What Is a Proxy Server? How It Works, Types and When You Need One

The word gets used for everything from a corporate web filter to a rotating pool of millions of home IPs. Underneath, they all do the same thing: accept a request from one machine and repeat it from another. This guide explains that hop, the ways proxies are classified, and how to tell which one a job actually needs.

How a proxy server works

1. 1Your client — a browser, a script, an app — is configured with the proxy's address and port.
2. 2Instead of connecting to the website, the client connects to the proxy and says where it wants to go.
3. 3The proxy opens its own connection to the website, from its own IP address.
4. 4The website answers the proxy, and the proxy relays the response back to you.

For an HTTPS site the proxy does not read the page. The client sends a CONNECT request naming the host, the proxy opens a raw tunnel, and the TLS handshake happens between your client and the website through that tunnel. The proxy sees which host you connected to and how much data moved — not the URLs, headers or content inside.

Types of proxy servers by IP origin

This is the classification that changes outcomes. Websites and anti-bot systems look up who owns an address — its ASN — and treat hosting networks very differently from consumer ones.

The trade-off runs in one direction: the more a site trusts an address, the scarcer and more expensive it is. The residential vs datacenter vs ISP comparison works through the cost of the same job on each, and it is often cheaper than people expect to stay on datacenter.

Types by protocol: HTTP, HTTPS and SOCKS5

• HTTP proxies understand web requests. They can forward plain HTTP and tunnel HTTPS with CONNECT, which covers browsers, scrapers and nearly every HTTP library.
• HTTPS proxies are HTTP proxies you connect to over TLS, so the hop between you and the proxy is encrypted as well. Useful on untrusted networks; not every client supports them.
• [SOCKS5](/blog/what-is-a-socks5-proxy) works a layer lower and forwards any TCP connection — and UDP where supported — without caring what protocol runs inside. It is the choice for non-web traffic such as game clients, mail or custom protocols.

For ordinary web work the protocol rarely decides success; the IP origin does. The detailed trade-offs are in HTTP vs SOCKS5 proxies.

Forward proxy vs reverse proxy

When a site sits behind Cloudflare, your forward proxy connects to Cloudflare's reverse proxy, which then decides whether to pass the request to the real server. That second layer is where most blocks happen — the Cloudflare 1020 and 1015 errors are the reverse proxy saying no.

Transparent, anonymous and elite proxies

Older guides grade proxies by the headers they add. A transparent proxy forwards your real IP in X-Forwarded-For and announces itself with a Via header. An anonymous proxy hides your IP but still admits it is a proxy. An elite or high-anonymity proxy adds nothing at all.

What a proxy server does not do

• It does not encrypt your traffic. HTTPS stays encrypted end to end, but anything you send over plain HTTP is visible to the proxy operator.
• It does not cover your whole device. Only the apps you point at it use it. Your system, other programs and often DNS lookups still go direct — which is the main practical difference from a VPN.
• It does not hide your browser. Cookies, logins and your browser fingerprint travel through the proxy untouched. A new IP with the same cookies is still you.

When you actually need a proxy

If none of these apply and you only want privacy on public Wi-Fi, a VPN is usually the simpler tool. Proxies earn their place when you need many addresses, specific addresses, or control over which app uses which one.

Free proxies: why they are a bad trade

Public proxy lists are full of misconfigured servers and deliberate traps. Their addresses are shared by thousands of strangers, so they are usually already banned where you want to use them, and the operator can read every unencrypted request and inject content into it. If the goal is a test, a single gigabyte of residential bandwidth costs about as much as a coffee and tells you far more. See how to test proxy quality for what to measure.

How to set one up

Every proxy comes down to four values: host, port, username and password — or a whitelisted IP instead of the credentials. Where you enter them depends on the client.

# Quick check from any terminal: which IP does the site see?
curl -x http://USERNAME:PASSWORD@PROXY_HOST:PROXY_PORT https://api.ipify.org

• Browsers — system proxy settings, or a per-profile proxy in an anti-detect browser.
• Python — the proxies argument in requests, or middleware in Scrapy.
• Headless browsers — the launch options in Playwright, Puppeteer or Selenium.
• Everything else — the integrations directory has copy-paste setups for common tools.

If the connection fails immediately, the error message usually says which leg broke. ERR_PROXY_CONNECTION_FAILED means the proxy was never reached; a 407 means it was reached and refused your credentials.