403 Forbidden through a proxy: find out who refused

Most likely first.

1. The website refused this request. Sites refuse requests that do not look like their usual visitors: missing or inconsistent headers, no cookies, an unusual TLS client, or a page that needs a signed-in session. This is the most common source of a 403 through a working proxy.
2. The website refuses the exit's network. Many sites score addresses by network type and history. Datacenter ranges and addresses with recent abuse reports are refused more often than residential ones, and some sites refuse every range they know belongs to a proxy or VPN.
3. The exit is in a country the site does not serve. Streaming, banking, betting and some retail sites answer 403 to countries outside their market. Check where the exit actually is; IP databases often disagree about cities.
4. The proxy refused the destination. Providers refuse private and reserved addresses such as 127.0.0.1, 10.0.0.0/8 and 192.168.0.0/16, keep their own blocked lists, and sometimes refuse ports. This 403 replaces the tunnel.
5. Another proxy in between. Office and school proxies answer 403 for blocked categories, and some providers send 403 instead of 407 to an address that is not on their IP whitelist.

1. 1See which side answered

   If no 200 Connection established line appears before the 403, the proxy refused. A 200 followed by HTTP/2 403 means the website did.

   Proxy's answer, then the site'sCopy

   curl -v -x http://HOST:PORT -U "USER:PASS" https://TARGET/ -o /dev/null 2>&1 \
     | grep -iE "^(> CONNECT|< HTTP|< x-proxy-reason|\* CONNECT)"

2. 2Read the website's response

   The headers and body often name what refused you: a challenge page, a firewall reference ID or a notice about your country.

   Save the headers and bodyCopy

   curl -s -D - -o 403-body.html -x http://HOST:PORT -U "USER:PASS" https://TARGET/ | head -20

3. 3Compare without the proxy and with another exit

   If the site answers 200 directly and 403 through every exit, it refuses the proxy network or the exit's country. If only some exits get a 403, it is scoring individual addresses.

   Direct, through the proxy, and the exit's addressCopy

   curl -s -o /dev/null -w "direct: %{http_code}\n" https://TARGET/
   curl -s -o /dev/null -w "proxy: %{http_code}\n" -x http://HOST:PORT -U "USER:PASS" https://TARGET/
   curl -s -x http://HOST:PORT -U "USER:PASS" https://api.ipify.org; echo

4. 4Repeat it in a real browser

   A browser profile on the same proxy runs JavaScript and keeps cookies. If the browser loads the page and curl gets a 403, the site is refusing the shape of the request, not the address. The IP leak test inside that profile shows where the exit really is.

• A 403 from the proxy

  Check the hostname and port, use the site's public hostname instead of an internal address, and ask the provider whether the destination is on its blocked list.

• A 403 from the website

  Read the site's terms and robots.txt first: a different exit address does not make a refused request permitted. Where the access is allowed, send the headers a browser sends for that page, keep cookies across requests in one session, and request pages in the order a visitor would.

• Match the exit to the site

  Use an exit in a country the site serves, a sticky session when the site ties cookies to an IP, and residential exits where it refuses datacenter ranges. Slow down too: a 403 often follows a burst the site counted as abuse. If the site offers an API, use that.

• 403 Forbidden (RFC 9110, section 15.5.4) — IETF / RFC Editor
• CONNECT (RFC 9110, section 9.3.6) — IETF / RFC Editor
• SOCKS Protocol Version 5 (RFC 1928) — IETF / RFC Editor
• Special-Purpose IP Address Registries (RFC 6890) — IETF / RFC Editor