Your CORS proxy just got rate limited — now what?

A free, shared, public CORS proxy suddenly returning 429s isn't a bug — it's the model working as designed. Here's why it happens, how to tell if it'll happen again, and what to check before you pick whatever's next.

Aug 20, 2026 · ~5 min read

Why free public proxies rate-limit you (even if you didn't do anything)

Most free CORS proxies share one thing: a single pool of capacity, unauthenticated, open to anyone who finds the URL. Your limit isn't really your limit — it's shared with every other site pointed at the same proxy. If someone else's traffic spikes, or a bot starts hammering it, your legitimate 10 requests/minute can get caught in the same 429 storm as their abuse. You didn't do anything wrong; you're sharing a queue with strangers, and it's untraceable which of you triggered it.

Some go further and shut down entirely without warning — cors-anywhere.herokuapp.com's public demo instance has been intentionally rate-limited to roughly 50 requests/hour for years specifically to stop people using the demo in production. That's not a bug either; it's the maintainer trying to get you to self-host or use something else.

Three questions to ask before you pick the next one

1. Is there a per-account limit, or a shared pool? If it's not authenticated with a key, you have no isolation from everyone else's traffic. Any proxy with no signup is a shared pool, full stop.
2. What happens over the limit — silent drop, or a clear 429 with a reset time? The former means your app breaks with no signal why. The latter you can actually build retry/backoff logic against.
3. Is there a status page or uptime history? If you can't check whether it's currently degraded, you're flying blind every time something breaks.

What corsproxy.dev does differently

• Per-account quota, not shared. Your 500 requests/day (free tier) are yours — enforced by an atomic per-account counter, not a pool. See how the counter actually works.
• A 429 tells you exactly when it resets — UTC midnight, in the error message, not a guess. Successful responses carry X-RateLimit-Remaining so you see it coming.
• A real status page instead of finding out via a support email.
• The same core is open-source — if you outgrow the managed tiers or need it entirely under your control, self-host it instead of migrating to a different codebase.

Migrating is usually a one-line change

Most CORS proxies share the same ?url= query-param shape. If that's what you're already sending:

Before: https://your-current-proxy.example/proxy?url=https://api.example.com/data
After:  https://api.corsproxy.dev/proxy?url=https://api.example.com/data&key=sk_live_...

Full walkthrough, including Axios and wrapper-function patterns: migrating from cors-anywhere. Want the full picture across seven options first? See the comparison post.