Proxy Status Codes

Understand proxy error responses and how to tell whether a request failed at the proxy or at the destination website.

Proxy error responses identify failures that occur while processing or forwarding a request. Use the HTTP status code and the Proxy-Status response header to distinguish proxy-generated errors from responses returned by the destination server.

For SOCKS5 connections, inspect the protocol reply codes instead of HTTP status codes or headers.

Response Format

The following response fields provide status information:

FieldLocationPurpose
HTTP status codeStatus lineIdentifies the response category. Common proxy errors include 403, 407, 502, 503, and 504.
Proxy-Status headerResponse headersIdentifies the reporting proxy and error type, following RFC 9209.

For example:

HTTP/1.1 504 Gateway Timeout
Proxy-Status: mrscraper; error=connection_timeout

This response indicates that the proxy gateway could not connect to the destination website through a proxy exit IP within the allowed time.

Identifying the Response Source

HTTP/1.1 200 Connection Established
  • Source: MrScraper proxy — success.
  • Meaning: The HTTPS CONNECT tunnel is open. This is the proxy's confirmation, not the target website's response.
HTTP/1.1 502 Bad Gateway
Proxy-Status: mrscraper; error=connection_terminated
Content-Type: text/plain; charset=utf-8

Bad Gateway
  • Source: MrScraper proxy — failure.
  • Meaning: The mrscraper; error=... entry identifies a proxy-classified failure. Here, the connection closed or reset before the proxy could complete the response.
HTTP/1.1 200 OK
Content-Type: text/html

<html><body>The requested page.</body></html>
  • Source: Target website — success.
  • Meaning: The target returned the requested page, which the proxy relayed to the client.
HTTP/1.1 403 Forbidden
Content-Type: text/html

<html><body>Access denied by the target website.</body></html>
  • Source: Target website — failure.
  • Meaning: The target rejected the request. The proxy relayed its response rather than generating a proxy error.

The target-response examples show typical forwarded responses. Body content and the absence of a mrscraper error entry alone do not prove target origin: some proxy-generated failures can also lack that entry.

HTTPS CONNECT Responses

HTTPS connections through the proxy begin with a CONNECT request. Before tunnel establishment, the proxy generates the response:

Statuserror=What it means
200NoneConnection Established — the tunnel is open. Subsequent encrypted traffic cannot include a proxy-generated status header.
403http_request_denied_by_policyThe request was blocked by policy.
407NoneClient authentication or account access was rejected.
502dns_errorA hostname needed to complete the request could not be resolved.
502connection_terminatedThe connection closed or reset before the tunnel could be established.
502NoneThe proxy gateway could not open the connection. No more specific error code is available.
503destination_unavailableNo suitable proxy exit IP is available, or the selected proxy exit IP cannot reach the destination website.
504connection_timeoutThe proxy gateway could not connect to the destination website through a proxy exit IP within the allowed time.
504connection_read_timeoutWaiting for connection data timed out before the tunnel could be established.
504connection_write_timeoutSending data required to establish the tunnel timed out.
504http_response_timeoutThe proxy timed out waiting for a response while establishing the tunnel.

A CONNECT failure does not return the destination server's application error page because the tunnel has not been established. After 200 Connection Established, the proxy cannot inspect encrypted application traffic or send a replacement HTTP error. Certificate validation failures, authentication pages, and application errors within the tunnel cannot be reported through Proxy-Status. Later transport failures close the connection instead.

destination_unavailable means no suitable proxy exit IP is available to complete your request, or the selected proxy exit IP cannot reach the destination website. It does not necessarily mean the website is down. Try again after a short delay or broaden your location targeting.

SOCKS5

If you use SOCKS5, your proxy client reports SOCKS5 reply codes instead of HTTP status codes. Check your client's error message or logs for the code, then use the tables below to find the next step.

Errors can occur when your client signs in or when it asks the proxy to connect to a website. Check which step failed: the same code can mean different things at each step.

Sign-In Responses

During sign-in, your client first agrees on an authentication method with the proxy gateway, then sends credentials if required.

ReplyWhat it meansClient action
0x00Sign-in succeeded after your client sent a username and password.Continue with the request.
0x02The proxy gateway selected username/password authentication.Send credentials.
0xFFYour client did not offer a supported authentication method.Enable username/password authentication.
0x01The proxy gateway rejected sign-in after your client sent credentials.Check your username, password, and account access before retrying.

SOCKS5 Connection Responses

After sign-in, your client asks the proxy to connect to the destination website. The proxy returns a code indicating whether that request was accepted or why it failed. Some clients label this code REP, which means “reply.”

Codes are shown in hexadecimal, a number format commonly used in client logs. For example, 0x04 is code 4. 0x00 means the request was accepted; other values indicate an error.

Reply code (REP)NameWhat it meansClient action
0x00SucceededThe request was accepted. For hostname requests, the tunnel is established. For IP-address requests, connection establishment may still be in progress.Start application traffic. A later failure can close the connection without another reply.
0x02Connection not allowed by rulesetDestination policy, account restrictions, or request-stage authentication rejected the request. BIND is also denied.Resolve the restriction before retrying.
0x03Network unreachableA network needed to establish the requested connection could not be reached. This does not establish that the destination network is unreachable.Retry a limited number of times with backoff.
0x04Host unreachableThe proxy could not connect. Possible causes include an unavailable proxy exit IP, a connection timeout, or a website address that could not be resolved. This code alone does not mean the website is down.Check the hostname and targeting options. Retry transient failures with bounded backoff.

You may also see these client errors:

CodeWhat it meansWhat to do
0x05 — Connection refusedThe proxy gateway encountered a refused connection while connecting through a proxy exit IP.Follow the same steps as for 0x04.
0x07 — Command not supportedYour client used an unsupported SOCKS5 command or HTTP-only scraper credentials.Check your client's SOCKS5 settings and use residential proxy credentials.
0x08 — Address type not supportedYour client sent an unsupported destination address format.Configure your client to use an IPv4 address, IPv6 address, or domain name.

Retry a few times, waiting longer after each attempt. Avoid retrying requests that could cause duplicate actions. The website may have already processed the first request.

Plain HTTP Responses

For unencrypted HTTP requests, the proxy can return the following errors before sending response headers to the client. Classified failures include a mrscraper; error=... entry in Proxy-Status.

Statuserror=What it means
403http_request_denied_by_policyThe request was blocked by policy.
407NoneClient authentication or account access was rejected.
502dns_errorA hostname needed to complete the request could not be resolved.
502connection_terminatedThe connection closed or reset before response headers could be sent to the client.
502NoneThe proxy gateway could not complete the request. No more specific error code is available.
503destination_unavailableNo suitable proxy exit IP is available, or the selected proxy exit IP cannot reach the destination website.
504connection_timeoutThe proxy gateway could not connect to the destination website through a proxy exit IP within the allowed time.
504connection_read_timeoutWaiting for response data timed out before response headers could be sent to the client.
504connection_write_timeoutSending request data timed out before the response could start.
504http_response_timeoutWaiting for the response to start timed out.

Once HTTP response headers have been sent, a later read timeout or connection termination cannot replace the response with a new 502, 504, or Proxy-Status header. The client observes a truncated response or a closed connection instead.

When to Retry

For temporary connection failures, limit the number of retries and wait progressively longer between attempts. Add a small random delay to avoid sending all retries at once.

HTTP and HTTPS CONNECT

The following guidance applies to plain HTTP responses and HTTPS CONNECT responses before the tunnel opens.

ResponseClient retry guidance
Proxy-generated 403Do not retry the identical request automatically. Resolve the policy restriction or change the destination.
407Do not retry unchanged credentials indefinitely. Check credentials and account access. If those are correct and the rejection persists, contact support.
Proxy-generated 502Retry a limited number of times for transient connection failures, including connection_terminated or an unclassified failure. If errors persist, check the destination and targeting options, then contact support.
Proxy-generated 503Retry with backoff if availability may recover. If no proxy exit IP matches your location targeting, broaden the targeting instead of repeatedly sending the identical request.
Proxy-generated 504Retry with backoff. A proxy timeout does not prove that the destination did not receive or process the request.
A destination response, including 403, 429, or 5xxFollow the destination's retry policy and any Retry-After header. Do not treat it as a proxy failure solely because of the HTTP status.
Connection closure after CONNECT success or a truncated HTTP responseReconnect and retry only if replaying the application request is safe. There may be no replacement HTTP error or proxy status header.

SOCKS5

Check whether the code occurred during sign-in or while connecting to the destination.

ResponseClient retry guidance
Sign-in rejected (0x01) or no supported authentication method (0xFF)Check your username, password, account access, and client authentication settings before retrying.
Connection not allowed (0x02)Resolve the destination or account restriction before retrying.
Network unreachable (0x03), host unreachable (0x04), or connection refused (0x05)Retry a limited number of times with increasing delays. If errors persist, check the destination and location targeting, then contact support.
Unsupported command (0x07) or address type (0x08)Correct your client settings before retrying.
Connection closes after a successful reply (0x00)Reconnect and retry only if the application request is safe to repeat. The destination may already have received it.

Only replay requests that are safe to repeat, such as idempotent operations or requests protected by an application-supported idempotency key. Ensure request bodies can be replayed. If the response was lost after the destination processed a request, retrying a non-idempotent operation can duplicate its effects.

On this page