However, a proxy may pass on the original address in headers, and some connections may go through directly. The proxy operator always sees your connection address. An ordinary proxy does not, by itself, provide protection from your internet service provider.
Which address the site, the operator and the provider see
Address masking only applies to connections that go through the intermediary.
| Observer | What they can see |
|---|---|
| Target website | The proxy's address; the original address is also available if it is passed separately or revealed by a direct connection |
| Proxy operator | Your original address and the destinations of connections through its server |
| Internet service provider | Your connection to the proxy; visibility of the rest depends on encryption and direct requests |
Encrypting the connection to the proxy limits observation of that segment, but it does not happen automatically. HTTPS (the secure protocol for transferring web data) protects the content of the connection to the site, but does not hide all addresses.
Which address the site, the operator and the provider see
the site receives the request from the intermediary's address.
A proxy may tell the website your original IP via the X-Forwarded-For or Forwarded headers.
The proxy operator always sees your connection address.
Signing in to your own account keeps you recognisable. For more on how far to trust the operator, see are proxies safe.
Which types of proxy hide your address
Web proxies
A web proxy is a website for opening other pages through an intermediary. Address masking only applies when you browse through it.
HTTP and HTTPS proxies
HTTP (the protocol for transferring web data) is used for requests to websites. An HTTP proxy is configured in a browser, application or the system. In an HTTPS tunnel, an intermediary that does not intercept the encryption cannot modify headers.
Support for HTTPS sites and encryption of the connection to the proxy itself are different properties.
SOCKS5
SOCKS5 (a network intermediary protocol, version 5) works with application connections. It does not guarantee encryption or coverage of every program.
The label "hide proxy" describes a promise to conceal the address, but it is not a separate protocol.
Which types of proxy hide your address
Where your original IP can leak
Request headers
A proxy may tell the website your original IP via the X-Forwarded-For or Forwarded headers. These service fields retain client information for statistics and diagnostics, even though the connection itself arrives from the intermediary.
In a 2018 study of open proxies, almost two thirds of the tested proxies leaked the user's IP, most often via X-Forwarded-For. That proportion cannot be extrapolated to today's paid services.
Connections that bypass the settings
The system-wide Windows setting is described for web traffic and does not guarantee coverage of every program. Android likewise warns: the browser uses the HTTP proxy, but other applications may not. Exceptions in the settings allow direct connections.
Enlarge image
WebRTC (real-time browser communication technology) creates separate connections. STUN checks (determining the external address of a connection) may bypass the application's proxy and reveal your provider's public address. Behaviour depends on the browser and the mode of operation. The mechanism is described in the WebRTC IP address handling requirements. For more on address leaks via the browser, see an additional review of WebRTC leaks on VPNRadarLab.
Connections that bypass the settings
Android likewise warns: the browser uses the HTTP proxy, but other applications may not.
Exceptions in the settings allow direct connections.
DNS queries
DNS (the Domain Name System) converts a website's name into a network address. With SOCKS5, this may be done by the proxy if the application passes it the name. However, individual browser components, including prefetching of addresses, may send queries locally.
A local DNS query reveals the domain to the resolver (the server that processes queries), but by itself it does not pass your original IP to the target website.
| Leak path | What to check | What to change |
|---|---|---|
| X-Forwarded-For / Forwarded | Whether the original IP appears in the headers received by the server | Choose a proxy that does not pass on the original address |
| An application outside the proxy | Which address is visible from that application | The application's settings and the exceptions list |
| WebRTC / STUN | Whether the provider's address appears in a WebRTC test | The WebRTC handling mode, then repeat the test |
| Local DNS | Which resolvers the DNS test shows | Name resolution through the proxy, if the client supports it |
How to test your proxy
- Open an external IP detection page without the proxy and note the address. Do not switch networks during the comparison.
- Enable the proxy and reload the page in the same browser. The proxy's address is expected; a match means the settings need checking.
- Compare the result with another application capable of showing the external address. The original IP indicates a direct connection.
- Run WebRTC and DNS tests. WebRTC must not reveal your provider's public address. The DNS test should show the expected resolver, whose address may differ from the proxy's IP.
- Check the original IP in the headers on a page that diagnoses server requests. An ordinary IP check may not take these fields into account.
In Windows, the settings are found under "Settings → Network & Internet → Proxy". Check the server, automatic configuration and exceptions. A successful test only confirms the connection you tested.
If you need to route the device's entire traffic through a tunnel, I recommend CitadelVPN with a compatible client in VPN (virtual private network) mode. Split tunnelling is included in all plans and lets you set exceptions, for example for local services. Check the client mode and the exceptions, then repeat the tests. Rules depend on the client and the platform; a leak-free result is not guaranteed.
Frequently asked questions
Is opening a site through a web proxy enough?
For changing the address while viewing that page, it usually is. For other tabs and applications, this approach changes nothing.
Can you hide your IP from the proxy owner?
Not when you connect to their server directly: the server receives your address as the source address of the connection.
Does SOCKS5 automatically forward my DNS queries?
Only if the application delegates name resolution to the proxy. Support for this feature by the protocol does not confirm that a particular client is configured for it.
When a proxy is enough
A proxy hides your IP from the website as long as it does not pass it on in headers and connections do not bypass the intermediary. Test the address, the headers and WebRTC, and check the DNS route separately. The operator always sees your connection. To choose a tool, use the comparison of proxies, VPN, Tor and Smart DNS.