Cloudflare 403 Proxy Troubleshooting: Field Checklist for Data Teams

Request fails
  |
  |-- 407 Proxy Authentication Required
  |      -> credentials, username format, password, plan limit, concurrency
  |
  |-- 403 with Server: cloudflare or cf-ray header
  |      -> Cloudflare edge decision, geo mismatch, rate pattern, browser requirement
  |
  |-- 403 without Cloudflare headers
  |      -> target origin rule, account permission, path-level access control
  |
  |-- HTML contains turnstile / cf-challenge
  |      -> challenge flow; do not retry blindly with HTTP client
  |
  |-- 429 Too Many Requests
         -> rate limit; back off and lower per-target concurrency

export BF_USER="your-sub-user-loc-us"
export BF_PASS="your-password"
export BF_PROXY="http://${BF_USER}:${BF_PASS}@p1.bytesflows.com:8001"

curl -sS \
  --proxy "$BF_PROXY" \
  --connect-timeout 10 \
  --max-time 20 \
  https://httpbin.org/ip

curl -sS -D - \
  --proxy "$BF_PROXY" \
  --connect-timeout 10 \
  --max-time 20 \
  https://httpbin.org/headers \
  -o /tmp/headers.json

curl -sS -D - \
  --proxy "$BF_PROXY" \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126 Safari/537.36' \
  https://example.com/category/page \
  -o /tmp/page.html

curl -sS -D /tmp/resp.headers \
  --proxy "$BF_PROXY" \
  https://example.com/path \
  -o /tmp/resp.body

cat /tmp/resp.headers | sed -n '1,30p'

import { chromium } from 'playwright';

const proxyServer = 'http://p1.bytesflows.com:8001';
const proxyUsername = 'your-sub-user-loc-us-session-debug001-time-10';
const proxyPassword = 'your-password';

async function run() {
  const browser = await chromium.launch({
    headless: true,
    proxy: {
      server: proxyServer,
      username: proxyUsername,
      password: proxyPassword,
    },
  });

  const context = await browser.newContext({
    locale: 'en-US',
    timezoneId: 'America/New_York',
    userAgent:
      'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126 Safari/537.36',
  });

  const page = await context.newPage();
  const response = await page.goto('https://httpbin.org/headers', {
    waitUntil: 'domcontentloaded',
    timeout: 30000,
  });

  console.log({ status: response?.status(), url: page.url() });
  console.log((await page.textContent('body'))?.slice(0, 500));

  await browser.close();
}

run().catch((err) => {
  console.error(err);
  process.exit(1);
});

import asyncio
from dataclasses import dataclass, asdict
from typing import Optional
import httpx

PROXY_HOST = "p1.bytesflows.com:8001"
BASE_USER = "your-sub-user"
PASSWORD = "your-password"

@dataclass
class DiagnosticResult:
    url: str
    country: str
    status_code: Optional[int]
    server: str
    cf_ray: str
    cf_mitigated: str
    content_type: str
    body_hint: str
    error: str = ""


def build_proxy(country: str, session_id: Optional[str] = None) -> str:
    user = f"{BASE_USER}-loc-{country}"
    if session_id:
        user += f"-session-{session_id}-time-10"
    return f"http://{user}:{PASSWORD}@{PROXY_HOST}"


def classify_body(text: str) -> str:
    sample = text[:1200].lower()
    if "cf-turnstile" in sample or "cf-challenge" in sample:
        return "cloudflare_challenge_or_turnstile"
    if "captcha" in sample:
        return "captcha_or_manual_verification"
    if "access denied" in sample:
        return "access_denied_page"
    if "consent" in sample or "privacy preferences" in sample:
        return "possible_consent_or_geo_page"
    return "normal_or_unknown"


async def diagnose(url: str, country: str = "us") -> DiagnosticResult:
    proxy_url = build_proxy(country, session_id="diag001")
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126 Safari/537.36",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language": "en-US,en;q=0.9" if country == "us" else "en;q=0.8",
    }
    try:
        async with httpx.AsyncClient(proxy=proxy_url, timeout=20.0, follow_redirects=True) as client:
            resp = await client.get(url, headers=headers)
            return DiagnosticResult(
                url=str(resp.url),
                country=country,
                status_code=resp.status_code,
                server=resp.headers.get("server", ""),
                cf_ray=resp.headers.get("cf-ray", ""),
            

    cf_mitigated=resp.headers.get("cf-mitigated", ""),
                content_type=resp.headers.get("content-type", ""),
                body_hint=classify_body(resp.text),
            )
    except Exception as exc:
        return DiagnosticResult(url=url, country=country, status_code=None, server="", cf_ray="", cf_mitigated="", content_type="", body_hint="", error=str(exc))


async def main():
    for country in ["us", "gb", "de"]:
        result = await diagnose("https://httpbin.org/html", country)
        print(asdict(result))

if __name__ == "__main__":
    asyncio.run(main())

# rotating country route
your-sub-user-loc-us

# short sticky diagnostic route
your-sub-user-loc-us-session-serp-us-001-time-10

# country pages to link naturally
/locations/united-states
/locations/united-kingdom
/locations/germany
/locations/japan