.

• CAPTCHA on every page: not an error code, but the same cause as a 403. The IP's reputation is low. Clean, dedicated ISP IPs are the lasting fix.

• Different IP than expected: your tool isn't using the proxy for every request (WebRTC, DNS or a system proxy setting). Check with the WebRTC leak test.

What the numbers mean for your setup

With more than half of web traffic automated and over a third of it malicious, sites don't give unknown IPs the benefit of the doubt. In practice:

• 407 and SSL errors are setup problems. Fix them once and they stay fixed.

• Timeouts are usually infrastructure. The proxy provider's network capacity and route length matter more than your code.

• 403s and 429s are reputation and behaviour problems. Good pacing handles 429. Clean IPs handle most 403s. Neither can be fully fixed by code alone if the IPs are already burned.

So two of the five error families depend on which proxy you buy.

Which proxies cause the fewest errors

For most users who keep hitting 403s, timeouts and CAPTCHAs, the answer is to move to CleanProxies ISP proxies: static US IPs registered to Tier-1 carriers, never shared, with unlimited bandwidth and threads and instant delivery. Need many IPs from one range? ISP subnet proxies start at $1.19/IP. Comparing providers? Our compare hub and the best ISP proxy providers ranking cover the market.

Testing checklist before you scale

1. Run the curl -v ipify test on 3–5 proxies. All should return the proxy IP.

2. Check each IP's ASN with IP lookup and listings with the blacklist checker.

3. Send 20 requests to your real target at your planned pace. Count 200s, 403s, 429s and timeouts.

4. Log time_connect and time_starttransfer to separate route speed from site speed.

5. Run the WebRTC leak test in your browser profile.

6. Scale only when the error rate stays flat as you add load.

7. Try it on CleanProxies first: the $4.99 trial gives you 5 ISP IPs for 1 hour, or 100 MB of residential traffic. Start the trial.

CleanProxies pricing

• ISP proxies: from $0.75/IP, the cheapest pricing on the market for dedicated US ISP IPs. See ISP proxies

• ISP subnet (/24) proxies: from $1.19/IP. See ISP subnets

• Rotating residential: from $0.63/GB, data never expires. See residential

• Mobile 4G/5G: from $0.79/GB. See mobile proxies

Every plan includes instant delivery, 99.9% uptime and 24/7 support.

Stop debugging bad IPs. View pricing · Get ISP proxies · Check your current proxies free

Frequently Asked Questions

Team CleanProxies

Proxy Infrastructure Team

Share