Every "free proxies for" page on the internet, including ours, makes claims about how a site treats free proxies. On 24 August 2026 we stopped claiming and counted. We pulled 50 proxies from our own free proxy list, all verified alive minutes earlier, and sent each one to a dozen AI sites, one homepage request each. An hour later we did it again with a fresh 50 and a different dozen. The result is a table of 21 AI services, and the finding underneath it is that "do free proxies work on AI sites" is the wrong question. The right one is which of four different walls each site has built, because the answer changes completely from one domain to the next.
Method, briefly
Each run: 50 HTTP proxies from https://hproxy.com/api/proxy-list?format=txt&recent=true&protocol=http, the freshest first. Each proxy was sent a plain-HTTP control request, an HTTPS control request, and then one request for each site's homepage, with a current Chrome user agent, redirects followed, a 15-second timeout, 25 in parallel, from a home connection. The same requests were sent directly from that home connection as the baseline, and every site in the tables below returned a normal page to it.
We classified each response as reached (a 2xx or 3xx with no challenge), blocked (a 403 carrying Cloudflare's Attention Required page), challenged (Cloudflare's browser-check page, or its cf-mitigated: challenge header), rate-limited (429), geo (the site's own not-available-in-your-country text), or dead (no response within the timeout). Two sites were dropped from the tables: sora.chatgpt.com, because the Sora product was discontinued in April 2026 and the domain now serves only an export page, and meta.ai, which answered 403 to the direct baseline as well, so it rejects command-line clients regardless of address.
Run one started at 01:04 UTC and covered character.ai, chat.deepseek.com, grok.com, civitai.com, elevenlabs.io, chub.ai, spicychat.ai, crushon.ai, klingai.com, poe.com and midjourney.com. Run two started at 02:10 UTC and covered suno.com, huggingface.co, replika.com, talkie-ai.com, labs.google/flow, poe.com again, janitorai.com, openrouter.ai, aistudio.google.com, polybuzz.ai and udio.com.
Finding one: most of the free pool cannot carry HTTPS
Before any site had a say, the pool thinned itself. In each run, 31 of 50 proxies relayed the plain-HTTP control. Only 20 in the first run and 24 in the second could open an HTTPS tunnel to any site at all. Every AI service here is HTTPS-only, so between half and three fifths of a freshly verified free list was out of the test before it began.
That is consistent with what the verification engine behind the list sees all year: a pool of 590K+ addresses discovered, of which only a few thousand are alive at any moment, tracked in detail in our free proxy data study. The rest of this study is about the 20, 24 and 27 that worked across the three runs.
Finding two: the sites disagree completely
Among working exits, the share turned away ranged from half to none, and the ordering has nothing to do with how famous the site is.
| Site | Run | Working exits | Reached | Blocked (403 page) | Challenged | Rate-limited | Geo page | Timed out | Cloudflare in front |
|---|---|---|---|---|---|---|---|---|---|
| character.ai | 1 | 20 | 8 | 10 | 0 | 0 | 0 | 2 | yes |
| poe.com | 1 | 20 | 9 | 0 | 8 | 0 | 0 | 3 | yes |
| midjourney.com | 1 | 20 | 12 | 0 | 5 | 0 | 0 | 3 | yes |
| poe.com | 2 | 24 | 12 | 0 | 4 | 0 | 0 | 8 | yes |
| openrouter.ai | 2 | 24 | 18 | 2 | 2 | 0 | 0 | 2 | yes |
| labs.google/flow | 2 | 24 | 14 | 0 | 0 | 0 | 4 | 6 | no |
| huggingface.co | 2 | 24 | 19 | 0 | 0 | 3 | 0 | 2 | no |
| grok.com | 1 | 20 | 15 | 0 | 2 | 0 | 0 | 3 | yes |
| chub.ai | 1 | 20 | 14 | 2 | 0 | 0 | 0 | 4 | yes |
| suno.com | 2 | 24 | 17 | 2 | 0 | 0 | 0 | 5 | yes |
| udio.com | 2 | 24 | 18 | 2 | 0 | 0 | 0 | 4 | no |
| chat.deepseek.com | 1 | 20 | 14 | 0 | 0 | 0 | 0 | 6 | no |
| civitai.com | 1 | 20 | 18 | 0 | 0 | 0 | 0 | 2 | yes |
| elevenlabs.io | 1 | 20 | 17 | 0 | 0 | 0 | 0 | 3 | no |
| spicychat.ai | 1 | 20 | 16 | 0 | 0 | 0 | 0 | 4 | yes |
| crushon.ai | 1 | 20 | 14 | 0 | 0 | 0 | 0 | 6 | yes |
| klingai.com | 1 | 20 | 17 | 0 | 0 | 0 | 0 | 3 | no |
| janitorai.com | 2 | 24 | 20 | 0 | 0 | 0 | 0 | 4 | no |
| replika.com | 2 | 24 | 22 | 0 | 0 | 0 | 0 | 2 | no |
| talkie-ai.com | 2 | 24 | 21 | 0 | 0 | 0 | 0 | 3 | no |
| aistudio.google.com | 2 | 24 | 15 | 0 | 0 | 0 | 0 | 9 | no |
| polybuzz.ai | 2 | 24 | 17 | 0 | 0 | 0 | 0 | 7 | no |
Read the top and the bottom together. Character.AI, Poe and Midjourney, the three strictest, are all Cloudflare customers that have asked Cloudflare to score addresses hard. Civitai, SpicyChat and CrushOn are Cloudflare customers too, and they turned away nobody. The presence of Cloudflare tells you nothing; the configuration tells you everything, and only a measurement reveals it.
Finding three: there are four different walls, and they mean different things
The word "blocked" hides four mechanisms, and a free-proxy user meets each one differently.
The reputation block. Character.AI's ten refusals were Cloudflare's Attention Required page with HTTP 403: the address was known and refused before the site saw the request. Chub, Suno and OpenRouter did the same to a smaller set, and one Dutch address, 204.76.203.9 on two ports, was refused by all three of them and by Udio, which does not use Cloudflare at all. That is what a shared address with a history looks like: everyone's edge already knows it. No retry helps; the address is the problem. The full account of Character.AI's edge is in free proxies for Character.AI.
The challenge. Poe, Midjourney and Grok did not refuse; they asked the client to prove it was a browser. A real browser on the same address might pass, or might loop. For a script or a curl it is a wall; for a person it is friction, and it recurs. Poe challenged 8 of 20 in one run and 4 of 24 an hour later, which is the same edge making a per-address judgment on a different set of addresses.
The rate limit. Hugging Face turned nobody away by reputation and answered three exits with HTTP 429 on their very first request. The Hub publishes anonymous limits per IP address over five-minute windows, and those three addresses had already spent theirs, courtesy of whoever else was using them. This is the wall free proxies hit on any site that meters per address: you inherit the strangers' consumption. The numbers are in proxies for Hugging Face.
The geo page. Google Flow showed its not-available-in-your-country page to four exits. One was in Russia, which is absent from Google's country list. Two were in the Netherlands and Cyprus by our geolocation, both on Google's list, which means Google's own geolocation placed those addresses elsewhere. Geo decisions belong to the site's database, not to the proxy seller's, and the two disagree more often than anyone selling country-targeted proxies admits. Google's page also says that VPNs will not enable access in unsupported regions, which we take at its word in proxies for Google Flow.
Wall and example
Reputation block
character.ai refused 10 of 20 with Cloudflare 403 pages
Browser challenge
poe.com challenged 8 of 20; midjourney.com 5
Per-IP rate limit
huggingface.co answered 3 exits with 429 on request one
Country page
labs.google/flow showed 4 exits its not-available page
What changes it
Only a different, clean address
retrying the same one never works
A real browser and a cleaner address
scripts fail; people loop
A token, then an unshared address
the allowance is per IP or per account
The site's own geolocation of the exit
not the proxy database's
Finding four: reaching the page is where free stops
Every number above is about a homepage with no account behind it. The moment a login is involved, the calculus changes for reasons the test cannot show: a free proxy is a server operated by someone you cannot see, on the path of your session token, and it dies or changes underneath a session that expects one stable address. Janitor AI let all 20 working exits through, and it is still the wrong place to sign in through one, because the roleplay history behind the login is exactly what a hostile operator would keep. That argument does not need a measurement; it is in are free proxies safe.
So the honest reading of the table: a free proxy will usually tell you whether a site loads from somewhere else, on the sites in the lower half; it will fail on arrival on the sites in the upper half; and on every site it is the wrong tool for an account. Where a site meters by address, Hugging Face's anonymous tier, Civitai's edge limits, a clean unshared address is a real product; where a site scores reputation, a residential or ISP address with no history is what clears the check; and where a site decides by account, Poe's points, Google Flow's eligibility, nothing about any address matters.
A third run, and the strictest edge of all
A day later we ran the same test a third time, on 24 August 2026 at 04:35 UTC, against a dozen more targets: the model providers people wire into Janitor AI and a set of image and video tools. Of 50 fresh proxies, 27 could carry HTTPS. The pattern held, and it produced a new leader.
claude.ai challenged 18 of the 27 working exits, two thirds of them, stricter than Character.AI's half and the highest we have recorded. Leonardo.ai challenged 6 and blocked 2. At the other end, chat.mistral.ai reached the page from 25 of the 27 and x.ai from 24, with only dead proxies missing rather than any block, and hailuoai.video, candy.ai, crushon.ai and polybuzz.ai turned away nobody; udio.com, runway.com and pika.art refused 2 each. meta.ai again answered 403 to every exit and to the direct baseline, confirming it rejects command-line clients by fingerprint rather than by address.
The consumer site claude.ai being the hardest wall while the developer endpoint x.ai is one of the softest is the study's pattern in miniature: the strictness is a per-domain decision, set by how much each site wants to keep automated clients out, and it has nothing to do with the size or seriousness of the company behind it.
What this study does not show
It is one homepage request per exit, not a session. It is three runs of 50 from one list on one day; the free pool changes hourly and a run tomorrow will differ in detail, which is why we intend to repeat it. Free proxies overlap between runs, and one address's bad reputation counted against it on several sites. Country attribution of an exit is our database's; the sites use their own, and Google's disagreement with ours on two addresses is the evidence. And the study says nothing about paid proxies, because it was not designed to; it says what the free pool is, measured rather than assumed.
Reproducing it
Pull the list, send the controls, send one request per site, classify by status code, the cf-mitigated header, the Cloudflare page title and the site's country text. The whole thing is under a hundred lines of Node around curl, and the free proxy API hands you the input. If you run it and your numbers differ, that is the free pool doing what it does; the ordering of the sites is the part we expect to hold.
Sources
- HProxy measurements, 24 August 2026, run one at 01:04 UTC, run two at 02:10 UTC and run three at 04:35 UTC: 50 proxies each from https://hproxy.com/api/proxy-list?format=txt&recent=true&protocol=http, one homepage request per site per exit with a Chrome user agent, 15-second timeout, from a home connection that served as the direct baseline. Raw classification: reached (2xx or 3xx, no challenge), blocked (403 with Cloudflare's Attention Required page), challenged (Cloudflare challenge page or cf-mitigated header), rate-limited (429), geo (the site's not-available text), dead (no response). Run three covered claude.ai, x.ai, chat.mistral.ai, leonardo.ai, runway.com, pika.art, udio.com, candy.ai, crushon.ai, hailuoai.video, polybuzz.ai and meta.ai.
- HProxy, free proxy data study, for the size and churn of the pool behind the list.
- Hugging Face, Hub rate limits: anonymous limits counted per IP address over five-minute windows.
- Google, Get started with Google Flow: the line that VPNs will not enable access in unsupported regions, and Where you can use Google Flow.
- OpenAI, What to know about the Sora discontinuation: why sora.chatgpt.com was excluded from the tables.