What Is a Proxy Server? (And How It Differs From a VPN)

Before the explanation, a demonstration.

When you connect through a proxy server and visit an IP lookup tool like myipco.com, here is what the tool sees: the proxy server's IP address, flagged as "hosting" or "proxy" in the connection type field, with your ISP showing as the proxy provider rather than your home broadband company.

What the tool does *not* see — your real IP — depends entirely on which type of proxy you are using and whether it is configured correctly. Many proxies add an `X-Forwarded-For` header to requests that contains your original IP, passing it transparently to every destination server. A site that knows to read that header can identify you despite the proxy.

This is the key thing most proxy explainers skip: from the perspective of the destination server, a proxy is often quite transparent. Whether your real identity leaks depends on the proxy type, the configuration, and whether the destination is looking for the tell-tale signs. This guide covers all of it.

A proxy server is an intermediary computer that sits between your device and the internet. When you use a proxy, your requests go to the proxy first; the proxy forwards them to the destination; the destination responds to the proxy; the proxy returns the response to you.

The destination server sees the proxy's IP address, not yours — the same basic IP-masking principle as a VPN. That is where many of the similarities end.

Proxies are one of the oldest tools in internet infrastructure. They were originally built for caching (a corporate proxy stores frequently accessed web pages locally to reduce bandwidth usage), content filtering (schools and companies route traffic through proxies to block certain sites), and load balancing. Privacy and IP masking came later, as a byproduct of the forwarding architecture.

The defining characteristics of a proxy: - Operates at the application layer — typically for a specific protocol (HTTP, HTTPS) or a specific app - Usually does not encrypt traffic by default (unlike a VPN) - Does not route all device traffic — only what you configure to use it - Can be transparent (destination knows you are using a proxy) or anonymous (destination does not)

The word "proxy" covers several distinct technologies with different capabilities:

HTTP proxy Handles only HTTP traffic. Fast and simple, but unencrypted — anyone monitoring your connection (your ISP, someone on the same network) can read the content. Mostly obsolete now that HTTPS is standard, but still used in corporate environments for caching and filtering.

HTTPS proxy (SSL proxy) Handles HTTPS traffic. Can operate in two modes: - *Tunnelling mode* (CONNECT method): the proxy creates an encrypted tunnel to the destination without being able to read the content. Your traffic is encrypted end-to-end. - *Intercepting/man-in-the-middle mode*: the proxy decrypts, inspects, and re-encrypts traffic using its own certificate. Used in corporate security appliances for deep packet inspection. Requires installing the proxy's root certificate as trusted on your device.

SOCKS5 proxy Protocol-agnostic — routes any TCP/UDP traffic, not just web browsing. More flexible than HTTP/HTTPS proxies. Used with specific applications (torrent clients, game launchers, SSH). Does not encrypt traffic natively but works with any app that supports SOCKS5 configuration.

Transparent proxy A proxy that intercepts traffic without the client being configured to use it. The user may not know they are going through a proxy. ISPs sometimes use these for caching or content filtering. The destination server typically receives the `X-Forwarded-For` header containing the real client IP.

Anonymous proxy Hides your IP from the destination but identifies itself as a proxy in request headers (via `Via` or `Proxy-Authorization` headers). The destination knows a proxy is in use but not who is behind it.

Elite / high-anonymity proxy Does not send `X-Forwarded-For`, `Via`, or other proxy-identifying headers. From the destination's perspective, the request appears to come from a normal browser, not a proxy. The highest privacy level among proxy types.

Residential proxy Routes traffic through IP addresses assigned to real residential internet connections (often via peer-to-peer networks where users opt in — or, in some shady services, do not). Destination servers see what looks like a regular home user IP, not a data centre. Widely used for web scraping and bypassing geo-restrictions because residential IPs are harder to block en masse than data centre IPs.

Datacenter proxy Hosted in commercial data centres. Fast and cheap, but easily identified and blocked by services that maintain lists of known data centre IP ranges.

This is the comparison most people are actually looking for. Here is the honest breakdown:

The practical summary:

A proxy changes your visible IP for specific traffic. A VPN changes your visible IP for all traffic *and* encrypts everything between your device and the VPN server — including hiding your activity from your ISP.

If you just want to access a geo-blocked page in your browser and you trust the proxy provider, an HTTPS proxy or SOCKS5 proxy works. If you want ongoing privacy, ISP-blind browsing, or protection on untrusted networks, a VPN is the right tool.

For a complete VPN explanation, see what is a VPN and how does it work.

This depends almost entirely on who operates the proxy and which type it is.

The fundamental trust problem When you route traffic through a proxy, the proxy operator can see everything passing through it — especially if the traffic is unencrypted (HTTP) or if they operate an intercepting HTTPS proxy. Free proxies have no transparent business model. As with free VPNs, the monetisation is often the traffic data itself.

What gets exposed on an unencrypted proxy: - Every URL you visit (not just the domain — the full path) - Any data you submit via HTTP forms (login credentials, if the site uses HTTP) - The content of pages you read

What is protected even on an unencrypted proxy: - HTTPS traffic is encrypted end-to-end between your browser and the destination — the proxy only sees the domain (via the CONNECT request), not the content. This is the standard modern browsing case.

The X-Forwarded-For leak Many proxy configurations automatically append your real IP in the `X-Forwarded-For` request header. This is standard practice for legitimate corporate proxies (so internal logging still works) but is a privacy failure for consumer proxies claiming to hide your identity. You can check the headers your requests are sending using myipco.com/my-headers.

WebRTC leaks Unlike VPN clients, browser proxy configurations do not suppress WebRTC. Your browser's WebRTC implementation can expose your real local and public IP address to JavaScript on the destination page, bypassing the proxy entirely for that specific data path. The browser fingerprinting guide covers this in detail.

Free proxy lists — the kind that circulate on proxy aggregator sites — are a specific risk worth understanding.

Who runs free proxies? Some are operated by legitimate researchers or privacy advocates. Many are operated by individuals harvesting credentials or reselling browsing data. A meaningful fraction are honeypots — deliberately operated to capture traffic for analysis, credential theft, or intelligence purposes.

The operational cost of running a proxy is real: bandwidth, servers, maintenance. Free proxies either have another revenue source (your data) or are running at a loss for reasons that should prompt questions.

Paid residential proxies are a different category — used heavily by businesses for web scraping, market research, and ad verification. They are expensive (often charged per gigabyte) and come from legitimate proxy network operators who pay device owners (or claim to) for using their connections as exit nodes. Legitimate use case, but the peer-to-peer model has been abused: some residential proxy networks have enrolled devices without clear consent, effectively using them as involuntary exit nodes.

The practical rule: if the proxy is free and you are using it for anything sensitive, assume the traffic is being logged.

There are several ways a destination server can detect proxy usage — and several ways you can check it yourself.

Check your IP lookup result Visit myipco.com and look at the connection type field. IP geolocation databases flag known proxy and hosting IPs. If your IP is registered to a data centre or proxy provider, it will show accordingly. Residential proxies are harder to detect this way — they show as normal residential IPs.

Check your request headers Visit myipco.com/my-headers and look for these headers in the response: - `X-Forwarded-For` — if present, it contains your original IP (and reveals that a proxy added it) - `Via` — identifies the proxy software in the chain - `Proxy-Connection` — a proxy-specific header some software adds

If you see `X-Forwarded-For` containing an IP address, that IP is what your real connection looks like — and any server reading that header knows it too.

How sites detect proxies you cannot see Beyond headers, sophisticated sites use: - IP reputation databases (known data centre and proxy ranges) - Timing analysis (proxy hops add measurable latency) - Geolocation mismatches (browser timezone/language vs. IP location) - WebRTC exposure of local IP even through proxy

For complete privacy, none of these are fully addressed by a proxy alone. A well-configured VPN handles more of them — but even then, browser fingerprinting (covered in the fingerprinting guide) remains a separate layer entirely.

Use a proxy when: - You need to route a specific application (a scraper, a game client, a download manager) through a different IP without affecting your whole device - You are doing web scraping or automation that requires appearing as multiple different IPs (residential proxy networks are built for this) - You want to quickly access a single geo-blocked page in a browser without installing software - You are on a managed network that uses a corporate proxy for caching or filtering — understanding what it does helps you work within it

Use a VPN instead when: - You want privacy from your ISP for all your browsing - You are on an untrusted public network (airport, hotel Wi-Fi) - You want consistent protection across all apps and traffic, not just one browser - You need encryption between your device and the exit point - You want DNS leak protection built in

Neither is sufficient when: - Your threat model includes browser fingerprinting — a proxy or VPN changes your IP but leaves your canvas hash, WebGL renderer, and hardware signals intact - You need true anonymity — for that, Tor Browser with its strict normalisation is the appropriate tool, accepting significant speed and usability trade-offs

For a full comparison of all the methods for changing or hiding your IP — including when to use proxies, VPNs, Tor, and router resets — see the how to change your IP address guide.