What is a proxy server and how does it work

A proxy server is an intermediary between a program on your device and a website or another server on the internet. The program (a browser, a script or a messenger) sends its request to the proxy instead of the site; the proxy connects to the site in its own name and returns the response. So the site sees the proxy’s IP address instead of yours and works out the country and city from it. The HTTP specification, RFC 9110, describes a proxy in just these terms: an intermediary chosen by the client, usually through its settings.

How a proxy server works

A request through a proxy travels like this:

1. The program connects to the proxy. Its settings hold the proxy server’s address (the host), the port and, if the proxy requires a sign-in, a username and password.
2. The program says where it wants to go. An HTTP proxy gets the page address in the request itself, and for an https:// site, a CONNECT request with the site name and port. A SOCKS5 proxy gets a name or an IP address and a port.
3. The proxy connects to the site. This connection comes from an IP address on the proxy’s side, called the exit IP.
4. The response comes back the same way: the site answers the proxy, and the proxy answers your program.

To the site, the request came from the exit IP. The site and geolocation services work out the country and city from it, each with its own database, so the city can differ between services. The proxy sees your own IP; the site does not, unless the proxy itself passes it on in the request headers (more on that below).

What a proxy changes and what it does not

A proxy changes one thing: the network address your connections reach the site from. Everything else depends on the protocol, the site and whoever runs the proxy.

What the proxy operator sees

All the traffic of a program connected to a proxy goes through it, so its operator can see:

• Your IP address, connection times and traffic volume.
• Which sites you connect to. For an https:// site, an HTTP proxy gets the site name and port in the CONNECT request; after a success response, under RFC 9110, it only relays data in both directions. That data is encrypted between your program and the site, so the proxy does not see page addresses, forms, passwords or content.
• Everything on http:// sites. The proxy makes such a request itself, so it sees page addresses, cookies, submitted forms and responses, and can change them.

A SOCKS5 proxy sees the address and port you connect to and relays the data without parsing it; if the data is HTTPS, the content is out of its reach as well. If a proxy service passes traffic on through other nodes, they may see the same.

A proxy does not encrypt traffic

The connection between your program and an ordinary HTTP or SOCKS5 proxy is not encrypted, and the username and password travel over it in the clear. An HTTP proxy receives them in the Proxy-Authorization header, usually just in base64, which is not encryption. In SOCKS5, sign-in is a separate step, and RFC 1929 warns plainly that it carries the password in cleartext. Page content is protected only by HTTPS between the program and the site.

If the browser warns that a site’s certificate is invalid, do not continue: under RFC 9110 (section 4.3.4), the browser must then either ask you or end the connection, and such a warning can mean that someone is tampering with your connection to the site.

What a proxy does not hide

A site recognizes a visitor by more than the IP address:

• Account sign-in and cookies. If you are signed in, the site knows it is you whatever address you come from, and cookies saved without the proxy are sent through the proxy too.
• Browser fingerprint. A site can recognize a browser or device by its settings and other traits, such as window size and the list of fonts. The 2025 W3C note on browser fingerprinting says that clearing cookies or using a VPN does not prevent visits from being linked this way. A proxy, which changes only the IP, does not prevent it either.
• Language and time zone. The browser states its preferred languages in the Accept-Language header (RFC 9110, section 12.5.4), and a page script can read the system time zone. Neither changes with the proxy.
• Traffic that skips the proxy. Programs that ignore the proxy settings go online from your own address. In a browser, WebRTC can behave this way: under RFC 8828, if the device can reach the internet directly, its connectivity checks may go around the proxy and reveal the device’s public IP. More in the article on proxies in a browser.

DNS: who looks up the site’s address

Before connecting, the site name has to be turned into an IP address. An HTTP proxy gets the name in the request and looks up the address itself. SOCKS5, under RFC 1928, accepts either a name or a ready IP address, and the program either passes the name to the proxy or looks up the address on your device. In curl, the scheme decides: with socks5h:// the proxy resolves the name, with socks5:// your device does. In the second case, your DNS provider sees which sites you open, and the site’s address may be picked for your region instead of the exit region. More in the article curl with a proxy.

Headers that can reveal your IP

A proxy can pass your address to the site itself, in HTTP request headers:

• X-Forwarded-For is a widely used but non-standard header to which a proxy appends the client’s IP address.
• Forwarded is the standard header for the same information, from RFC 7239: in its for parameter the proxy states who sent it the request, and by default RFC 7239 recommends a generated identifier there instead of an IP address.
• Via, under RFC 9110 (section 7.6.3), must be added by a proxy to every message it forwards. It tells the site about the intermediaries on the request’s path, not about you.

Many sellers sort proxies into “transparent”, “anonymous” and “elite” by which of these headers they add. These are not standard terms: in RFC 9110, “transparent proxy” means an interception proxy that the client did not choose. And a proxy can add headers only to an unencrypted request to an http:// site: in a CONNECT tunnel to an https:// site the request is encrypted, and the proxy neither reads nor changes it.

Proxy vs VPN: what is the difference

A proxy and a VPN both change the address your traffic reaches sites from, but a VPN usually works at the IP layer: for example, IPsec under RFC 4301 protects the traffic of all protocols carried over IP. A proxy works with a program’s individual connections.

Need a different IP for one program, or a separate location for each task? A proxy fits. Need to encrypt all of a device’s traffic up to a server you trust? That is a VPN. Neither hides your accounts, cookies or browser fingerprint.

Types of proxies

By protocol: HTTP and SOCKS5

An HTTP proxy accepts requests in HTTP: it fetches http:// pages itself and opens a tunnel with the CONNECT method for https:// sites. If a provider says “HTTPS proxy”, ask what it means: opening https:// sites through CONNECT, or a TLS connection to the proxy itself.

SOCKS5 is a lower-level protocol: the proxy connects the program to a host and port and relays the data without parsing it. RFC 1928 also has a command for UDP, but UDP support depends on the service.

The program usually decides the protocol for you: browsers work with a username and password over HTTP, and Telegram on a phone over SOCKS5. More in the article HTTP vs SOCKS5.

By where the IP comes from

• Residential: IP addresses of home internet providers. The address comes from a pool and is not reserved for you.
• Mobile: IP addresses of 4G / 5G / LTE cellular networks, also from a pool.
• Static ISP proxies: a dedicated static IP registered to an internet provider. It stays with your order for the whole paid term.
• Datacenter: addresses of servers in data centers. Proxeta does not sell them.

How ISP proxies differ from residential and mobile ones is covered in the article ISP vs residential proxies.

By session: rotation and sticky sessions

Proxies with an address pool usually work through a gateway: you connect to one host and port, and the gateway picks which IP your connection to the site comes from. In rotation mode, each new connection may get a new IP; in a sticky session, the address is kept for as long as possible. More in the articles sticky session vs rotation and what is a backconnect proxy.

Forward and reverse proxies

This article is about forward proxies: the user chooses them, and they act on the user’s behalf. A reverse proxy sits in front of a site: to a visitor it looks like the site itself, and it passes requests on to the servers behind it. RFC 9110 calls such an intermediary a gateway and mentions caching to speed up the server and load balancing. Examples are the nginx web server, which passes requests to an application behind it, and content delivery network (CDN) servers in front of a site.

What proxies are used for

• Seeing a site from another country or city. Sites can show different prices, ads, stock and search results depending on the visitor’s location.
• Collecting public data. A script opens public pages from the location you need and spreads requests across addresses, staying within what the site allows. How to choose proxies for this is covered in the article web scraping proxies, and example code in web scraping with Python. A proxy gives no right to collect data: laws and site terms apply as usual.
• Connecting Telegram. Telegram apps have their own proxy settings: how to set up a proxy in Telegram.
• Setting a proxy for a browser profile. In antidetect browsers, the proxy is set in the profile settings: how to set up a proxy in an antidetect browser.
• Testing your own site. For example, how country redirects, language, currency and prices work for visitors from different regions.
• Managing access in an organization. Under RFC 9110, an organization’s requests are often grouped through a shared proxy for security and shared caching. The network administrator then gives you the proxy address.

A proxy does not change the rules: laws, site terms and the Acceptable Use Policy apply just as they do without it. Among other things, the policy prohibits fraud, spam and collecting data where that is unlawful or violates the site owner’s rights or terms.

Free proxies and running your own

The main risk of free proxies from public lists is not speed but the fact that you do not know who runs them:

• You do not know who runs the proxy or what it records. All of the program’s traffic goes through it: it can read and change http:// pages, for example by inserting ads or scripts, and for https:// sites it sees which sites you open.
• No terms and no accountability. Such a proxy usually has no privacy policy, no support and no promise to work tomorrow; addresses from lists vanish without warning.
• An address shared with strangers. Anyone at all can be using a proxy that is open to everyone at the same time as you.

If you use one anyway, open only https:// sites, do not sign in to accounts, do not install certificates or programs the proxy owner asks you to install, and do not continue past a browser certificate warning.

A paid proxy is not safer by itself: you trust its operator just the same, but you know who the operator is and can read its terms and privacy policy before you pay.

You can run your own proxy server with open-source software on a server you control. The exit IP is then that server’s address, and protecting the proxy with a password and keeping it updated is up to you: a proxy open to the internet without a password can be used by anyone.

How to connect and check a proxy

What the provider gives you

To connect, you need four values: the host (the name or IP address of the proxy server), the port, the username and the password. Providers often give them as one string; at Proxeta, the format is host:port:login:password:

proxy.example.invalid:8080:demo-country-us-sid-k7m2q9x4ab-filter-medium:demo-password

The example uses placeholder data. If the program asks for separate fields, split the string at the colons. Copy the login in full: in Proxeta strings it holds the location and the session. More in the articles proxy string format and connecting a proxy.

Where to enter the details

• Browser. Chrome and Edge take the proxy from the Windows or macOS settings, and Firefox has its own connection settings: how to set up a proxy in a browser.
• curl and scripts. Commands and errors are covered in curl with a proxy, and code for requests, httpx and Playwright in proxies in Python.
• The whole system. A proxy in the Windows or macOS settings applies to programs that use the system settings. Windows has no login fields: the browser asks for the login in a sign-in window.

How to check the exit IP

1. Before turning the proxy on, open https://api64.ipify.org or any “what is my IP” page and note the address.
2. Turn the proxy on and open the same page in a new tab. The address should change and match the location you chose.

Without a browser, curl does the same check:

curl -sS --max-time 30 -w '\n' \
  --proxy http://proxy.example.invalid:8080 \
  --proxy-user 'demo-login:demo-password' \
  https://api64.ipify.org

The command prints the exit IP. If it matches your address without the proxy, the request went around the proxy. The service answers over both IPv4 and IPv6, so the address may turn out to be IPv6.

How to turn a proxy off

Turn the proxy off where you turned it on. The menu names are as of November 2026 and may differ in other versions.

• Windows: “Settings” → “Network & internet” → “Proxy”. Under “Manual proxy setup”, next to “Use a proxy server”, select “Set up”, turn it off and save; check the “Automatic proxy setup” section on the same page too (Microsoft help).
• macOS: Apple menu → “System Settings” → “Network”, select the network service, then “Details” → “Proxies”, and turn off the proxy types that are on (Apple help).
• Firefox: the “Connection Settings” window in the browser settings, where you set up the manual proxy configuration: choose the no-proxy option there.
• Chrome extension: in Proxeta Proxy Manager, a saved proxy is turned off from the extension window.
• Telegram: on the same screen where you added the proxy, with the “Use Proxy” switch on a phone, the “Disable proxy” option in Telegram Desktop or the “Proxy” switch in the macOS app.

Then open the IP check page again: your usual address should be back.

Proxeta proxies

Proxeta sells residential, mobile and static ISP proxies; it has no datacenter proxies.

• Residential and mobile proxies are paid for by the gigabyte of traffic used, from one balance. In the “Generate proxies” section of the Dashboard, you choose the country, optionally the region and city, the session type (“Sticky session” or “Rotation”) and the protocol: HTTP on port 8080 or SOCKS5 on port 1080. Sign-in is by username and password only, there is no IP allowlist, and UDP is not carried. The @proxetabot bot also issues sticky session strings.
• ISP proxies are one dedicated IP for 30 days, with a choice of country only. You order a number of IPs and pay for each address; they connect over HTTP and SOCKS5 with a username and password, and their traffic is not counted in gigabytes.

Prices are in the pricing section. Proxeta records how much traffic you use and, under its Privacy Policy, does not collect the content of the websites you visit through a proxy; the Acceptable Use Policy states that Proxeta does not monitor the content of your traffic. Among its service providers, the Privacy Policy also names proxy network providers.