What is a proxy server?

Normally your browser opens a connection straight to the website, and the site logs the address the connection came from, say 203.0.113.42. With a proxy configured, the browser instead connects to the proxy, for example 198.51.100.8 on port 8080, and asks it to fetch the page. The proxy opens its own connection to the website, relays the response back, and the site's logs show the proxy's address.

That one trick is the basis for everything proxies are used for:

• Changing what a site sees: a different address, often in a different country or network.
• Filtering and control: schools and companies route browsers through a proxy that blocks categories of sites, logs requests and scans downloads.
• Caching: a proxy can store popular responses and serve them locally, which is why ISPs ran them when bandwidth was scarce.
• Reaching a private network: a proxy inside a company network lets an outside browser reach internal sites, which is what a "jump host" does.
• Many addresses at once: automated tools rotate through pools of proxies so that each request appears to come from a different place.

The word also covers the other direction. A reverse proxy sits in front of a website rather than in front of a user: Cloudflare, nginx and load balancers accept visitors' connections and forward them to the real servers behind. When a lookup says a site's address belongs to a CDN, that is a reverse proxy at work. Everything below is about the forward kind, the one you configure on your own device.

Proxies differ in two independent ways: the protocol they speak, and whose address they lend you.

HTTP and HTTPS proxies

The oldest kind, built into every browser and operating system. For plain web pages the browser sends the whole request to the proxy, which fetches it. For encrypted sites the browser issues a CONNECT request and the proxy simply tunnels the encrypted bytes through, so it can see which host you visit but not the page contents. An "HTTPS proxy" is one you talk to over an encrypted connection; the term does not mean the proxy decrypts your traffic. Corporate filtering proxies do decrypt it, by installing their own certificate on company machines, which is why a work laptop can show a proxy's name on the certificate of every site.

SOCKS5

A general-purpose proxy that forwards any TCP connection and, unlike SOCKS4, also UDP traffic; the protocol has been standardized since 1996. It does not understand what it carries, so it works for games, email clients, torrent clients and SSH as well as browsers. SOCKS5 supports username and password authentication and can resolve domain names on the proxy's side, which keeps your DNS lookups off your own network. It adds no encryption of its own: whatever you send in the clear arrives at the proxy in the clear.

Residential

The lent address belongs to a home internet connection, so to a website the visit looks like an ordinary household. These addresses come from consumer devices whose owners agreed, knowingly or through a bundled app, to share their connection. Residential proxies are slower and dearer than datacenter ones and are used precisely because detection systems trust home addresses more.

Datacenter

The address belongs to a hosting company's range. Fast, cheap and plentiful, but easy to recognize: the registry record says the block is a datacenter, and sites that care about it treat the visit with suspicion. The proxy and VPN check flags these within a second for the same reason.

Mobile

The address belongs to a mobile carrier's pool. Because carriers put thousands of subscribers behind each public address, sites hesitate to block a mobile address, which makes these the hardest type to detect and the most expensive to rent.

Transparent

A proxy you did not configure and may not know about. Networks can intercept web traffic and pass it through a proxy without any setting on your device; hotel and airport Wi-Fi login pages work this way, and some ISPs cache through transparent proxies. The HTTP headers tool often reveals one through a Via or X-Forwarded-For header that your browser never sent.

Both put another address between you and the site. The differences are in scope, encryption and what happens to the traffic you forgot about.

The practical rule: a proxy changes where one program appears to be; a VPN protects everything the device sends. If the goal is privacy on an untrusted network, a proxy is the wrong tool, because every other app on the device still connects directly. What is a VPN? covers the other side in the same detail.

A proxy comes as a host name or address, a port, and sometimes a username and password. Where to type them:

• Windows 11: Settings > Network & internet > Proxy. Under Manual proxy setup, next to Use a proxy server, select Set up, enter the proxy address and port, and save. The same page has Automatically detect settings and Use setup script for networks that publish a PAC file.
• macOS: System Settings > Network > your connection > Details > Proxies. Turn on Web proxy (HTTP), Secure web proxy (HTTPS) or SOCKS proxy and enter the server and port; there is a checkbox for a password.
• iPhone and iPad: Settings > Wi-Fi > (i) next to the network > scroll to HTTP PROXY > Configure Proxy > Manual. The setting is per Wi-Fi network and does not apply to cellular data.
• Android: Settings > Network & internet > Internet > gear next to the network > the pencil (Edit) icon > Advanced options > Proxy > Manual. Also per network, Wi-Fi only.
• Firefox keeps its own: Settings > General > Network Settings > Settings, then Manual proxy configuration. Chrome, Edge and Safari use the operating system's proxy.

Two things the operating-system settings do not do. They do not force every program through the proxy: software can ignore them, and some deliberately does. And an HTTP proxy entered in the system settings covers web traffic only; a game or a mail client needs a SOCKS5 proxy configured inside the program.

Set the proxy, then open the proxy and VPN check. The address at the top should be the proxy's, not your own, and the connection type tells you how the address looks to other sites: residential, datacenter, mobile, or a known proxy range. If your own address is still there, the application you are testing with is not using the proxy; check that the browser you opened is the one you configured.

Then look for the leaks a proxy does not cover. The DNS leak test shows whether your name lookups still go to your own provider, which they do with an HTTP proxy and with SOCKS5 unless the application asks the proxy to resolve names. The WebRTC leak test shows whether your browser hands out your real address through WebRTC, which runs outside the proxy. What websites can see lists the headers the proxy adds; a Via or X-Forwarded-For header with your real address in it means the proxy is announcing you.

Finally, the VPN test runs all of these in one pass and gives a single verdict, which is the quickest way to confirm that an address change is complete rather than cosmetic.