407 or 403: find out who answered

A 407 always comes from the proxy. A 403 can come from the proxy or from the website behind it, and the fix depends entirely on which. Finding out takes one command, so run it before you change anything.

Who answered?

Run curl verbosely and keep only the status lines:

curl -sv -x http://HOST:PORT -U "USERNAME:PASSWORD" https://api.ipify.org 2>&1 | grep "^< HTTP"

For an HTTPS target, the proxy speaks first: HTTP/1.1 200 Connection established means it opened the tunnel. Anything after that line is the website talking.

• A 403 or 407 before any Connection established line came from the proxy.
• A 403 after it came from the website.

The proxy refused you

A 407 means the proxy wanted credentials it did not get or did not accept. A 403 that arrives before any Connection established line means the proxy understood the request and still said no. Either way, work down the list:

1. Username and password match the proxy's Connection card character for character, with no stray space or line break.
2. Special characters are percent-encoded when the credentials sit inside a URL: @ as %40, : as %3A. Or pass them with -U as above.
3. The host you connect to belongs to the proxy whose credentials you copied.
4. Your client really sends them. Some send nothing until challenged, so one 407 followed by a success is normal.
5. The proxy is not set to IP allowlist, which switches its credentials off. See Using an IP allowlist instead of credentials.
6. If you use the allowlist on purpose, the public IP you connect from is on it.
7. The proxy shows Active on its page, not Expired or Cancelled.
8. It has bandwidth left, if its plan has a cap: the Capacity card shows it.

A 403 from the website

The tunnel opened, so the proxy did its part and the site is turning down that exit or that request. Slow down, send headers the way a real browser would, or use a different exit: another IP on ISP or datacenter. If it keeps happening, A site is blocking your proxy: what we need to see lists what to send us.

Still unclear? Email support@proxyhive.io with the curl -v output and the password replaced by REDACTED.