A 463 error is an Amazon Web Services (AWS) Application Load Balancer code indicating that the incoming request contained an X-Forwarded-For HTTP header with more than 30 IP addresses.
The X-Forwarded-For header records the list of proxy servers and client IP addresses that a request has passed through. To protect against header-inflation attacks and proxy loop recursion, AWS enforces a hard limit of 30 IP addresses in this header.
Determining why
Requests rarely pass through 30 legitimate proxy hops. A 463 error almost always indicates either:
- A misconfigured proxy loop where internal proxy servers are endlessly passing requests back and forth between each other.
- An automated bot, penetration test, or malicious actor injecting synthetic header payloads.
- A chained microservice architecture where internal services append forwarding headers without stripping previous layers.
Steps you can take
- If you are a visitor:
- Try disabling proxy or VPN software that might be chaining multiple hops.
- Check your device for malware or rogue proxy extensions.
- If you are the website owner or system administrator:
- Inspect your edge reverse proxies (like Cloudflare, Fastly, or local nginx instances) to ensure they are not recursively appending duplicate headers.
- Sanitize or reset the
X-Forwarded-Forheader at your ingress gateway before handing traffic off to the AWS Application Load Balancer.