What is a proxy server and how does it work?

9 November 2026

A proxy is an intermediary server that connects to websites on your behalf. Your program sends its request to the proxy, the proxy opens the connection to the site, and the reply comes back the same way. The site therefore sees the proxy's IP address, not yours.

The definition in the HTTP standard

The HTTP semantics specification, RFC 9110, section 3.7, defines a proxy as a message-forwarding agent chosen by the client, usually through local configuration. The key words are "chosen by the client". You set up the program or device to use it, and the site only learns about it from what reaches it.

The same specification separates three kinds of intermediary. A proxy is picked by the client. A gateway, or reverse proxy, is placed in front of a site's servers by whoever runs the site.

A tunnel passes bytes along without reading them. The first two are compared in Forward vs reverse proxy.

How a request travels through a proxy

Say you have set your browser to use a proxy and you open a website. This is what happens, in order:

1. The browser opens a TCP connection to the proxy's address and port, not to the website.
2. The browser tells the proxy where it wants to go. With an HTTP proxy it puts the full URL in the request line or sends a CONNECT request. With SOCKS5 it sends the destination name and port in a short binary message.
3. If the proxy requires authentication, the browser sends a username and password. See Proxy authentication for how that works.
4. The proxy resolves the site's name to an address if needed, then opens its own connection, from its own IP, to the site's server.
5. The site replies to the proxy, and the proxy passes the reply back to the browser over the first connection.

The result is two separate connections: one between you and the proxy, and one between the proxy and the site. The site only ever sees the second.

What proxies are used for

The uses vary, but they come down to two things: changing where a connection leaves for the internet, or gathering traffic at one point where it can be controlled. For example:

• Seeing a site or app the way users in another country see it, since many services differ by the country of the address.
• Testing your own site or advert from different networks before it goes live.
• Spreading the requests of public data collection scripts across different exit addresses.
• Filtering staff traffic and caching frequently requested pages inside a company.
• Separating one program from the rest of the device, so it exits from one address while everything else keeps your normal connection.

Types of proxy by protocol

"Proxy" covers several protocols. They differ in how much of your traffic the proxy understands, and in whether the path between you and the proxy is encrypted.

The protocol details are in SOCKS5 vs HTTP proxy. How the tunnel works, and what encrypting the path to the proxy changes, is in CONNECT and HTTPS proxies.

Who sees what

A proxy moves the point where your traffic leaves for the internet. It does not hide everything from everyone. What each party sees depends on the type of proxy and on whether the site itself uses encryption:

• Your internet provider sees that you are connected to the proxy, and how much data moves and when. With an unencrypted proxy it also sees site names, and the content of any page not served over https.
• The proxy sees your real address and the names of the sites you request. For https sites it does not see the content, because the encryption runs from your browser to the site itself.
• The site sees the proxy's address. It can still learn yours if the proxy adds headers that carry it, or if the browser exposes it some other way, such as WebRTC.

The headers a proxy may add are well defined. RFC 9110 requires a proxy to add a Via header to messages it forwards.

RFC 7239 defines the Forwarded header, which can carry the client's address. These can only be added to plain HTTP requests: a proxy cannot change a request inside a TLS tunnel.

A proxy is not a VPN

A proxy works per program. Anything you have not configured keeps using your normal connection, and some programs ignore the system proxy setting altogether. A VPN instead creates a network interface on the device and carries all of its traffic at the IP packet level.

So a proxy suits one program, a script or a browser, while a VPN suits the whole device. The full picture is in What is a VPN.

How to test a proxy yourself

The simplest test is to request a page that shows your address, once without the proxy and once through it. With curl it looks like this, using your own proxy host and port:

curl https://ifconfig.me
curl -x http://proxy.example.com:8080 https://ifconfig.me
curl -x socks5h://proxy.example.com:1080 https://ifconfig.me

The last two lines should print a different address from the first. If they match, the request did not go through the proxy. In a browser, open the My IP tool before and after turning the proxy on, and compare the address, the network (ASN) and the country.

To see which headers actually reach a site, use the HTTP headers tool. If your real address shows up there, the proxy is passing it on.

How to choose a proxy

• Encryption to the proxy. On a network you do not trust, such as café Wi-Fi, use an HTTPS proxy or another encrypted connection. HTTP and SOCKS5 send the destination and your password in the clear.
• Where names are resolved. If site names are resolved on your device, your local DNS server may see the sites you visit. See DNS leaks.
• Type of address. Data center, residential and mobile addresses each have a different reputation with websites. See Residential, data center and mobile proxies.
• Logging. The proxy sees your address and your destinations, so read what the provider says about recording them and for how long.
• Authentication. An open proxy with no password is used by anyone who finds it, and its address may well be blocked or watched.

Proxies at syriaproxy

We offer SOCKS5, HTTP and HTTPS proxies for programs, exiting from the Syriatel 4G network inside Syria. Names are resolved inside Syria by Syriatel's resolvers.

Our SOCKS5 and HTTP proxies are unencrypted, like any proxy of those types, while the HTTPS proxy is encrypted. Setup is described in Proxy setup.

FAQ

Test the proxy you use with the free proxy checker: whether it works, how fast it answers, and its exit address.