Proxy Error 407 and Other Proxy Errors: Causes and Fixes

Every request through a proxy has two legs: from you to the proxy, and from the proxy to the website. An error can come from either side, and the fix depends on which. The quickest way to tell them apart:

A simple test: request a plain IP echo service through the proxy. If that works and only your target fails, the proxy is fine and the problem is the target's reaction to your traffic.

curl -v -x http://login:[email protected]:8000 https://api.ipify.org

A 407 response is the proxy's way of saying "who are you?". It comes with a Proxy-Authenticate header, typically Basic realm=..., and the client is expected to retry with a Proxy-Authorization header. In curl it usually shows up as Received HTTP code 407 from proxy after CONNECT; in Python requests as ProxyError ... Tunnel connection failed: 407 Proxy Authentication Required.

Causes and fixes

1. 01

   Copy the credentials again

   Logins and passwords are case sensitive. Copy them from the order page, check for trailing spaces and line breaks, and make sure login and password did not swap places when the string was split.

2. 02

   Encode special characters

   If the password contains @, :, /, # or %, it breaks the login:password@host:port URL format. URL-encode it (@ becomes %40, : becomes %3A) or pass credentials separately, for example with curl's -U login:password.

3. 03

   Check the authorization method

   If the proxy uses an IP allowlist instead of a login, it answers 407 to any address that is not on the list. Your IP changes when you switch networks or turn on a VPN. Add the new address or switch to login and password.

4. 04

   Check the expiry date

   An expired rental usually fails authentication. Confirm the proxy is still active.

5. 05

   Check the client supports proxy auth

   Chrome's --proxy-server flag ignores credentials in the URL, and Chromium does not support username and password for SOCKS5 at all. Use the app's own auth field, an extension, an IP allowlist or a local forwarder.

from urllib.parse import quote

login = 'user123'
password = quote('p@ss:word#1', safe='')   # 'p%40ss%3Aword%231'
proxy = f'http://{login}:{password}@203.0.113.10:8000'

These errors mean you never had a working conversation with the proxy. In Chrome and Edge they appear as ERR_PROXY_CONNECTION_FAILED or ERR_SOCKS_CONNECTION_FAILED; in curl as error (7) Failed to connect or (28) Connection timed out.

• Refused instantly: the host is reachable but nothing listens on that port. Check the port number in your order.
• Reset or empty reply: something answered, but in a different protocol. Speaking HTTP to a SOCKS5 port or SOCKS5 to an HTTP port looks exactly like this.
• Timed out: wrong host, the proxy is down, or a firewall, antivirus or corporate network on your side blocks outgoing connections to that port. Try from another network such as mobile data to rule out your side.
• Could not resolve proxy (curl error 5): a typo in the hostname or an invisible character copied with it.

# as HTTP
curl -v -x http://login:[email protected]:8000 https://api.ipify.org

# as SOCKS5 with DNS on the proxy side
curl -v -x socks5h://login:[email protected]:8000 https://api.ipify.org

If one works and the other does not, you have found a protocol mismatch. Many providers issue separate ports for HTTP and SOCKS5. The differences between the two are explained in what is a SOCKS5 proxy.

To open an HTTPS site, the browser asks an HTTP proxy to create a tunnel with CONNECT host:443. ERR_TUNNEL_CONNECTION_FAILED means the proxy did not return 200 Connection established. Typical reasons:

• Authentication failed during CONNECT (a 407 hidden behind the generic message).
• The proxy could not reach the target host or port, or does not allow CONNECT to that port.
• An IPv6-only proxy was asked to reach a site that has no IPv6 address; see IPv4 vs IPv6 proxies.
• Antivirus or a corporate filter on your machine intercepts HTTPS and breaks the tunnel.

Test with curl -v and look at the line after CONNECT: it shows the exact status the proxy returned, which the browser hides.

These are gateway errors: the proxy accepted your request but could not get a valid response from the next hop. With rotating residential and mobile pools, the next hop is often a home or carrier connection that just went offline.

import time, random, requests

PROXY = 'http://login:[email protected]:8000'

def get(url, tries=4):
    for i in range(tries):
        try:
            r = requests.get(url, proxies={'http': PROXY, 'https': PROXY}, timeout=20)
            if r.status_code in (502, 503, 504, 429):
                raise requests.HTTPError(r.status_code)
            return r
        except (requests.ConnectionError, requests.Timeout, requests.HTTPError):
            time.sleep(2 ** i + random.random())
    raise RuntimeError('proxy request failed: ' + url)

When you get 403 or 429 from the target, the proxy has done its job: your request arrived. The site decided it does not like the source. Three things decide that: the IP and its network type, the request rate, and how much your client looks like a real browser.

Pool size and rotation strategy are covered in how many proxies do I need and rotating vs static proxies.

Browser automation has its own quirks with authentication. Ready code for each framework is in proxies for Selenium, Playwright and Puppeteer, and antidetect tools are covered in the antidetect browser proxy setup.

1. 1Validate the proxy line in the free proxy checker: it parses ip:port:login:password, login:password@ip:port and URL formats and flags broken lines.
2. 2Run one curl -v request to an IP echo service. Note the exact error.
3. 3If you see 407: credentials, special characters, allowlist, expiry.
4. 4If the connection fails: port, protocol, firewall. Try both http:// and socks5h://.
5. 5If the proxy works but the target fails: rate, headers, IP type. Test the target in a browser through the same proxy.
6. 6Only then change app settings, and compare them with the working curl command.