401 Unauthorized
- Means
- Log in first
- Usually comes from
- The website
403 Forbidden is the HTTP status code a server returns when it understood the request but refuses to fulfil it. Unlike a 401, logging in will not help: the server has decided this client, IP or request is not allowed.
RFC 9110 defines 403 as a refusal that new credentials won't fix. Servers use it for real permission rules, such as a private folder, and anti-bot and firewall systems use it to block traffic they don't trust. Many return a 404 instead, to avoid revealing that a page exists.
When a request works without the proxy but returns 403 through it, the site is reacting to something about the proxied request. Find out which.
Look at the response, not just the code. A body that names a CDN or security vendor, or headers such as server: cloudflare with a cf-ray ID, mean the site's edge blocked you. A failure while opening the tunnel means the proxy refused.
If the site blocks hosting ranges, consumer IPs help: CleanProxies rotating residential proxies in 190+ countries and static ISP proxies on US carrier networks. Respect sites that refuse automated access, and read the proxy errors guide for the other codes.
curl -sv -o /dev/null \
-x http://USERNAME:PASSWORD@HOST:PORT \
https://example.com 2>&1 \
| grep -Ei '^< (HTTP|server|cf-ray)|CONNECT'The CleanProxies proxy that fits best here, with a $4.99 trial to test it first.
Rotating or sticky residential IPs in 190+ countries, with data that never expires.
Residential IPs in 190+ countries with country, state and city targeting. Rotate on every request or hold a sticky session for up to 24 hours; GB never expire.
Setup guides and best practices from the CleanProxies blog.
Terms that come up alongside 403 Forbidden.
Straight answers about 403 Forbidden.
The server understood your request and refuses to serve it. It is a permission or policy decision, not a technical failure.