# Proxy (/docs/proxy)

Every fetch goes through EliseBot's proxy pool.

Every fetch goes through one of EliseBot's proxies; EliseBot never connects to a target itself, and a request cannot
choose or bring a proxy.

- The proxy is picked per attempt from the pool, so a retry may go out another way.
- The proxy resolves the target, so EliseBot refuses what it can see before the request leaves, on every redirect hop:
  a non-public IP literal, `localhost` or `*.localhost` fails with `non_public_address`, and an explicit port other
  than 80 and 443 with `port_not_allowed`.
- A proxy that is unreachable, refuses the connection or the credentials (407) or fails the CONNECT is retried like
  any failure, then ends as `proxy_error`, with the fixed `error` `proxy connection failed` that never names the
  proxy's address or banner. A 429 or 5xx, the target's or an HTTP proxy's on a plain-http target, stays
  `http_status` and is retried as usual.