HTTPS protects content when the certificate is verified correctly, yet an unknown intermediary remains a poor choice for banking, email and software installation.
What the operator can see and alter
A proxy is an intermediary server that passes requests from applications to websites. It knows your IP address (the network address of your connection) and the destination addresses. There is a separate explanation of when a proxy really does hide your IP.
HTTP (the protocol for transferring web data) does not encrypt content. HTTPS (the secure protocol for transferring web data) encrypts the connection to the website by means of TLS (transport layer security).
| Situation | What is available to the operator | Possibility of interference |
|---|---|---|
| Website over HTTP | Addresses, pages, passwords you enter | Altering text, inserting adverts or scripts, and swapping files |
| Website over HTTPS through a configured proxy | Your IP and the destination address; the content is protected | Blocking the connection; reading it requires an additional capability to intercept TLS |
| Website inside a web proxy page | The requests and content that the intermediary fetches on your behalf | Alteration of the displayed page |
A web proxy itself fetches the page at the address you enter. The HTTPS in its address bar protects the connection to the intermediary, but the fetched page is available to the operator. You should not enter passwords through an unknown web proxy.
In an ordinary HTTPS tunnel, the content is protected. Interception is possible if the intermediary's trusted certificate has been installed or an invalid certificate has been accepted. A certificate confirms whom the connection has been established with; a service asking you to install its own certificate changes the trust model.
Encrypting the segment up to the proxy does not automatically protect the segment up to the website. The operator can also log details of connections. This single point of trust is described by the Tor Project.
What was found in open proxies
In a 2018 study of open proxies, more than 107,000 open proxies were tested: 13 million requests over 50 days. More than 92% of the addresses in the lists did not respond.
About 8% of the working proxies returned unexpected content at least occasionally, and 3.6% did so consistently. Not every discrepancy was an attack: sign-in pages and errors were also encountered. The researchers did, however, find cryptocurrency-mining scripts, man-in-the-middle TLS interception, and programs with remote-access trojans instead of the original downloads.
The percentages relate only to open proxies from lists in 2018. They do not describe the current situation, nor paid and corporate proxies.
When using a proxy is justified
Open proxies from free lists are the least predictable: a working server does not prove the owner's good faith.
| Option | Suitable task | Limitation |
|---|---|---|
| Your organisation's proxy | Access to work resources according to the IT department's settings | Not intended for privacy from the organisation |
| Your own proxy | Passing requests through a server you control | Requires updates and restricted access |
| A proxy from a known operator in another country | Checking a regional version of a site without signing in to an account | Trust in the operator is still required |
You can check the British version of a site's catalogue through a known operator with an exit in the United Kingdom, without signing in to an account.
How to reduce the risk when connecting
- Open only HTTPS sites with a valid certificate.
- Do not sign in to your bank or email through an unknown proxy.
- Do not download or update software through a free proxy.
- Do not click through browser warnings about certificates.
- Do not install certificates at the request of an unknown proxy service.
- Choose an operator with a clearly stated policy on collecting and storing data.
If an intermediary is needed for all of a device's traffic, it is worth choosing an operator with a published data policy. CitadelVPN's privacy policy dated 29 July 2026, for example, lists what the operator states it does not store; the service itself is described at CitadelVPN.
According to that policy, the operator does not store browsing history, traffic content, DNS queries (domain name system queries), original or exit IP addresses, or connection timestamps. Email, account status and limits, payment confirmations and support enquiries are processed separately. This is the operator's own statement, not the result of an independent audit. A VPN does not replace HTTPS or verifying a website's authenticity.
Frequently asked questions
Is a paid proxy safer than a free one?
Paying does not prove this. Check the owner, reputation and data retention terms. The study of open proxies did not assess paid services.
Does SOCKS5 encrypt the connection?
SOCKS5 (a protocol for relaying network connections, version 5) does not in itself guarantee encryption. Under RFC 1929, ordinary username and password authentication transmits the password in plain text. Where interception is possible, additional protection of the channel to the proxy is needed. The site's HTTPS does not protect that password.
Is a proxy safer than Tor?
Tor distributes trust across at least three nodes: no single node knows both the source address and the destination. In the 2018 measurement, no content substitution or TLS interception was found at Tor exit nodes. However, an exit node can see traffic that is not protected by HTTPS.
Choosing a tool
For checking a public website, a proxy from a known operator is suitable. For banking, email and downloading software, unknown intermediaries are unsuitable. HTTPS protects the content of the tunnel when certificates are verified. To choose a tool by how much of your traffic it covers, see the comparison of proxies, VPNs, Tor and Smart DNS.