# Proxy error reference for scrapers

> Proxy error reference for scrapers: 407, 403, 429, 502, 503, 504, tunnel, TLS, timeout and SOCKS5 errors, who sends each one and the fix.

- URL: https://crawlrelay.com/docs/errors/
- Last updated: 2026-10-13
- Publisher: CrawlRelay (https://crawlrelay.com)

Every page answers the same four questions: who sent the error, what it looks like in your tool, why it happened, and whether a retry can help.

**Quick answer — How do I find out why a proxied request failed?**

First find out **who** answered: the proxy gateway (407, CONNECT failures, some 502 and 504), the website (401, 403, 429, most 503), or your own client (TLS and timeout errors). Then match the exact message to a page below. This reference covers 15 errors that scrapers meet with **CrawlRelay** residential proxies or any HTTP or SOCKS5 proxy, with code to fix each one.

## Which error am I looking at?

Find your symptom, then open the page for the full diagnosis.

| Symptom | Sent by | Retry? | Page |
| --- | --- | --- | --- |
| `407`, 'Tunnel connection failed: 407' | Proxy | No | [407 Proxy Authentication Required](https://crawlrelay.com/docs/errors/407-proxy-authentication-required/) |
| `401` with `WWW-Authenticate` | Website | No | [401 vs 407](https://crawlrelay.com/docs/errors/401-unauthorized/) |
| `403` page or firewall message | Website | Once, then stop | [403 Forbidden](https://crawlrelay.com/docs/errors/403-forbidden/) |
| `429`, often with `Retry-After` | Website | Yes, later | [429 Too Many Requests](https://crawlrelay.com/docs/errors/429-too-many-requests/) |
| `502`, 'CONNECT tunnel failed, response 502' | Proxy or CDN | Yes, new exit | [502 Bad Gateway](https://crawlrelay.com/docs/errors/502-bad-gateway/) |
| `503`, maintenance or challenge page | Website or CDN | Yes, with backoff | [503 Service Unavailable](https://crawlrelay.com/docs/errors/503-service-unavailable/) |
| `504` | Proxy or CDN | Once or twice | [504 Gateway Timeout](https://crawlrelay.com/docs/errors/504-gateway-timeout/) |
| `net::ERR_TUNNEL_CONNECTION_FAILED` | Browser (proxy refused CONNECT) | After fixing the cause | [ERR_TUNNEL_CONNECTION_FAILED](https://crawlrelay.com/docs/errors/err-tunnel-connection-failed/) |
| `net::ERR_PROXY_CONNECTION_FAILED` | Browser (proxy unreachable) | No | [ERR_PROXY_CONNECTION_FAILED](https://crawlrelay.com/docs/errors/err-proxy-connection-failed/) |
| `ProxyError: Unable to connect to proxy` | Python client | Depends on the cause | [Cannot connect to proxy](https://crawlrelay.com/docs/errors/cannot-connect-to-proxy/) |
| `[SSL: WRONG_VERSION_NUMBER]` | Your TLS library | No | [SSL: WRONG_VERSION_NUMBER](https://crawlrelay.com/docs/errors/ssl-wrong-version-number/) |
| `CERTIFICATE_VERIFY_FAILED` | Your TLS library | No | [Certificate verify failed](https://crawlrelay.com/docs/errors/ssl-certificate-verify-failed/) |
| `ReadTimeout`, 'Read timed out' | Your client | Yes, new exit | [Read timed out](https://crawlrelay.com/docs/errors/read-timeout/) |
| `ECONNRESET`, 'socket hang up', 'Connection reset by peer' | Network | Yes, safe requests | [Connection reset](https://crawlrelay.com/docs/errors/connection-reset/) |
| 'Missing dependencies for SOCKS support', curl error 97 | Client or SOCKS server | Depends | [SOCKS5 errors](https://crawlrelay.com/docs/errors/socks5-proxy-errors/) |

## All errors by type

- [401 Unauthorized vs 407](https://crawlrelay.com/docs/errors/401-unauthorized/)
- [403 Forbidden](https://crawlrelay.com/docs/errors/403-forbidden/)
- [407 Proxy Authentication Required](https://crawlrelay.com/docs/errors/407-proxy-authentication-required/)
- [429 Too Many Requests](https://crawlrelay.com/docs/errors/429-too-many-requests/)
- [502 Bad Gateway](https://crawlrelay.com/docs/errors/502-bad-gateway/)
- [503 Service Unavailable](https://crawlrelay.com/docs/errors/503-service-unavailable/)
- [504 Gateway Timeout](https://crawlrelay.com/docs/errors/504-gateway-timeout/)
- [Cannot connect to proxy (ProxyError)](https://crawlrelay.com/docs/errors/cannot-connect-to-proxy/)
- [Connection reset by peer (ECONNRESET)](https://crawlrelay.com/docs/errors/connection-reset/)
- [ERR_PROXY_CONNECTION_FAILED](https://crawlrelay.com/docs/errors/err-proxy-connection-failed/)
- [ERR_TUNNEL_CONNECTION_FAILED](https://crawlrelay.com/docs/errors/err-tunnel-connection-failed/)
- [Read timed out (ReadTimeout)](https://crawlrelay.com/docs/errors/read-timeout/)
- [SOCKS5 proxy errors](https://crawlrelay.com/docs/errors/socks5-proxy-errors/)
- [SSL: CERTIFICATE_VERIFY_FAILED](https://crawlrelay.com/docs/errors/ssl-certificate-verify-failed/)
- [SSL: WRONG_VERSION_NUMBER](https://crawlrelay.com/docs/errors/ssl-wrong-version-number/)

## Which errors should a scraper retry automatically?

Retry what can change on its own, and stop on what cannot:

- **Retry with a new connection:** 502, 504, connection resets and read timeouts. A new connection usually gets a different residential exit.
- **Retry later, slower:** 429 and 503. Wait for `Retry-After` or back off exponentially with jitter, and lower concurrency on that host.
- **Retry once, then stop:** 403. One retry on a new IP separates a flagged address from a site rule.
- **Never retry blindly:** 407, 401, TLS errors and unreachable proxies. They are configuration problems.

The [Python guide](https://crawlrelay.com/docs/python/) shows a retry policy that follows these rules with urllib3's `Retry`.

## How do I log errors so they are easy to debug?

Log five fields for every failed request: the URL's host, the status code or exception class, the session ID if any, the time to first byte, and the first 200 characters of the response body. The body tells you whether a CDN, a firewall or the proxy wrote the error page. Count errors per host and per status every minute: a jump on one host means that site changed something; a jump on every host means your setup or your network did.

## Error reference: questions

### How can I tell if an error comes from the proxy or from the website?

Look at where it happened. Errors during the CONNECT step, shown by curl `-v` before any TLS handshake, come from the proxy: 407, or a 502 or 504 on CONNECT. Statuses that arrive after the TLS handshake, with the site's headers and HTML, come from the website. Client errors such as timeouts and TLS failures come from your own code or network.

### Are failed requests billed?

Traffic is counted in bytes moved through the gateway, so an error response that never reached a website, such as a 407, moves almost nothing. A block page from a website is a normal response and has a size like any other page. Cut both by fixing configuration errors early and slowing down on 403 and 429.

### What is a normal error rate for a scraper using residential proxies?

It depends on the targets. Proxyway's 2026 research measured a median success rate of 99.28% on residential proxy networks but 74.43% on protected real targets such as Amazon, Google and Instagram. Measure your own targets and track the rate over time: a sudden change matters more than the absolute number.

---

CrawlRelay: CrawlRelay is a developer-first rotating residential and 4G/5G mobile proxy service for scrapers and AI data pipelines: non-expiring pay-as-you-go traffic from $0.50/GB, paid in crypto, with no ID upload. No KYC — no ID, no selfie, no documents. Pay in crypto.