# Proxy checker says working but sites don't load > A proxy checker can pass while sites fail, because most test plain HTTP and the browser needs a CONNECT tunnel. Exit and stability are separate answers too. Source: https://mosaicbrowser.com/blog/proxy-checker-says-working ## A green tick that means the socket opened is worthless A proxy checker can pass while sites fail, because most test plain HTTP and the browser needs a CONNECT tunnel. Exit and stability are separate answers too. ![Exit, tunnel and stability are three answers, beside a screenshot: a proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/covers/proxy-checker-says-working.webp) When a proxy checker says working and sites don't load, look at what the checker sent. Most send one `GET` for a plain `http://` page and go green if any bytes come back. Almost nothing you browse is plain HTTP now. For an `https://` address the browser asks an HTTP proxy for a `CONNECT` tunnel instead, and plenty of gateways answer the `GET` and turn the `CONNECT` down. We ran into this writing the check Mosaic runs before it opens a profile. It ended up as three questions rather than one: where the proxy exits, whether it tunnels, and whether it stays put. They break separately, and one green tick can't say which of them did. ## Why a proxy can pass a check and still load nothing Through a proxy, plain HTTP is a single line, `GET http://example.com/ HTTP/1.1`. The proxy fetches the page itself and passes it back, and since it reads the whole request it is free to rewrite it, log it or refuse it. HTTPS takes another route. The browser sends `CONNECT www.example.com:443 HTTP/1.1` and waits. Only after a `200` does it start TLS, inside a socket the proxy now just copies bytes through, so the page itself stays invisible to the proxy. That second request is where gateways differ. One refuses `CONNECT` outright, another allows it on some ports only, a third answers 4xx because its exit couldn't reach the target. A checker that only ever sent `GET` goes green for all three. ([A proxy that answers HTTP and refuses CONNECT](https://mosaicbrowser.com/blog/proxy-http-works-https-fails) walks through that one case with curl.) Our check goes the browser's way instead. It asks the proxy for a tunnel to `www.cloudflare.com:443`, completes a real TLS handshake inside it and requests `/cdn-cgi/trace`. If a proxy that answered plain HTTP turns the tunnel down, the result quotes the status code back: "The proxy answered plain HTTP but refused CONNECT (403). Profiles behind it will not load HTTPS sites." We spelled it out because "proxy down" sends people hunting for a network fault they don't have. Chrome's grey [ERR_TUNNEL_CONNECTION_FAILED page](https://mosaicbrowser.com/blog/err-tunnel-connection-failed) is the same refusal with the proxy's reason dropped. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## Where does it exit? The address you connect to is the gateway. The address a site sees is the exit, and the two can sit in different countries. A plan called "Germany" is a request to the seller, not a measurement. We read the exit from outside, with a location lookup made through the proxy, and record the IP, country, city, ISP and timezone it reports. That matters more for a browser profile than for a scraper, because the profile's timezone, languages and geolocation are drawn from that exit. Believe the label instead and you get a browser that says Berlin while its packets leave from somewhere else. ## Does it hold still? The tunnel probe has a second use. Cloudflare's trace reports the address and country it saw, so one check gets two readings of the exit: one over plain HTTP from the lookup, one over TLS from Cloudflare. If they disagree, the endpoint is rotating. Rotation is a legitimate product and a poor home for an account. One rotating endpoint we measured answered Peru, Brazil and Bahrain in three consecutive requests. A profile behind it claims one timezone and browses from several countries an hour. The check marks that as rotating rather than failed: the proxy works, and it is the wrong kind for that job. Comparing two readings has its own trap, and we fell into it. A dual-stack residential exit sent the HTTP lookup over IPv4 and the TLS request over IPv6, and plain string comparison called a sticky session a pool three checks in a row. Only two addresses of the same family can show movement. [Two IP addresses, one exit](https://mosaicbrowser.com/blog/two-ip-addresses-one-exit) has the full case. ## One failure from a residential pool is not a verdict A residential pool hands out a dead exit some of the time. The gateway answers something like `400 Target website error` and the next attempt is fine. Going red on the first of those reports a working proxy as broken, which is the same mistake as trusting one run of a third-party detector. So a transport failure is retried, and the result says how many attempts it took. Where the proxy comes from a provider, the retry asks for a new session rather than repeating the old one. We watched one session answer 504 four times running while fresh sessions on the same gateway answered 200, and three tries on one token is one try with a longer wait. Some answers are final and are never retried: rejected credentials, a refused `CONNECT`, a rotating port refusing a `-session-` token. Retrying a refusal three times turns an instant, readable answer into a forty-second wait for the same sentence. ## What else rides along with the check Two more readings come from the same open connection, and neither can fail the check. One asks which DNS resolver the exit node uses. On one US residential session the exit was Verizon and the resolvers were Google's, in Germany and the Netherlands, which a scanner can read as a mismatch. The other is the exit's reputation, scored only once there is an address, because an exit on a blocklist can lose an account before the fingerprint is even looked at. A resolver we could not read leaves those fields empty rather than reporting agreement. "We did not find out" and "they agree" are different answers. ![A proxy check in Mosaic: exit address, location, latency, tunnel and reputation](https://mosaicbrowser.com/shots/proxy-check.png) *One check, several separate answers* ## The order to test in, by hand or in Mosaic 1. Fetch an `https://` address through the proxy, so the tunnel is part of the test. 2. Read where it exits, from a lookup made through the proxy. 3. Check it twice and compare addresses of the same family. 4. Retry a timeout before you blame the proxy; read a refusal's words. The curl commands for each step, plus the browser-side leak checks, are in [how to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it). Mosaic's check does the first three in one pass, runs before every launch, and won't open a profile behind a proxy that has not answered and tunnelled. If the proxy comes from a [provider account](https://mosaicbrowser.com/features/proxy-providers), each profile mints its own session, so a dead exit costs that profile a fresh session instead of a red row. ## Questions ### Why does a proxy checker say my proxy works when websites don't load? The checker most likely sent one plain-HTTP request and stopped there. To reach any https:// site a browser asks an HTTP proxy for a CONNECT tunnel, and a gateway can serve the first request and refuse the second. ### How do I test whether a proxy tunnels HTTPS? Ask for an https:// page through it: curl -x http://USER:PASS@HOST:PORT https://www.cloudflare.com/cdn-cgi/trace. An ip= line in the reply means the tunnel opened, and that line is also the exit address Cloudflare saw. ### Is a rotating proxy broken if two checks show different IPs? No. Rotating means a new exit per connection, and that is what the seller is selling. It suits scraping better than an account somebody logs in to every day, because the profile's timezone and language describe one place. ### Should I throw away a proxy that failed one check? Not after one failure. Residential pools hand out a dead exit now and then, and the next session usually works. A refusal with a reason in it, such as rejected credentials or a refused CONNECT, is different: it will say the same thing every time, so read it. ## Related [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [What ERR_TUNNEL_CONNECTION_FAILED is telling you](https://mosaicbrowser.com/blog/err-tunnel-connection-failed): Chrome's tunnel connection failed error means the proxy refused the CONNECT tunnel. In our runs the usual cause was a sticky session the gateway had retired. [IPv4 from one probe, IPv6 from the other: one exit, not two](https://mosaicbrowser.com/blog/two-ip-addresses-one-exit): A proxy that shows an IPv4 address on one checker and an IPv6 address on another is usually one dual-stack exit. Rotation only shows within one family. [What an expiring sticky session looks like from inside a browser](https://mosaicbrowser.com/blog/sticky-session-expiry-symptoms): A sticky session expired on our proxy: the browser showed tunnel errors, the check a healthy proxy in another state. Neither said expired. [Provider accounts: one gateway line, one exit per profile](https://mosaicbrowser.com/features/proxy-providers): Paste your proxy seller's gateway line once and Mosaic mints a separate session for every profile, so each one browses from its own exit address.    ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.