Proxy Status Codes
Understand proxy error responses and how to tell whether a request failed at the proxy or at the destination website.
Proxy error responses identify failures that occur while processing or forwarding a request. Use the HTTP status code and the Proxy-Status response header to distinguish proxy-generated errors from responses returned by the destination server.
For SOCKS5 connections, inspect the protocol reply codes instead of HTTP status codes or headers.
Response Format
The following response fields provide status information:
| Field | Location | Purpose |
|---|---|---|
| HTTP status code | Status line | Identifies the response category. Common proxy errors include 403, 407, 502, 503, and 504. |
Proxy-Status header | Response headers | Identifies the reporting proxy and error type, following RFC 9209. |
For example:
HTTP/1.1 504 Gateway Timeout
Proxy-Status: mrscraper; error=connection_timeoutThis response indicates that the proxy gateway could not connect to the destination website through a proxy exit IP within the allowed time.
Identifying the Response Source
HTTP/1.1 200 Connection Established- Source: MrScraper proxy — success.
- Meaning: The HTTPS CONNECT tunnel is open. This is the proxy's confirmation, not the target website's response.
HTTP/1.1 502 Bad Gateway
Proxy-Status: mrscraper; error=connection_terminated
Content-Type: text/plain; charset=utf-8
Bad Gateway- Source: MrScraper proxy — failure.
- Meaning: The
mrscraper; error=...entry identifies a proxy-classified failure. Here, the connection closed or reset before the proxy could complete the response.
HTTP/1.1 200 OK
Content-Type: text/html
<html><body>The requested page.</body></html>- Source: Target website — success.
- Meaning: The target returned the requested page, which the proxy relayed to the client.
HTTP/1.1 403 Forbidden
Content-Type: text/html
<html><body>Access denied by the target website.</body></html>- Source: Target website — failure.
- Meaning: The target rejected the request. The proxy relayed its response rather than generating a proxy error.
The target-response examples show typical forwarded responses. Body content and the absence of a mrscraper error entry alone do not prove target origin: some proxy-generated failures can also lack that entry.
HTTPS CONNECT Responses
HTTPS connections through the proxy begin with a CONNECT request. Before tunnel establishment, the proxy generates the response:
| Status | error= | What it means |
|---|---|---|
200 | None | Connection Established — the tunnel is open. Subsequent encrypted traffic cannot include a proxy-generated status header. |
403 | http_request_denied_by_policy | The request was blocked by policy. |
407 | None | Client authentication or account access was rejected. |
502 | dns_error | A hostname needed to complete the request could not be resolved. |
502 | connection_terminated | The connection closed or reset before the tunnel could be established. |
502 | None | The proxy gateway could not open the connection. No more specific error code is available. |
503 | destination_unavailable | No suitable proxy exit IP is available, or the selected proxy exit IP cannot reach the destination website. |
504 | connection_timeout | The proxy gateway could not connect to the destination website through a proxy exit IP within the allowed time. |
504 | connection_read_timeout | Waiting for connection data timed out before the tunnel could be established. |
504 | connection_write_timeout | Sending data required to establish the tunnel timed out. |
504 | http_response_timeout | The proxy timed out waiting for a response while establishing the tunnel. |
A CONNECT failure does not return the destination server's application error page because the tunnel has not been established. After 200 Connection Established, the proxy cannot inspect encrypted application traffic or send a replacement HTTP error. Certificate validation failures, authentication pages, and application errors within the tunnel cannot be reported through Proxy-Status. Later transport failures close the connection instead.
destination_unavailable means no suitable proxy exit IP is available to complete your request, or the selected proxy exit IP cannot reach the destination website. It does not necessarily mean the website is down. Try again after a short delay or broaden your location targeting.
SOCKS5
If you use SOCKS5, your proxy client reports SOCKS5 reply codes instead of HTTP status codes. Check your client's error message or logs for the code, then use the tables below to find the next step.
Errors can occur when your client signs in or when it asks the proxy to connect to a website. Check which step failed: the same code can mean different things at each step.
Sign-In Responses
During sign-in, your client first agrees on an authentication method with the proxy gateway, then sends credentials if required.
| Reply | What it means | Client action |
|---|---|---|
0x00 | Sign-in succeeded after your client sent a username and password. | Continue with the request. |
0x02 | The proxy gateway selected username/password authentication. | Send credentials. |
0xFF | Your client did not offer a supported authentication method. | Enable username/password authentication. |
0x01 | The proxy gateway rejected sign-in after your client sent credentials. | Check your username, password, and account access before retrying. |
SOCKS5 Connection Responses
After sign-in, your client asks the proxy to connect to the destination website. The proxy returns a code indicating whether that request was accepted or why it failed. Some clients label this code REP, which means “reply.”
Codes are shown in hexadecimal, a number format commonly used in client logs. For example, 0x04 is code 4. 0x00 means the request was accepted; other values indicate an error.
Reply code (REP) | Name | What it means | Client action |
|---|---|---|---|
0x00 | Succeeded | The request was accepted. For hostname requests, the tunnel is established. For IP-address requests, connection establishment may still be in progress. | Start application traffic. A later failure can close the connection without another reply. |
0x02 | Connection not allowed by ruleset | Destination policy, account restrictions, or request-stage authentication rejected the request. BIND is also denied. | Resolve the restriction before retrying. |
0x03 | Network unreachable | A network needed to establish the requested connection could not be reached. This does not establish that the destination network is unreachable. | Retry a limited number of times with backoff. |
0x04 | Host unreachable | The proxy could not connect. Possible causes include an unavailable proxy exit IP, a connection timeout, or a website address that could not be resolved. This code alone does not mean the website is down. | Check the hostname and targeting options. Retry transient failures with bounded backoff. |
You may also see these client errors:
| Code | What it means | What to do |
|---|---|---|
0x05 — Connection refused | The proxy gateway encountered a refused connection while connecting through a proxy exit IP. | Follow the same steps as for 0x04. |
0x07 — Command not supported | Your client used an unsupported SOCKS5 command or HTTP-only scraper credentials. | Check your client's SOCKS5 settings and use residential proxy credentials. |
0x08 — Address type not supported | Your client sent an unsupported destination address format. | Configure your client to use an IPv4 address, IPv6 address, or domain name. |
Retry a few times, waiting longer after each attempt. Avoid retrying requests that could cause duplicate actions. The website may have already processed the first request.
Plain HTTP Responses
For unencrypted HTTP requests, the proxy can return the following errors before sending response headers to the client. Classified failures include a mrscraper; error=... entry in Proxy-Status.
| Status | error= | What it means |
|---|---|---|
403 | http_request_denied_by_policy | The request was blocked by policy. |
407 | None | Client authentication or account access was rejected. |
502 | dns_error | A hostname needed to complete the request could not be resolved. |
502 | connection_terminated | The connection closed or reset before response headers could be sent to the client. |
502 | None | The proxy gateway could not complete the request. No more specific error code is available. |
503 | destination_unavailable | No suitable proxy exit IP is available, or the selected proxy exit IP cannot reach the destination website. |
504 | connection_timeout | The proxy gateway could not connect to the destination website through a proxy exit IP within the allowed time. |
504 | connection_read_timeout | Waiting for response data timed out before response headers could be sent to the client. |
504 | connection_write_timeout | Sending request data timed out before the response could start. |
504 | http_response_timeout | Waiting for the response to start timed out. |
Once HTTP response headers have been sent, a later read timeout or connection termination cannot replace the response with a new 502, 504, or Proxy-Status header. The client observes a truncated response or a closed connection instead.
When to Retry
For temporary connection failures, limit the number of retries and wait progressively longer between attempts. Add a small random delay to avoid sending all retries at once.
HTTP and HTTPS CONNECT
The following guidance applies to plain HTTP responses and HTTPS CONNECT responses before the tunnel opens.
| Response | Client retry guidance |
|---|---|
Proxy-generated 403 | Do not retry the identical request automatically. Resolve the policy restriction or change the destination. |
407 | Do not retry unchanged credentials indefinitely. Check credentials and account access. If those are correct and the rejection persists, contact support. |
Proxy-generated 502 | Retry a limited number of times for transient connection failures, including connection_terminated or an unclassified failure. If errors persist, check the destination and targeting options, then contact support. |
Proxy-generated 503 | Retry with backoff if availability may recover. If no proxy exit IP matches your location targeting, broaden the targeting instead of repeatedly sending the identical request. |
Proxy-generated 504 | Retry with backoff. A proxy timeout does not prove that the destination did not receive or process the request. |
A destination response, including 403, 429, or 5xx | Follow the destination's retry policy and any Retry-After header. Do not treat it as a proxy failure solely because of the HTTP status. |
| Connection closure after CONNECT success or a truncated HTTP response | Reconnect and retry only if replaying the application request is safe. There may be no replacement HTTP error or proxy status header. |
SOCKS5
Check whether the code occurred during sign-in or while connecting to the destination.
| Response | Client retry guidance |
|---|---|
Sign-in rejected (0x01) or no supported authentication method (0xFF) | Check your username, password, account access, and client authentication settings before retrying. |
Connection not allowed (0x02) | Resolve the destination or account restriction before retrying. |
Network unreachable (0x03), host unreachable (0x04), or connection refused (0x05) | Retry a limited number of times with increasing delays. If errors persist, check the destination and location targeting, then contact support. |
Unsupported command (0x07) or address type (0x08) | Correct your client settings before retrying. |
Connection closes after a successful reply (0x00) | Reconnect and retry only if the application request is safe to repeat. The destination may already have received it. |
Only replay requests that are safe to repeat, such as idempotent operations or requests protected by an application-supported idempotency key. Ensure request bodies can be replayed. If the response was lost after the destination processed a request, retrying a non-idempotent operation can duplicate its effects.
Proxy Types
Compare Static and Rotating Residential Proxy types, understand HTTP and SOCKS5 protocol support, and learn which one to use for your workload.
Country Codes
Learn how Residential Proxy uses ISO 3166-1 alpha-2 country codes to target specific countries, with popular codes, examples, and best practices.