403 Forbidden
The server understood the request and refused it. In scraping it usually means the address class was rejected before anything else was considered.
A 403 is a refusal, not an error. The request arrived, was understood and was declined, which is why retrying it unchanged returns the same answer forever.
The timing tells you almost everything. A 403 on the very first request, before any volume, is a decision about who you appear to be: most often that the address belongs to a hosting range. A 403 that appears after hundreds of successful requests is about what you did, and is closer in spirit to a rate limit than to a block.
That distinction decides the fix. The first case is solved by changing address class, from datacenter to residential, and no amount of pacing helps. The second is solved by slowing down or spreading across more addresses, and changing address class is money spent on the wrong problem.
A 403 is also the code sites reach for when they mean something else. Some return it instead of a 429, some when a consent banner was not handled, some when a required header is missing. Before concluding anything, read the body: a real refusal is usually short, while a challenge page is large and full of scripts.
What the server decided, and when
The status itself carries no reason. Servers use 403 for address class, for missing authentication that is not worth a 401, for geographic restrictions, for a failed bot check and sometimes simply for a request that arrived without headers a browser would send.
What narrows it down is position in the sequence. First request refused: identity. Refused after volume: behaviour. Refused only on some paths: authorisation. Refused only from some countries: geography.
The response body is the second signal. A one-line refusal comes from a rule; a full HTML page with scripts is a challenge, and a challenge is not the same thing as a block even though both arrive as 403.
What to change, in order
The ladder is short and each step is cheap to test:
Narrowing a 403
# 1. is it the address class? try residential on the same target
curl -o /dev/null -s -w "%{http_code}\n" -x login:password@YOUR-DC-IP:50100 https://target.example/
curl -o /dev/null -s -w "%{http_code}\n" -x login_c_US:password@proxy.sotaproxy.com:10000 https://target.example/
# 2. is it headers? send a real language header
curl -o /dev/null -s -w "%{http_code}\n" -H "Accept-Language: en-US" -x login_c_US:password@proxy.sotaproxy.com:10000 https://target.example/
# 3. is it a challenge rather than a refusal? look at the size
curl -s -x login_c_US:password@proxy.sotaproxy.com:10000 https://target.example/ | wc -c- A 403 on the first request from a datacenter address is the most common single result in this business, and it is not a sign of anything being wrong with your setup.
- If residential also returns 403 immediately, the problem is not address class. Look at headers, cookies and whether scripts need to run.
- Log 403 separately from 429 and from timeouts. Merging them produces a blocking rate that overstates the problem.
What a 403 is not
It is not a ban on you personally
Nothing has been recorded about your account. A range was declined, and a different range is served normally a second later.
It is not solved by rotating faster
If every address in a class is refused, cycling through more of them refuses faster.
It is not always a 403
Some sites answer a rate limit with 403 and some answer a block with 429. The code is a hint, the sequence is the evidence.
A challenge page is not a refusal
A large HTML body with scripts means the site wants something executed, not that it decided against you.
Términos relacionados
Ver esto en práctica
¿Listo para usar 403 forbidden?
SotaProxy te da acceso a proxies residenciales rotativos, móviles, de centro de datos e ISP. Sin compromiso mínimo.
Empezar