What Is a Proxy? How Proxy Servers Work, Types and Uses

A proxy is a server that sits between your device and the internet and makes requests on your behalf. Websites see the proxy's IP address instead of yours. That simple idea powers a large part of the modern web: data collection, ad checks, price tracking, security filtering, and load balancing all rely on it. This guide explains how proxies work, the main types and protocols, how providers sell them, how to set one up and test it, and what to do when things go wrong. It starts with the basics and moves on to the technical details step by step.

What is a proxy, in plain English?

A proxy server is an intermediary. Instead of your computer talking directly to a website, it talks to the proxy, and the proxy talks to the website. The response travels back the same way.

A useful analogy is a mail forwarding service. You hand your letter to the service, it sends the letter from its own address, and it passes any reply back to you. The recipient sees the forwarding service's address, not your home address. The service can also read the outside of the envelope, decide where it goes, and keep records, which is why who runs the proxy matters.

The word "proxy" can refer to the server itself, to a single IP address you route traffic through, or to an access endpoint from a provider that hands out many IPs behind one hostname. In this guide, "proxy" means the general concept unless stated otherwise.

How a proxy works, step by step

Here is what happens when you load a page through a typical forward proxy:

1. Your client is configured to use the proxy. A browser, script, or app knows the proxy's hostname, port, and (usually) credentials.
2. The client connects to the proxy, not the target. It sends the request, such as "get https://example.com/page", to the proxy server.
3. The proxy authenticates you. It checks a username and password or confirms your IP address is on its allowlist.
4. The proxy picks an exit IP. A simple proxy has one IP. A provider gateway may choose an IP from a large pool based on your settings, such as country or session.
5. The proxy connects to the target site. The website receives a connection from the proxy's exit IP.
6. The response flows back. The site answers the proxy, and the proxy relays the response to your client.

What the target website sees

The website sees the exit IP and whatever the request contains. That includes headers such as User-Agent and Accept-Language, cookies, and, in a browser, a full fingerprint: screen size, fonts, time zone, and more. A proxy changes the network origin. It does not change who you appear to be at the browser level. That is why proxies are often paired with tools such as an antidetect browser when the browser identity matters.

Proxy headers and anonymity levels

Some proxies add headers that reveal they are proxies, or even reveal your original IP:

• X-Forwarded-For is a widely used de facto header that lists the original client IP and any proxies along the way.
• Via is a standard HTTP header (defined in RFC 9110) that intermediaries add to show the request passed through them.
• Forwarded is the standardized replacement for X-Forwarded-For, defined in RFC 7239.

Based on these headers, proxies are traditionally grouped into three anonymity levels:

Keep in mind that "elite" only describes headers. A site can still identify proxy traffic through IP reputation databases, hosting-provider IP ranges, or mismatches between your IP location and your browser settings.

With HTTPS traffic tunneled through a proxy (explained below), the proxy cannot inject headers into the encrypted request at all, so header-based leaks mainly affect plain HTTP.

Forward proxy vs reverse proxy

Both are intermediaries, but they serve opposite sides of the connection.

• A forward proxy acts for the client. It sends your requests out to the internet. Commercial proxy services, corporate web filters, and most of what this guide covers are forward proxies.
• A reverse proxy acts for the server. It sits in front of one or more web servers and receives requests from the internet on their behalf. Load balancers, content delivery networks, web application firewalls, and TLS termination layers are common reverse proxy setups.

When people buy "proxies" for scraping or ad verification, they are buying forward proxies. When a site runs behind a CDN, its visitors are talking to a reverse proxy.

Proxy protocols: HTTP, HTTPS, SOCKS4 and SOCKS5

The protocol defines how your client talks to the proxy. Most providers support at least HTTP and SOCKS5.

HTTP proxies

An HTTP proxy understands HTTP. For plain http:// URLs, the client sends the full URL to the proxy, and the proxy forwards the request. Because the proxy can read and modify the request, it can cache responses, filter content, or add headers.

HTTPS through an HTTP proxy (the CONNECT method)

For https:// URLs, the client sends a CONNECT request asking the proxy to open a raw TCP tunnel to the target host and port, for example CONNECT example.com:443. Once the proxy agrees, the client performs the TLS handshake directly with the website through that tunnel. The proxy sees the destination hostname and how much data flows, but not the encrypted content. Note that "HTTPS proxy" sometimes also means a proxy you connect to over TLS, which encrypts the hop between you and the proxy. Check which one a provider means.

SOCKS4 and SOCKS5

SOCKS proxies work at a lower level and simply relay traffic, so they can carry protocols other than HTTP.

• SOCKS4 supports TCP connections only, has no real password authentication, and cannot resolve hostnames on its own. The SOCKS4a extension added hostname support.
• SOCKS5, defined in RFC 1928, adds username and password authentication (RFC 1929), IPv6, hostname resolution on the proxy side, and a UDP ASSOCIATE command for relaying UDP traffic.

UDP support matters for things like DNS, some games, VoIP, and QUIC-based traffic. Not every provider enables UDP on SOCKS5 endpoints even though the protocol supports it, so confirm before you buy if you need it.

Proxy types by IP source

The most important difference between proxy products is where the IP addresses come from. Websites judge traffic partly by the type of network an IP belongs to, identified through its ASN (the autonomous system number of the network that announces it).

Residential proxies

Residential proxies route traffic through IP addresses that internet service providers assign to homes. To a website, the traffic looks like it comes from an ordinary household connection. Providers typically source these IPs from users who opt in through apps or SDKs, often in exchange for compensation or a free service. Residential pools are usually large and rotating, and they are sold per GB of traffic. See our residential proxy guide for tested options.

Mobile proxies

Mobile proxies use IPs from cellular carriers (4G and 5G). Carriers place many subscribers behind the same public IPs through carrier-grade NAT, so websites are cautious about blocking mobile IPs, since doing so could affect many real users. That makes mobile IPs the hardest type to block, and usually the most expensive. More in our mobile proxy guide.

ISP and static residential proxies

ISP proxies, often sold as static residential proxies, are IP addresses registered to consumer internet service providers but hosted on servers in data centers. You get the trust profile of a residential ASN with the speed and stability of server hosting, and the IP stays the same for as long as you rent it. They suit long sessions and account work. Some providers use the two terms interchangeably; others draw a line between them, so read the product details. See our ISP proxy guide and static residential guide.

Datacenter proxies

Datacenter proxies use IPs owned by hosting and cloud companies. They are fast, cheap, and plentiful, but their ASNs are easy to identify as non-residential, so stricter sites block or challenge them more often. They work well for targets with light protection and for high-volume, cost-sensitive jobs. See our datacenter proxy guide.

Shared vs dedicated IPs

Datacenter and ISP proxies are usually offered as:

• Shared: several customers use the same IPs. Cheaper, but another user's behavior can get an IP blocked on the sites you care about.
• Dedicated (private): the IPs are assigned to you alone for the rental period. More predictable reputation, higher price.

Some providers also offer "semi-dedicated" plans shared by a small number of users.

Comparison table

As a rule of thumb, datacenter IPs are usually far cheaper per GB or per IP than residential or mobile IPs, while residential and mobile IPs get blocked less often on strict sites. The right choice depends on the target, not on the type in isolation.

Rotating vs sticky sessions

A rotating proxy gives you a different exit IP automatically, either on every request or on a schedule. A sticky session keeps the same IP for a set time so that multi-step flows, such as logging in, adding to a cart, or paging through results, are not interrupted by an IP change.

Common rotation methods:

• Per request: each new connection gets a new IP. Useful for broad scraping where requests are independent.
• Timed sessions: the same IP is kept for a duration you choose, often from about a minute to several tens of minutes, depending on the provider.
• Session IDs: you add a session identifier (usually in the username) and get the same IP for as long as you reuse it, within the provider's time limit.
• On demand: for mobile and some static proxies, you call an API endpoint or URL to trigger a new IP.
• Static: the IP never rotates (ISP and dedicated datacenter proxies).

Residential sticky sessions can end early if the peer device behind the IP goes offline. Build retries into your code rather than assuming a session will last its full duration.

Geo-targeting options

Most providers let you choose where your exit IP is located. Targeting is usually set through parameters in the username or through different gateway ports. Typical levels, from broadest to narrowest:

• Country, available almost everywhere.
• State or region.
• City.
• ZIP or postal code, offered by some providers for some countries.
• ASN or carrier, meaning a specific ISP or mobile network.

Narrower targeting shrinks the pool of available IPs, which can mean slower connections, more repeated IPs, and sometimes a higher price. Geolocation databases also disagree with each other, so an IP sold as "Chicago" may show up as a nearby city on some lookup services.

Authentication and proxy endpoints

Providers use two main ways to confirm that you are allowed to use their proxies.

• Username and password. Credentials are sent with each connection (for HTTP proxies, in the Proxy-Authorization header). This works from any network and lets you pass settings such as country and session in the username.
• IP allowlisting (whitelisting). You register your server's public IP in the provider's dashboard, and connections from that IP are accepted without credentials. This is convenient for tools that do not support proxy authentication, but it breaks if your own IP changes.

A proxy is usually described as a URL, or as a host:port:user:pass string. Examples with placeholder values:

http://user:pass@gate.example.com:7777
socks5://user:pass@gate.example.com:1080
gate.example.com:7777:user:pass

Many providers encode options in the username. The exact format varies, but it often looks something like this:

http://user-country-us-session-abc123:pass@gate.example.com:7777

Here the username asks for a US exit IP and a sticky session called abc123. Always check your provider's documentation for its exact syntax.

How proxies are priced

Pricing models differ by proxy type. In general terms:

• Per GB (bandwidth): you pay for traffic. Standard for residential and mobile pools. Larger plans usually lower the per-GB rate.
• Per IP: you rent a fixed number of IPs, usually monthly, often with unlimited or generous bandwidth. Standard for ISP and datacenter proxies.
• Per port or thread: you pay for concurrent connections rather than traffic or IPs. Common for some mobile and rotating datacenter products.
• Unlimited: flat fee for unlimited traffic, usually limited by speed, concurrency, or a fair-use policy.

When comparing plans, estimate your real traffic first. A page with images and scripts can weigh a few megabytes, while an API response may be a few kilobytes. Blocking images and unneeded resources can cut per-GB costs considerably. Also check whether failed requests count toward your bandwidth and whether unused traffic expires at the end of the billing period.

Common use cases

• Web scraping and data collection. Spreading requests across many IPs avoids per-IP rate limits and makes large crawls possible. If you would rather not manage proxies, retries, and rendering yourself, a scraping API bundles them into one request.
• Ad verification. Advertisers and agencies check how ads appear in different locations and whether they are shown on the intended sites, which requires viewing pages from real local IPs.
• SEO and SERP monitoring. Search results vary by location. Proxies let teams check rankings as a user in a given country or city would see them.
• Price and product monitoring. Retailers and brands track competitor prices, stock levels, and listings, which often differ by region.
• Multi-account management. Social media managers and e-commerce sellers keep each account on its own stable IP, usually combined with separate browser profiles. Always follow each platform's rules.
• Brand protection. Companies look for counterfeit products, trademark misuse, and unauthorized resellers across marketplaces and regions.
• Market research. Collecting public reviews, listings, and travel fares across markets.
• Testing geo-specific content. Developers and QA teams verify localization, geo-blocking, pricing pages, and app behavior in other countries.

Proxy vs VPN vs Tor

All three change the IP address a website sees, but they are built for different jobs.

Tor routes traffic through three relays (guard, middle, and exit), so no single relay knows both who you are and where you are going. Its exit IPs are public and widely blocked, which makes it a poor fit for business data collection. A VPN protects all of your traffic but gives you few IPs to work with. A proxy gives you the most control over IPs, which is why it is the standard tool for automation.

Free vs paid proxies

Free public proxy lists are easy to find, but they carry real risks:

• Security. You do not know who runs the server. A malicious operator can log your traffic, inject ads or scripts into plain HTTP pages, or try to intercept credentials.
• Reliability. Free proxies go offline often, are slow, and are frequently already blocked by popular sites.
• Unknown origin. Some open proxies are misconfigured or compromised machines. Routing traffic through them can cause legal and ethical problems.

Paid services offer authentication, support, known terms, and pools that are maintained. Many offer a trial or a small starter plan, which is a safer way to experiment than a free list.

Ethics, legality, and compliance

Using a proxy is legal in most jurisdictions. The legal questions are about what you do through it and where the IPs come from. This section is general information, not legal advice; consult a lawyer for your specific situation.

How residential IPs are sourced

Residential and mobile IPs belong to real people's connections. Ethically run networks obtain explicit, informed consent from those users, usually through an opt-in in an app or SDK, often with compensation, and let them withdraw at any time. Some networks in the past were built from malware or bundled software that users never knowingly agreed to. When choosing a provider, look for a clear explanation of how its IPs are sourced, published consent flows, and limits on how peers' devices and bandwidth are used.

Know-your-customer (KYC) checks

Many reputable providers verify customers' identity and intended use before granting residential or mobile access, and some restrict certain targets such as banking or government sites. This can feel like friction, but it reduces abuse of the network and of the people whose IPs it uses.

Terms of service and access rules

A website's terms of service may restrict automated access, and laws on unauthorized computer access, copyright, and database rights vary by country. Scraping publicly available data is treated differently from bypassing logins or technical barriers. Respect rate limits, avoid overloading servers, and stay away from content behind authentication unless you are allowed to access it.

GDPR and personal data

Under the EU's GDPR, IP addresses and other information that can identify a person can count as personal data. If you collect personal data, such as names, profiles, or reviews linked to people, you need a lawful basis, must limit what you collect, and must handle it securely. Data protection rules apply whether or not you use a proxy.

How to choose a proxy provider

Use this checklist when comparing services. Our review process explains how we test these points, and the proxy provider directory lets you compare them side by side.

• Pool size claims. Large numbers are common in marketing. What matters is how many usable IPs exist in the locations you need, and how often you see repeats.
• Success rates and speed. Test against your actual targets. Response times and block rates vary widely by site and location.
• Targeting. Confirm the country, city, and ASN options you need, and check how many IPs are actually available at that level.
• Protocols. HTTP and SOCKS5 support, UDP if you need it, and IPv6 if relevant.
• Session control. Sticky session length, session IDs, and on-demand rotation.
• Pricing model. Per GB vs per IP, minimum commitments, whether traffic expires, and how failed requests are billed.
• Trial and refund policy. A trial or small plan lets you test before committing.
• Compliance. IP sourcing transparency, KYC, and acceptable-use rules.
• Support. Response times and technical depth when something breaks.
• Dashboard and API. Usage statistics, sub-users, credential management, and an API for automation.

How to set up and test a proxy

Browser and operating system settings

• Windows: Settings, then Network and Internet, then Proxy, then set up a manual proxy server.
• macOS: System Settings, then Network, then select your connection, then Details, then Proxies.
• Browsers: Chrome and Edge use the operating system's proxy settings by default. Firefox has its own settings under Network Settings. Browser extensions can switch between proxies per profile.

System-wide proxy settings often do not support credentials well, so IP allowlisting or a browser extension is usually easier for manual browsing. For automation, configure the proxy in your code instead.

Test with curl

The -x option tells curl which proxy to use. The test endpoint below returns the IP address the site sees:

curl -x http://user:pass@gate.example.com:7777 https://httpbin.org/ip

If the proxy works, the origin value in the response shows the proxy's exit IP rather than yours. Run it twice with a rotating endpoint and you should see two different IPs. For SOCKS5, use socks5h:// so DNS lookups also happen on the proxy side:

curl -x socks5h://user:pass@gate.example.com:1080 https://httpbin.org/ip

Test with Python

With the requests library, pass a proxies dictionary:

import requests

proxy = "http://user:pass@gate.example.com:7777"
proxies = {"http": proxy, "https": proxy}

response = requests.get("https://httpbin.org/ip", proxies=proxies, timeout=15)
print(response.json())

For SOCKS proxies, install the extra dependency with pip install "requests[socks]" and use a socks5h:// URL. Always set a timeout so a slow proxy does not hang your script.

Common problems and troubleshooting

407 Proxy Authentication Required

The proxy did not accept your credentials. Check for typos, make sure special characters in the password are URL-encoded, confirm that targeting parameters in the username match the provider's format, and check that your plan is active. If you use IP allowlisting, confirm your current public IP is on the list.

Connection refused or timeouts

Check the hostname and port, and make sure the protocol matches the port (an HTTP client pointed at a SOCKS port will fail). Firewalls on corporate networks sometimes block outbound proxy ports.

Blocks, 403 errors, and CAPTCHAs

If a site keeps blocking you:

• Slow down and add random delays. Too many requests per IP is the most common cause.
• Switch to a higher-trust IP type, for example from datacenter to residential or ISP.
• Use realistic, consistent headers. A mobile User-Agent on a datacenter IP, or a browser language that does not match the IP's country, looks suspicious.
• Keep a sticky session for multi-step flows, and rotate between independent tasks.
• For sites that rely on JavaScript challenges, use a real browser or a scraping API, since proxies alone do not solve browser checks.

Slow speeds

Residential and mobile IPs depend on the peer device's connection, so speeds vary. Choose gateways close to your server, avoid overly narrow targeting, reuse connections where your client supports it, and compare speeds across providers during a trial.

IP leaks: WebRTC and DNS

Even with a proxy configured, your real IP can leak:

• WebRTC in browsers can reveal your real public IP address through its connection setup, because it may open connections outside the proxy (modern browsers usually hide local network addresses). Disable or restrict WebRTC, or use a browser setup that manages it.
• DNS leaks happen when hostname lookups go through your own network instead of the proxy. With SOCKS5, use remote DNS resolution (for example socks5h:// in curl and Python).
• Apps that ignore proxy settings send traffic directly. Check each application rather than assuming system settings apply everywhere.

Test for leaks by visiting an IP-check page and a WebRTC and DNS leak test page with your proxy enabled.

Glossary

• ASN (autonomous system number): an identifier for a network operator, such as an ISP or hosting company. Websites use it to tell residential IPs from datacenter IPs.
• Backconnect / gateway: a single endpoint that routes your traffic through IPs from a large pool.
• CGNAT (carrier-grade NAT): a technique that puts many users behind one public IP, common on mobile networks.
• CONNECT: the HTTP method that asks a proxy to open a tunnel, used for HTTPS.
• Elite proxy: a proxy that sends no headers revealing either your IP or the use of a proxy.
• Exit IP: the IP address the target website sees.
• Forward proxy: a proxy acting for clients that send requests out to the internet.
• IP allowlisting: authenticating by your source IP instead of a password.
• Pool: the set of IPs a provider can route your traffic through.
• Reverse proxy: a proxy acting for servers, such as a load balancer or CDN.
• Rotation: automatically changing the exit IP between requests or over time.
• SOCKS5: a general-purpose proxy protocol that relays TCP and, where enabled, UDP traffic.
• Sticky session: keeping the same exit IP for a set period.
• Subnet: a block of related IP addresses. Sites sometimes block a whole subnet at once.
• X-Forwarded-For: a header that can reveal the original client IP to the target site.

Next steps

Now that you know how proxies work, compare real services in the proxy provider directory, or go straight to a type: residential, mobile, ISP, static residential, or datacenter. If you would rather not manage proxies yourself, read what a scraping API is. For multi-account work, see what an antidetect browser is. And to understand how we rate providers, read our review process.