Data study

We Pointed Free Proxies at 21 AI Sites: Which Edges Block Them, Which Wave Them Through, and the Four Kinds of Wall

Data study: 100 free-proxy pulls against 21 AI sites. Character.AI blocked 10 of 20 working exits, Poe challenged 8, DeepSeek and Janitor blocked none, Hugging Face returned 429s, Google Flow showed geo pages.

HProxy Team··12 min read
HProxy.Data study

Skip the dead lists.

Our free proxy list re-checks every exit every few minutes across 100+ countries, with a live last-checked time, so you copy IPs that worked moments ago, not a stale text dump.

Open the free proxy list

Every "free proxies for" page on the internet, including ours, makes claims about how a site treats free proxies. On 24 August 2026 we stopped claiming and counted. We pulled 50 proxies from our own free proxy list, all verified alive minutes earlier, and sent each one to a dozen AI sites, one homepage request each. An hour later we did it again with a fresh 50 and a different dozen. The result is a table of 21 AI services, and the finding underneath it is that "do free proxies work on AI sites" is the wrong question. The right one is which of four different walls each site has built, because the answer changes completely from one domain to the next.

Method, briefly

Each run: 50 HTTP proxies from https://hproxy.com/api/proxy-list?format=txt&recent=true&protocol=http, the freshest first. Each proxy was sent a plain-HTTP control request, an HTTPS control request, and then one request for each site's homepage, with a current Chrome user agent, redirects followed, a 15-second timeout, 25 in parallel, from a home connection. The same requests were sent directly from that home connection as the baseline, and every site in the tables below returned a normal page to it.

We classified each response as reached (a 2xx or 3xx with no challenge), blocked (a 403 carrying Cloudflare's Attention Required page), challenged (Cloudflare's browser-check page, or its cf-mitigated: challenge header), rate-limited (429), geo (the site's own not-available-in-your-country text), or dead (no response within the timeout). Two sites were dropped from the tables: sora.chatgpt.com, because the Sora product was discontinued in April 2026 and the domain now serves only an export page, and meta.ai, which answered 403 to the direct baseline as well, so it rejects command-line clients regardless of address.

Run one started at 01:04 UTC and covered character.ai, chat.deepseek.com, grok.com, civitai.com, elevenlabs.io, chub.ai, spicychat.ai, crushon.ai, klingai.com, poe.com and midjourney.com. Run two started at 02:10 UTC and covered suno.com, huggingface.co, replika.com, talkie-ai.com, labs.google/flow, poe.com again, janitorai.com, openrouter.ai, aistudio.google.com, polybuzz.ai and udio.com.

Finding one: most of the free pool cannot carry HTTPS

Before any site had a say, the pool thinned itself. In each run, 31 of 50 proxies relayed the plain-HTTP control. Only 20 in the first run and 24 in the second could open an HTTPS tunnel to any site at all. Every AI service here is HTTPS-only, so between half and three fifths of a freshly verified free list was out of the test before it began.

Of 50 fresh free proxies, how many could do each thing
Answered a plain-HTTP request (run 1)
31
Could carry HTTPS anywhere (run 1)
20
Answered a plain-HTTP request (run 2)
31
Could carry HTTPS anywhere (run 2)
24
Source: HProxy measurement, 24 August 2026, two runs of 50 proxies from hproxy.com/free-proxy-list; HTTPS capability = at least one completed HTTPS request across all targets in the run

That is consistent with what the verification engine behind the list sees all year: a pool of 590K+ addresses discovered, of which only a few thousand are alive at any moment, tracked in detail in our free proxy data study. The rest of this study is about the 20, 24 and 27 that worked across the three runs.

Finding two: the sites disagree completely

Among working exits, the share turned away ranged from half to none, and the ordering has nothing to do with how famous the site is.

SiteRunWorking exitsReachedBlocked (403 page)ChallengedRate-limitedGeo pageTimed outCloudflare in front
character.ai1208100002yes
poe.com120908003yes
midjourney.com1201205003yes
poe.com2241204008yes
openrouter.ai2241822002yes
labs.google/flow2241400046no
huggingface.co2241900302no
grok.com1201502003yes
chub.ai1201420004yes
suno.com2241720005yes
udio.com2241820004no
chat.deepseek.com1201400006no
civitai.com1201800002yes
elevenlabs.io1201700003no
spicychat.ai1201600004yes
crushon.ai1201400006yes
klingai.com1201700003no
janitorai.com2242000004no
replika.com2242200002no
talkie-ai.com2242100003no
aistudio.google.com2241500009no
polybuzz.ai2241700007no

Read the top and the bottom together. Character.AI, Poe and Midjourney, the three strictest, are all Cloudflare customers that have asked Cloudflare to score addresses hard. Civitai, SpicyChat and CrushOn are Cloudflare customers too, and they turned away nobody. The presence of Cloudflare tells you nothing; the configuration tells you everything, and only a measurement reveals it.

Share of working free exits turned away, per AI site
character.aiblock pages
50%
poe.com (run 1)challenges
40%
midjourney.comchallenges
25%
poe.com (run 2)challenges
17%
openrouter.ai2 blocks, 2 challenges
17%
labs.google/flowcountry pages
17%
huggingface.corate limits
13%
grok.comchallenges
10%
chub.aiblock pages
10%
suno.comblock pages
8%
udio.com403s, not Cloudflare
8%
11 other sitesevery working exit reached the page
0%
Source: HProxy measurement, 24 August 2026; turned away = blocked, challenged, rate-limited or shown a country page, as a share of the run's working exits (20 in run 1, 24 in run 2)

Finding three: there are four different walls, and they mean different things

The word "blocked" hides four mechanisms, and a free-proxy user meets each one differently.

The reputation block. Character.AI's ten refusals were Cloudflare's Attention Required page with HTTP 403: the address was known and refused before the site saw the request. Chub, Suno and OpenRouter did the same to a smaller set, and one Dutch address, 204.76.203.9 on two ports, was refused by all three of them and by Udio, which does not use Cloudflare at all. That is what a shared address with a history looks like: everyone's edge already knows it. No retry helps; the address is the problem. The full account of Character.AI's edge is in free proxies for Character.AI.

The challenge. Poe, Midjourney and Grok did not refuse; they asked the client to prove it was a browser. A real browser on the same address might pass, or might loop. For a script or a curl it is a wall; for a person it is friction, and it recurs. Poe challenged 8 of 20 in one run and 4 of 24 an hour later, which is the same edge making a per-address judgment on a different set of addresses.

The rate limit. Hugging Face turned nobody away by reputation and answered three exits with HTTP 429 on their very first request. The Hub publishes anonymous limits per IP address over five-minute windows, and those three addresses had already spent theirs, courtesy of whoever else was using them. This is the wall free proxies hit on any site that meters per address: you inherit the strangers' consumption. The numbers are in proxies for Hugging Face.

The geo page. Google Flow showed its not-available-in-your-country page to four exits. One was in Russia, which is absent from Google's country list. Two were in the Netherlands and Cyprus by our geolocation, both on Google's list, which means Google's own geolocation placed those addresses elsewhere. Geo decisions belong to the site's database, not to the proxy seller's, and the two disagree more often than anyone selling country-targeted proxies admits. Google's page also says that VPNs will not enable access in unsupported regions, which we take at its word in proxies for Google Flow.

The four walls, and what a free-proxy user can do about each

Wall and example

  • Reputation block

    character.ai refused 10 of 20 with Cloudflare 403 pages

  • Browser challenge

    poe.com challenged 8 of 20; midjourney.com 5

  • Per-IP rate limit

    huggingface.co answered 3 exits with 429 on request one

  • Country page

    labs.google/flow showed 4 exits its not-available page

What changes it

  • Only a different, clean address

    retrying the same one never works

  • A real browser and a cleaner address

    scripts fail; people loop

  • A token, then an unshared address

    the allowance is per IP or per account

  • The site's own geolocation of the exit

    not the proxy database's

Source: HProxy measurement, 24 August 2026

Finding four: reaching the page is where free stops

Every number above is about a homepage with no account behind it. The moment a login is involved, the calculus changes for reasons the test cannot show: a free proxy is a server operated by someone you cannot see, on the path of your session token, and it dies or changes underneath a session that expects one stable address. Janitor AI let all 20 working exits through, and it is still the wrong place to sign in through one, because the roleplay history behind the login is exactly what a hostile operator would keep. That argument does not need a measurement; it is in are free proxies safe.

So the honest reading of the table: a free proxy will usually tell you whether a site loads from somewhere else, on the sites in the lower half; it will fail on arrival on the sites in the upper half; and on every site it is the wrong tool for an account. Where a site meters by address, Hugging Face's anonymous tier, Civitai's edge limits, a clean unshared address is a real product; where a site scores reputation, a residential or ISP address with no history is what clears the check; and where a site decides by account, Poe's points, Google Flow's eligibility, nothing about any address matters.

A third run, and the strictest edge of all

A day later we ran the same test a third time, on 24 August 2026 at 04:35 UTC, against a dozen more targets: the model providers people wire into Janitor AI and a set of image and video tools. Of 50 fresh proxies, 27 could carry HTTPS. The pattern held, and it produced a new leader.

claude.ai challenged 18 of the 27 working exits, two thirds of them, stricter than Character.AI's half and the highest we have recorded. Leonardo.ai challenged 6 and blocked 2. At the other end, chat.mistral.ai reached the page from 25 of the 27 and x.ai from 24, with only dead proxies missing rather than any block, and hailuoai.video, candy.ai, crushon.ai and polybuzz.ai turned away nobody; udio.com, runway.com and pika.art refused 2 each. meta.ai again answered 403 to every exit and to the direct baseline, confirming it rejects command-line clients by fingerprint rather than by address.

Third run, 24 August 2026: working free exits turned away, of 27
claude.aiCloudflare challenge, strictest measured
18
leonardo.ai6 challenged, 2 blocked
8
udio / runway / pikaeach, blocked
2
mistral, x.ai, candy, crushon, hailuo, polybuzzevery working exit reached the page
0
Source: HProxy measurement, 24 August 2026, 04:35 UTC: 50 free proxies, 27 could carry HTTPS; meta.ai excluded (403 to the baseline too)

The consumer site claude.ai being the hardest wall while the developer endpoint x.ai is one of the softest is the study's pattern in miniature: the strictness is a per-domain decision, set by how much each site wants to keep automated clients out, and it has nothing to do with the size or seriousness of the company behind it.

What this study does not show

It is one homepage request per exit, not a session. It is three runs of 50 from one list on one day; the free pool changes hourly and a run tomorrow will differ in detail, which is why we intend to repeat it. Free proxies overlap between runs, and one address's bad reputation counted against it on several sites. Country attribution of an exit is our database's; the sites use their own, and Google's disagreement with ours on two addresses is the evidence. And the study says nothing about paid proxies, because it was not designed to; it says what the free pool is, measured rather than assumed.

Reproducing it

Pull the list, send the controls, send one request per site, classify by status code, the cf-mitigated header, the Cloudflare page title and the site's country text. The whole thing is under a hundred lines of Node around curl, and the free proxy API hands you the input. If you run it and your numbers differ, that is the free pool doing what it does; the ordering of the sites is the part we expect to hold.

Sources

  • HProxy measurements, 24 August 2026, run one at 01:04 UTC, run two at 02:10 UTC and run three at 04:35 UTC: 50 proxies each from https://hproxy.com/api/proxy-list?format=txt&recent=true&protocol=http, one homepage request per site per exit with a Chrome user agent, 15-second timeout, from a home connection that served as the direct baseline. Raw classification: reached (2xx or 3xx, no challenge), blocked (403 with Cloudflare's Attention Required page), challenged (Cloudflare challenge page or cf-mitigated header), rate-limited (429), geo (the site's not-available text), dead (no response). Run three covered claude.ai, x.ai, chat.mistral.ai, leonardo.ai, runway.com, pika.art, udio.com, candy.ai, crushon.ai, hailuoai.video, polybuzz.ai and meta.ai.
  • HProxy, free proxy data study, for the size and churn of the pool behind the list.
  • Hugging Face, Hub rate limits: anonymous limits counted per IP address over five-minute windows.
  • Google, Get started with Google Flow: the line that VPNs will not enable access in unsupported regions, and Where you can use Google Flow.
  • OpenAI, What to know about the Sora discontinuation: why sora.chatgpt.com was excluded from the tables.

Frequently asked questions

Do free proxies work on AI sites?
For loading a homepage, sometimes, and it depends far more on the site than on the proxy. In three runs of 50 free proxies on 24 August 2026, only 20 to 27 of the 50 could complete an HTTPS request anywhere. Among those working exits, Character.AI refused half with a Cloudflare block page and Poe challenged up to two in five, while DeepSeek, Civitai, ElevenLabs, Janitor AI, Replika and Talkie let every one through. None of that covers logging in, which is the part free proxies are wrong for regardless of the site.
Which AI sites block free proxies the most?
By share of working exits turned away in our runs: Character.AI (10 of 20, Cloudflare block pages), Poe (8 of 20 in one run, 4 of 24 in the other, Cloudflare challenges), Midjourney (5 of 20, challenges), then OpenRouter (4 of 24), Grok, Chub, Suno and Udio (2 each). Every one of those sites fronts with Cloudflare, and every refusal was Cloudflare's reputation scoring rather than the site itself.
Which AI sites let free proxies through?
chat.deepseek.com, civitai.com, elevenlabs.io, spicychat.ai, crushon.ai, klingai.com, janitorai.com, replika.com, talkie-ai.com, aistudio.google.com and polybuzz.ai returned a normal page to every working exit that reached them. Several of those sit behind Cloudflare too, so the difference is configuration: how strictly each site asks Cloudflare to score addresses, not whether Cloudflare is there.
What is the difference between a block, a challenge, a 429 and a geo page?
They are four different walls and we saw all four. A block is a 403 with Cloudflare's Attention Required page: the address is refused outright. A challenge is a page that demands a browser solve a check; curl cannot, so it counts as turned away. A 429 is a rate limit: Hugging Face answered three exits that way on their first request, because the address's anonymous five-minute allowance had already been used by strangers. A geo page is the site deciding you are in the wrong country: Google Flow showed its not-available page to four exits, including two in countries it lists as supported, because Google's geolocation of an address differs from ours.
Why could only 20 of 50 free proxies carry HTTPS?
Because most entries on any free list are plain-HTTP relays, dead, or both. In each run, 31 of 50 answered a plain-HTTP control and only 20 to 27 could open an HTTPS tunnel to any site. Every AI service in this study is HTTPS-only, so the majority of the free pool is out before a site gets a say. This matches what our verification engine sees across the whole pool, tracked in our free proxy data study.
Can I reproduce this?
Yes. Pull 50 proxies from https://hproxy.com/api/proxy-list?format=txt&recent=true&protocol=http, send each one a plain-HTTP control, an HTTPS control and one request per site with a browser user agent and a 15-second timeout, then classify by status code, the cf-mitigated header, the Cloudflare page title and the site's country-page text. Our runs used curl at 25 in parallel from a home connection, which served as the direct baseline for every site.

Get proxies that are alive right now

Our free list re-checks every exit every few minutes and shows a last-checked time, so you copy IPs that worked moments ago, not a stale text dump. When the location has to survive a real check, the paid network holds up.

129M+ proxy checks run · 100+ countries · HTTP / HTTPS / SOCKS · re-checked every few minutes · no signup