403 Forbidden through a proxy: the site, or the proxy?
A 403 through a proxy can come from two places, and the fix is different for each. Most often the site you asked for refused the request: the standard says the server “understood the request but refuses to fulfill it” (RFC 9110, section 15.5.4), and with a proxy that usually means it does not trust the address or the way the request looks. Less often, the proxy itself refused to open the site for you. One curl command tells you which.
Proxy error · Last revised Oct 20, 2026
On this page
Find out who sent it
curl -s -o /dev/null -x "http://USERNAME:[email protected]:8000" \
-w "proxy %{http_connect} site %{http_code}\n" https://the-site-you-need.com/pageOn our test proxy (Oct 19, 2026), the two cases printed:
proxy 200 site 403 the proxy connected you; the site refused
proxy 403 site 000 the proxy refused to connect you to that siteThis split works for https:// addresses, which go through the proxy as a tunnel. For a plain http:// address the proxy forwards the request itself, so curl prints proxy 000 and the 403 could be from either; test with the https:// version of the page.
When the site sent it (proxy 200, site 403)
- Compare without the proxy. Request the same page from your own connection. If it is also 403 there, the page is closed to everyone and no proxy will open it.
- The address type is the signal. Many sites refuse datacenter addresses outright and accept residential or mobile ones. If a datacenter plan gets 403 and the site matters to your job, a residential plan is what changes the answer; residential vs datacenter prices the difference.
- The request looks like a script. A missing or default user agent, no
Accept-Language, or many requests from one session are refused by many sites whatever the address. Send the headers a browser sends, at a browser’s pace. - The address has a poor reputation. A shared IP carries what its other users did with it. A dedicated or freshly rotated IP tells you whether reputation was the cause (proxy IP reputation).
- The page is for one country. Some sites refuse visitors from outside the countries they sell in. Set the proxy’s country to the site’s own market.
The standard also says a client “SHOULD NOT automatically repeat the request with the same credentials”. The same goes for the same address and the same request: an unchanged retry gets the same 403.
When the proxy sent it (proxy 403)
The provider does not allow that site on your plan. Providers restrict some targets (banks, government sites, some social networks), and some open them only after an identity check. The provider’s dashboard or terms list which. Ask its support with the exact address; switching IPs on the same plan will not help.
What a run of 403s costs
On a plan billed by the GB, a refusal is still traffic: the block page travels through the proxy like any other page, and unless your provider’s terms say failed requests are free, you pay for it.
What failed responses cost: on a plan billed by the GB, a refused or blocked page is traffic too, unless your provider's terms say failed requests are free. 1,000 of them at about 100 KB each are 0.1 GB, about $0.07 at today's cheapest residential rate for 50 GB (Geonode, $0.69 a GB, the cheapest of 55 plans checked up to Oct 24, 2026). A retry loop that runs all night, 10 requests a second for 8 hours, is 288,000 of them: 28.8 GB, about $19.96. Price your own amount →
Related
A 403 that turns up after many fast requests is often a rate limit in disguise: see 429 Too Many Requests. A page that loads with 200 but shows a block or a captcha is covered in 200 OK but blocked.
Price it for your amount
Today's checkout totals, every billing type competing. Change the amount to recalculate.
Geonode
$34.65Residential monthly subscription · Monthly
Checked Oct 24, 2026 · $0.69 per GB used
Buy at Geonode →GB and IP packages use separate amounts and billing units.