What Is a Proxy Server? How Proxies Work, Types and Uses

Explainer · Last reviewed 22 October 2026 · 14 min read

A proxy server is a computer that sits between your device and the internet and makes requests on your behalf, so the websites you visit see the proxy’s IP address instead of yours. Think of someone who places an order for you: the shop deals with them and sees their address, not yours. This guide explains how a proxy server works step by step, the difference between forward and reverse proxies, the main types, how proxies compare with VPNs and Tor, what they are used for, and how to set one up and check it. If you only need to change a setting on your device, start with our guide to proxy settings.

What Is a Proxy Server?

In networking, a proxy is a server that handles requests for its clients by forwarding them to other servers. NIST’s glossary uses almost exactly those words. Your browser, app or script connects to the proxy instead of to the website. The proxy opens its own connection to the website, sends the request, receives the response and hands it back to you. From the website’s side, the visitor is the proxy.

The word “proxy” also has a legal meaning, someone authorised to act or vote for you, and the idea is the same: a stand-in. This guide is only about the networking sense.

A proxy works at the level of individual applications and connections. You point one browser, one tool or one script at it, and only that traffic goes through the proxy. Everything else on the device keeps using your normal connection unless you set the proxy system-wide.

How Does a Proxy Server Work? Step by Step

Every proxy connection follows the same four steps. Your app connects to the proxy’s host and port and, if the proxy needs it, logs in. The proxy reads where you want to go, looks up the website’s address and opens its own connection to it. The website answers the proxy. The proxy relays that answer back to you.

your app
   |  1. connects to the proxy
   |     and logs in
   v
proxy
   |  2. looks up the website and
   |     opens its own connection
   v
website
   |  3. sees the proxy's IP address
   |  4. answers; the proxy relays
   v     the response back
your app

A plain HTTP request through a proxy

For an unencrypted http:// page, your app sends the proxy the full address of the page it wants, for example GET http://example.com/page. HTTP/1.1 calls this the absolute form. Because the request is in plain text, the proxy can read it, change it, cache the response for the next visitor or block it. This is how office and school proxies filter sites and how caching proxies save bandwidth.

HTTPS through a proxy: the CONNECT tunnel

Most of the web now uses HTTPS, and here the proxy works differently. Your app asks the proxy to open a tunnel with CONNECT example.com:443. The proxy connects to that host and port and replies with a 200 status, often worded Connection established. From then on it only relays encrypted bytes: the TLS connection runs end to end between your app and the website. The proxy sees the host name, the port and how much data moves, but not the pages, form data or cookies.

The exception is TLS inspection. Some corporate networks decrypt HTTPS at the proxy, but that only works because the company installs its own root certificate on every work device. Without that certificate the browser shows a warning instead of loading the page.

The HTTP standard (RFC 9110) also tells proxies to limit CONNECT to a known set of ports, because a tunnel to the mail port 25 could trick the proxy into relaying spam. That is why many proxy services open only ports 80 and 443.

Logging in to a proxy

A private proxy needs to know who you are. With HTTP proxies, the proxy answers an anonymous request with status 407 Proxy Authentication Required, and your app repeats the request with a Proxy-Authorization header that carries your username and password. Basic authentication is only base64 encoding, not encryption, so the login is readable on the hop between you and the proxy unless that hop is itself encrypted. The other common method is an IP allow list, where the proxy accepts any connection from an approved address. ProxyEmpire uses a username and password on every product and offers no IP allow list, so the same login works from any device or network.

SOCKS5 in one paragraph

A SOCKS5 proxy relays raw connections instead of web requests, so it works for any application that supports it, not only browsers. After a short handshake, which can include a username and password, your app tells the proxy which host and port to connect to and the proxy carries the traffic. With SOCKS5 you can choose who looks up the website’s address: in curl, socks5:// resolves the name on your machine and socks5h:// lets the proxy do it. Our SOCKS proxy guide covers the protocol in depth, and SOCKS vs HTTP compares the two.

Who sees what

A proxy moves the point where your traffic becomes visible; it doesn’t make it invisible. This table shows what each party can see when you browse through a typical forward proxy.

Forward Proxy vs Reverse Proxy

A forward proxy works for clients. You, or your company, choose to send traffic through it, and it reaches out to the internet on your behalf. Office web filters, caching proxies and the proxy networks businesses rent are all forward proxies.

A reverse proxy works for servers. It sits in front of a website, receives visitors’ requests and passes them to the servers behind it. Visitors usually don’t know it is there. Websites use reverse proxies for load balancing across many servers, caching, handling HTTPS certificates, and absorbing attacks before they reach the application. Content delivery networks are the best-known example. The HTTP standard calls this role a gateway.

There is a third case: a transparent or interception proxy, which a network places in your path without your device being configured for it, often on public or corporate Wi-Fi. Our guides to forward vs reverse proxies and transparent proxies go further.

Types of Proxy Servers

Lists of “12 types of proxy” usually mix different questions together. It is clearer to sort proxies by one question at a time: which protocol they speak, where their IP addresses come from, how much they reveal, how long you keep an IP and who else uses it.

By protocol

• HTTP proxies handle web requests. They read plain HTTP and tunnel HTTPS with CONNECT, which covers browsers, scrapers and most tools.
• HTTPS proxies usually means HTTP proxies that tunnel HTTPS. In the strict sense it is a proxy you connect to over TLS, so even your login is encrypted.
• SOCKS5 proxies relay any TCP connection for applications that support them. See SOCKS5 proxies for how they are sold and set up.
• DNS proxies forward domain-name lookups rather than web traffic; our DNS proxy guide explains them.

By where the IP address comes from

For anyone renting proxies, this is the question that matters most, because websites treat each kind of address differently.

Mobile carriers put many subscribers behind each public address using carrier-grade NAT, which is why one mobile IP is shared by so many people; our explainer on CGNAT covers how that works. For the detail on each kind, read what residential proxies are, what mobile proxies are and what static residential proxies are, or the side-by-side comparison of residential, mobile and datacenter proxies.

ProxyEmpire sells all of them: rotating residential (30M+ IPs), rotating mobile (4M+ 4G/5G IPs), ISP / static residential in 24 countries, rotating datacenter in 62 countries, plus unlimited residential, billed by connection speed instead of per GB, and dedicated mobile, a private 4G/5G device.

By anonymity

Proxies differ in what they tell the website about you. The HTTP standard requires a proxy to identify itself in a Via header, and many proxies also pass your original IP in X-Forwarded-For or the standard Forwarded header.

• Transparent proxies pass your real IP along, so the website still knows who you are. (The same word is also used for interception proxies, described above.)
• Anonymous proxies hide your IP but still reveal that a proxy is in use.
• Elite or high-anonymity proxies send neither your IP nor obvious proxy headers.

ProxyEmpire’s gateways don’t forward your own IP address to the websites you visit. Our guide to proxy anonymity levels shows how to test any proxy for these headers.

By session: rotating, sticky and static

A rotating proxy gives you a new IP for every request or at intervals, which spreads a large job across many addresses. A sticky session keeps the same IP for a while, for tasks such as staying logged in. A static proxy keeps one IP for as long as you rent it.

Commercial proxy networks usually give you one gateway address instead of a list of IPs, and you choose the location and session in the username. With ProxyEmpire, rotating residential and mobile proxies all use v2.proxyempire.io on port 5000; adding -country-us to the username selects the United States, and -sid-123456 holds a sticky session. You build the full username in the dashboard’s Connection Builder and copy it:

curl -x http://USERNAME-country-us-sid-123456:PASSWORD@v2.proxyempire.io:5000 https://ipinfo.io/json

More on choosing between them in sticky vs rotating proxies, and on how networks manage their addresses in proxy pools.

By who else uses it

Public or open proxies are free and used by anyone who finds them; the risks are covered below. Shared proxies are paid IPs that several customers use. Private or dedicated proxies are assigned to one customer; see what private proxies are.

Proxy vs VPN vs Tor

All three put another IP address between you and the website, but they work at different levels and protect different things.

NIST describes a VPN as a virtual network built on top of existing networks that carries data securely, and the Tor Project explains that Tor sends traffic through a random path of relays so no single point knows both ends. A proxy is the lightest of the three: it does one job, changing the route and IP for the traffic you send through it. For a deeper comparison see residential proxies vs VPNs, Tor proxies explained and six ways to hide your IP address. Two related setups: a proxy firewall is a proxy whose main job is security filtering, and proxy chaining sends traffic through several proxies in a row.

What Proxy Servers Are Used For

Organisations run forward proxies to control and record web access: blocking malware and unwanted sites, caching common downloads, and logging traffic for security reviews.

Websites run reverse proxies to stay fast and available: spreading load across servers, caching pages near visitors, managing HTTPS certificates and filtering attack traffic.

Businesses rent proxy networks to see the web the way visitors in other places see it. Common jobs include:

• collecting public web data for analysis and AI training, covered in web scraping 101;
• price monitoring across countries and shops;
• checking search rankings by city with SEO proxies;
• confirming that ads show correctly in each market with ad verification proxies;
• finding counterfeit listings for brand protection;
• testing localised sites and apps, and academic research.

Individuals use proxies to keep their own IP address away from the sites they visit, or to check how a page looks from another country.

Whatever you use a proxy for, the website’s terms and the law where you are still apply.

Risks of Free and Public Proxies

Whoever runs a proxy can see the traffic it carries and, for plain HTTP, change it. With a public proxy you don’t know who that is. Researchers have measured what happens:

• A study presented at NDSS 2018 monitored open HTTP proxies for two months and found that 38% modified the content passing through them, and 5.15% of the proxies tested did so maliciously, mostly by injecting ads or tracking code, and sometimes by redirecting users to pages containing malware.
• A 2018 study of more than 107,000 listed open proxies over 50 days found that more than 92% didn’t respond at all. Among those that did, the researchers observed cryptocurrency-mining code injected into pages, TLS man-in-the-middle attacks and downloaded files modified to include remote-access trojans.

Two more risks apply to any proxy you don’t trust: a proxy login sent with Basic authentication, or a SOCKS5 username and password, travels unencrypted unless the link to the proxy is encrypted, and plain HTTP pages are fully readable by the operator. If you test proxies at all, use HTTPS sites only and never log in to accounts that matter through a proxy you can’t vouch for.

How to Choose a Proxy Server

As a worked example, here is how ProxyEmpire answers those questions. Rotating residential and mobile plans include targeting by country, region, city, ZIP, ISP or carrier, ASN and OS fingerprint at no extra charge; static and datacenter proxies target by country. All six proxy types work over HTTP, HTTPS and SOCKS5 on one host, port and login. Only ports 80 and 443 are open by default, port 25 is never opened, and some site categories, such as payment and banking services, are blocked on every proxy type. Unused bandwidth rolls over, support is available 24/7 from real people, and uptime is published on the status page. Current plans are on the pricing page.

How to Set Up a Proxy

Every proxy setup asks for the same details: the host (a name or IP address), the port, the protocol (HTTP, HTTPS or SOCKS5) and, for private proxies, a username and password. Where you enter them decides what goes through the proxy:

• System-wide: Windows 11 has it under Settings, Network & internet, Proxy, and macOS under System Settings, Network, Details, Proxies. Many apps follow these settings. Our Windows proxy guide walks through it.
• Per network or phone: the proxy option in Wi-Fi settings, explained in our Wi-Fi proxy guide, with step-by-step setups for iPhone and Android.
• Per browser: Firefox has its own proxy settings, while Chrome uses the system’s; see our Chrome and Firefox guides, or use a browser extension.
• Per tool or script: scrapers, anti-detect browsers and code take the proxy as a setting or a URL, like the curl example above; our curl proxy guide covers the options.

Some networks hand out proxy settings automatically with a PAC file, a small script that tells the browser which addresses to send through which proxy. For ProxyEmpire users, the free ProxyEmpire Proxy Manager extension for Chrome (it also works in Edge and Brave) and the free Android app fill in these details for you. If you juggle many proxies, a proxy manager keeps them organised.

How to Check That a Proxy Works

Seeing the proxy in your settings doesn’t prove traffic goes through it. Load an IP lookup page with and without the proxy and compare the address, country and ISP. To test several proxies at once, our free proxy checker tests up to 100 HTTP, SOCKS4 or SOCKS5 proxies for status, speed, country and ISP.

If a request fails, the error usually says why. A 407 means the proxy wants a login or rejected yours; a refused connection usually means the wrong host, port or protocol. Our guide to proxy error codes lists the common ones and their fixes.

Proxy Server FAQ

References

1. RFC 9110: HTTP SemanticsIntermediaries (proxy, gateway, tunnel, interception proxy), CONNECT, Via, Proxy-Authorization and 407
2. RFC 9112: HTTP/1.1Absolute-form and authority-form requests to proxies
3. RFC 7239: Forwarded HTTP ExtensionThe standard Forwarded header and its privacy considerations
4. RFC 1928: SOCKS Protocol Version 5SOCKS5 handshake and commands
5. RFC 1929: Username/Password Authentication for SOCKS V5SOCKS5 login, sent in cleartext
6. MDN: Proxy servers and tunnelingForward and reverse proxies, CONNECT tunnels, PAC files
7. MDN: X-Forwarded-ForHow proxies pass on the client’s IP address
8. NIST CSRC Glossary: proxy serverFormal definition
9. NIST CSRC Glossary: virtual private networkFormal definition of a VPN
10. Tor Project: How Tor worksCircuits of relays and layered encryption
11. everything curl: SOCKS proxysocks5 vs socks5h name resolution
12. Microsoft Support: Use a proxy server in WindowsWindows 11 and 10 proxy settings
13. Apple Support: Change proxy settings on MacmacOS proxy settings
14. Tsirantonakis et al., NDSS 2018A Large-scale Analysis of Content Modification by Open HTTP Proxies
15. Mani, Vaidya, Dworken and Sherr, 2018An Extensive Evaluation of the Internet’s Open Proxies