What Is a Proxy Server? Types, Uses and Risks

A proxy server is an intermediary that makes requests on your behalf: you connect to the proxy, the proxy connects to the website, and the website sees the proxy's IP address instead of yours. Forward proxies act for users, reverse proxies act for websites, and the main types (HTTP, SOCKS5, transparent and residential) differ in what traffic they carry and how visible they are.

Proxies are everywhere, often without people noticing: corporate networks filter through them, almost every large website sits behind one, and browser extensions and apps sometimes quietly turn your connection into one. This guide explains how each kind works, what a proxy does and does not hide, and the real risks of using a free one.

Forward proxies vs reverse proxies

	Forward proxy	Reverse proxy
Acts on behalf of	The client (you)	The server (the website)
Who configures it	The user or their organisation	The website operator
Hides	The client's IP from websites	The origin servers from visitors
Typical uses	Content filtering, caching, access control, changing apparent location	Load balancing, TLS termination, caching, CDNs, protection against attacks

When people say "use a proxy", they mean a forward proxy. A reverse proxy is invisible to visitors: when you load a site behind a CDN, the address you connect to belongs to the CDN's reverse proxy, which fetches content from the real server behind it. Response headers such as Via, Server or provider-specific cache headers often reveal one; you can inspect them with our HTTP headers checker.

Types of forward proxy

HTTP proxies

An HTTP proxy understands web traffic. For a plain http:// page, the browser sends the full URL to the proxy, which fetches it and can read, cache, filter or modify everything:

GET http://example.com/page HTTP/1.1
Host: example.com

For HTTPS, the browser asks the proxy to open a raw tunnel using the CONNECT method, then performs the TLS handshake with the website through it:

CONNECT example.com:443 HTTP/1.1
Host: example.com:443

HTTP/1.1 200 Connection established

From then on the proxy only relays encrypted bytes. It knows which host and port you connected to, and how much data moved, but not the URLs or page content. The exception is a proxy that performs TLS interception, which only works if a root certificate controlled by the proxy operator has been installed on your device. Companies do this deliberately on managed laptops; you should never install such a certificate for a proxy you do not control.

SOCKS5 proxies

SOCKS5 (RFC 1928) works at a lower level than HTTP. It simply relays TCP connections, and optionally UDP, for any protocol: web, email, games or SSH. It supports username and password authentication but does not encrypt traffic itself. A handy way to create one is SSH's dynamic port forwarding, which gives you an encrypted SOCKS proxy through any server you can log in to:

ssh -D 1080 user@server.example.com

# Use it from the command line
curl --socks5-hostname 127.0.0.1:1080 https://example.com/

The --socks5-hostname option makes the proxy resolve the domain name, so your DNS queries also go through the proxy instead of leaking to your local resolver.

Transparent proxies

A transparent (or intercepting) proxy is one you never configured. The network silently redirects your traffic through it. Schools, hotels, airline Wi-Fi captive portals and some ISPs use them to filter content, cache files or show login pages. Because HTTPS traffic cannot be read without the user's cooperation, modern transparent proxies mostly see only the destination hostname, but they can still block it.

Datacenter, residential and mobile proxies

Commercial proxy services are usually classified by where their IP addresses come from:

Datacenter proxies use addresses belonging to hosting providers. They are fast and cheap but easy to recognise.
Residential proxies route traffic through real home internet connections, so it appears to come from ordinary households.
Mobile proxies use cellular connections, whose addresses are shared by many users through carrier NAT and are rarely blocked outright.

Note: Residential proxy networks need real people's connections. Some participants knowingly sell their bandwidth, but others are enrolled through software development kits bundled into free apps, games or browser extensions with consent buried in the terms, or through malware. If your connection is part of such a network, strangers' traffic leaves from your IP address, and abuse complaints, blocklistings or worse can be traced to you. Be cautious about apps that offer rewards for "sharing unused bandwidth", and think about where a proxy's addresses come from before paying for one.

X-Forwarded-For and what proxies reveal

Many proxies add headers that tell the destination server a proxy was involved, and sometimes who the original client was:

Via: 1.1 proxy.example.net
X-Forwarded-For: 203.0.113.7, 198.51.100.2
Forwarded: for=203.0.113.7;proto=https

X-Forwarded-For lists the client and each proxy in turn; the left-most entry is the claimed original client. Forwarded (RFC 7239) is the standardised version of the same idea. These headers are how reverse proxies pass your real IP to the application behind them, and also how a poorly configured forward proxy can leak it.

Because any client can write anything into these headers, a server should only trust them when they were added by a proxy it operates. Applications that blindly trust X-Forwarded-For can be tricked into logging the wrong IP or bypassing IP-based rate limits.

Proxies are sometimes described as transparent, anonymous or elite (high-anonymity) depending on whether they pass your IP and reveal themselves in these headers. These labels are informal and not defined by any standard, so test rather than trust them.

How websites detect proxies

IP reputation and ownership. Addresses belonging to hosting providers are easy to classify; an ASN lookup shows whether an IP belongs to a residential ISP or a data centre. Commercial databases also track known proxy and VPN exit addresses.
Headers. Via, X-Forwarded-For and similar headers give the game away immediately.
WebRTC and DNS leaks. A browser configured to use a proxy may still send WebRTC traffic directly, exposing your real IP to page scripts. Test this with our WebRTC leak test.
Mismatches. A browser time zone or language that does not fit the IP's location, or TCP and TLS fingerprints that do not match the claimed operating system, raise suspicion.
Open proxy ports. Some services check whether the connecting IP itself answers on common proxy ports such as 1080, 3128 or 8080.

The risks of free proxies

Running a proxy costs money, so a free one is paid for some other way. Public proxy lists also include machines that are open by accident or because they have been compromised. When you route traffic through an unknown proxy:

Unencrypted traffic is fully exposed. Anything sent over plain HTTP, including login forms, can be read, logged and modified. Ads or malicious scripts can be injected into pages.
Metadata is always exposed. Even with HTTPS, the operator sees every site you connect to, when and for how long.
Fake certificates. Any request to install a certificate or ignore a browser security warning is a sign of interception.
Reliability and speed. Free proxies are often overloaded, short-lived and already blocked by the sites you want to reach.

If you need privacy rather than just a different apparent IP, a proxy is usually the wrong tool, because it does not encrypt your connection to it. Our comparison of a VPN vs proxy explains when each makes sense.

How to check that a proxy is working

Note your normal public IP on the WhatsMyIPNumber homepage.
Configure the proxy in your browser or operating system, or for command-line tools with environment variables such as https_proxy=http://198.51.100.20:3128.
Reload the page. The address shown should now be the proxy's, along with its ISP and location.
Run the WebRTC leak test to confirm your real address is not exposed another way.

Frequently asked questions

Does a proxy hide my IP address?

From the websites you visit, usually yes, provided the proxy does not forward it in a header and nothing leaks around it. The proxy operator always sees your real IP, and so does your ISP, which can see that you are connecting to the proxy.

Is a proxy the same as a VPN?

No. A proxy typically handles one application or protocol and does not encrypt the connection to it. A VPN carries all of your device's traffic through an encrypted tunnel.

Is using a proxy legal?

In most countries using a proxy is legal, and businesses rely on them daily. What you do through it is still subject to the law and to the terms of the sites you access, and using someone else's connection without informed consent raises clear ethical and legal problems.

What is the difference between HTTP and SOCKS5 proxies?

An HTTP proxy understands web requests and can cache or filter them; HTTPS passes through it as a CONNECT tunnel. SOCKS5 relays any TCP or UDP traffic without understanding it, which makes it more flexible but unable to do web-specific filtering or caching.