What is a proxy server and how does it work?

A proxy server is a computer that sits between your device and the websites you visit, forwarding requests on your behalf. It can live on your own machine or anywhere between you and the destination server. This article explains the two main types — forward and reverse proxies — and what each one actually does.

Forward proxies

A forward proxy acts on behalf of clients. When you send a request through one, the proxy forwards it to the destination and returns the response to you. The website sees the proxy's IP address instead of yours.

Forward proxies are used to:

• Hide your IP address — the destination server sees the proxy's address, not your device's.
• Control and filter traffic — organizations and schools route traffic through a proxy to enforce acceptable-use policies, with URL and content filtering.
• Reduce bandwidth — a shared proxy can store and forward frequently requested content for a group of clients.

Open proxies — forward proxies accessible to anyone on the Internet — are common; security researchers estimated "hundreds of thousands" of them years ago. An anonymous proxy reveals that it is a proxy but still hides your original IP.

Reverse proxies

A reverse proxy does the opposite: it acts on behalf of servers, not clients. It sits in front of one or more web servers, and all traffic headed to those servers goes through it first. Clients may not even know the proxy exists — responses look like they came from the server directly.

Common jobs for a reverse proxy:

• Load balancing — distribute requests across several backend servers.
• Caching static content — serve images and files from the proxy, offloading the web servers.
• Compression — compress and optimize responses to speed up load time.
• TLS termination — handle HTTPS encryption at the proxy, centralizing certificate management.
• Extra defense layer — filter some attacks before they reach the application server.

Forward vs reverse

How a proxy forwards traffic

When you browse through a proxy, your browser sends the request to the proxy instead of the destination. The proxy forwards it, receives the response, and sends it back to you.

For HTTPS traffic, many proxies use the HTTP CONNECT method, which opens a two-way tunnel between your browser and the destination through the proxy. Not all proxies support CONNECT — some limit it to port 443 only.

Proxies can also pass on information about the original client using headers:

• Forwarded — the standardized header for client-facing proxy information.
• X-Forwarded-For — the de-facto standard identifying the original client IP.
• Via — added by the proxy itself, showing a request passed through it.

These headers are not inherently trustworthy — they can be missing, modified, or added by several proxies in a row.

What a proxy cannot do

A proxy is not a security magic wand:

• It can see your traffic — the proxy operator (or anyone who controls it) can read or log what passes through, unless it is encrypted end-to-end.
• It does not fix the website — a reverse proxy adds a defense layer but does not protect against attacks on the web application itself.
• It does not make headers honest — a proxy that hides your IP can also add fake forwarding headers.

FAQ

What is the difference between a forward proxy and a reverse proxy?

A forward proxy acts on behalf of clients: it hides the identity of the user, and the destination server only sees the proxy's IP address. A reverse proxy acts on behalf of servers: it sits in front of one or more web servers, so clients may not even know it exists while it handles load balancing, caching, and TLS termination.

Can a proxy hide your IP address?

Yes — that is the main job of a forward proxy. The destination server sees the proxy's address instead of your device's. But a proxy is not a privacy guarantee: whoever controls the proxy can read or log everything that passes through it unless the traffic is encrypted end-to-end.

What is the HTTP CONNECT method used for?

For HTTPS traffic, many proxies use the HTTP CONNECT method, which opens a two-way tunnel between your browser and the destination through the proxy. Not all proxies support CONNECT — some limit it to port 443 only.

Can you trust the X-Forwarded-For header?

Not by itself. Headers like Forwarded, X-Forwarded-For, and Via are added by proxies, but they are not inherently trustworthy — they can be missing, modified, or added by several proxies in a row.

Summary

A forward proxy works for you, hiding your IP and filtering your traffic; a reverse proxy works for servers, balancing load, caching, and handling TLS. Both forward traffic between two points, and both see the traffic they carry. When you use a proxy — or build a site behind one — the question is always: who controls it, and what do they see?