What Is a Proxy Server? Definition & Architecture

What a Proxy Server Actually Is

A proxy server is not a product, a privacy feature or a genre of software. It is a position in a conversation — a machine that terminates your connection and opens its own one to the destination on your behalf. Every distinction people argue about, from forward versus reverse to transparent versus elite, falls out of two mechanical questions: who chose the intermediary, and which header fields does it rewrite before the destination sees your request?

HTTP’s own specification is stricter than the marketing around it. RFC 9110 section 3.7 names three common forms of intermediary, and what separates them is not the software — one program can play more than one role — but position and selection.

• A proxy is, in the specification’s words, a message-forwarding agent that is chosen by the client, usually via local configuration rules. The client knows it is there because the client put it there.
• A gateway — which the RFC itself glosses as a.k.a. reverse proxy — acts as an origin server for the outbound connection but translates received requests and forwards them inbound to another server or servers. To a visitor it is indistinguishable from the real thing.
• A tunnel acts as a blind relay between two connections without changing the messages, and the specification is explicit that it is not considered a party to the HTTP communication.

That vocabulary settles most of the confusion in one stroke: a proxy server is defined by where it sits and who selected it, not by what it is sold as. The same machine running the same software can be a proxy for a company’s staff and a gateway for the site it fronts.

One layer distinction is worth making early and then leaving alone. An HTTP proxy understands HTTP messages — it parses your request line and can rewrite your headers. A SOCKS proxy, specified in RFC 1928, works a layer lower and relays a TCP connection, and where implemented UDP, without parsing what travels inside. Which one to point your tool at has its own page: HTTP vs SOCKS5. The proxy checker speaks both, if you would rather test than read.

This page defines the role, not any one species of it. For the cellular case — an exit point that is a device on a mobile network — see what is a mobile proxy. For the family tree of exit types, see types of proxies explained.

What Actually Changes on the Wire

Almost every answer to how does a proxy server work is a story about hops: your request goes here, then there, then to the website. It is true and almost useless, because it describes nothing you can observe. Three things do change observably, and all three live in the HTTP message itself.

1. The request-target changes shape

A request sent straight to a server uses what RFC 9112 calls origin-form: the path alone, with the hostname carried separately in Host. Section 3.2 then states a MUST-level requirement — when making a request to a proxy, other than a CONNECT or server-wide OPTIONS request, a client must send the target URI in absolute-form as the request-target. The full URL moves into the request line, because the proxy cannot assume it is the destination.

Direct to the origin (origin-form)
    GET /pub/index.html HTTP/1.1
    Host: example.org

Through a forward proxy (absolute-form, RFC 9112 s3.2)
    GET http://example.org/pub/index.html HTTP/1.1
    Host: example.org
    Proxy-Authorization: Basic dXNlcjEyMzpzM2NyZXQ=

2. HTTPS is not proxied at all — it is tunnelled

The moment the scheme is https, the mechanism above stops applying. The client does not send a request for the proxy to read; it sends a CONNECT using a third request-target shape, authority-form — nothing but the host and port separated by a colon. RFC 9110 describes what follows: CONNECT requests that the recipient establish a tunnel to the destination origin server identified by the request target and, if successful, thereafter restrict its behavior to blind forwarding of data, in both directions, until the tunnel is closed.

The consequence is the one most people have backwards. Across an HTTPS request a proxy sees the destination hostname, the port, the timing and the byte counts. It does not see your path, headers, cookies or the response body: TLS is negotiated end to end through the tunnel, and the proxy relays ciphertext it has no key for.

CONNECT example.org:443 HTTP/1.1
    Host: example.org

HTTP/1.1 407 Proxy Authentication Required
    Proxy-Authenticate: Basic realm="proxy"

CONNECT example.org:443 HTTP/1.1
    Host: example.org
    Proxy-Authorization: Basic dXNlcjEyMzpzM2NyZXQ=

HTTP/1.1 200 Connection Established
    <-- TLS handshake and everything after it is opaque to the proxy -->

3. Credentials ride a header pair of their own

Proxy authentication is deliberately separate from origin authentication, because one message can be challenged by two different parties and the client must tell them apart. A proxy wanting credentials answers 407 Proxy Authentication Required with Proxy-Authenticate, and the client retries carrying Proxy-Authorization; a site wanting credentials answers 401 with WWW-Authenticate and is answered with Authorization. The status code is a free diagnosis: 407 means your proxy rejected you and the destination never heard from you, 401 means the proxy did its job and the destination is refusing.

All of that lives at the HTTP message layer, which is where this page stops on purpose. The physical journey underneath — client, hardware, carrier, destination — is a different artefact, drawn step by step in how mobile proxies work.

The Same Request, Three Ways

Which Half of This Question Is Yours?

The phrase what is a proxy server is asked by at least four different people with four different problems, and only some of them want the same answer. This is the shortest route from the diagram to the page you actually needed.

Forward Proxy vs Reverse Proxy

These are the same machinery pointed in opposite directions, and topology is a poor way to tell them apart — both sit in the middle, both terminate one connection and open another. The useful test is allegiance. Ask who deployed the thing and whose interest it serves, and the answer falls out immediately.

A forward proxy is chosen by the client and works on the client’s behalf: it conceals the client from the destination. A reverse proxy — a gateway, in the specification’s vocabulary — is chosen by the site operator and works on the site’s behalf: it conceals the origin servers from the client. You are not its user. You are the party it is protecting the site from.

That is why you cannot buy a reverse proxy to change your IP address, a request that lands in support inboxes constantly. Nginx, HAProxy and a CDN edge are all proxying for the server. Installing one in front of your own site changes what visitors can learn about your infrastructure and changes nothing whatsoever about what a website you visit can learn about you.

One row of that table deserves its own sentence, because it is where the two halves of this article meet. A forward proxy does not have to be chosen by you personally — it only has to be chosen on the client side. A company that routes every workstation through an egress proxy has deployed a forward proxy that nobody at a keyboard opted into, and the reason it feels like surveillance rather than a service is precisely that the allegiance and the selection have come apart.

Transparent, Anonymous and Elite Are Header Behaviours

Proxy listings sell three anonymity levels as though they were product grades stamped on the hardware. They are nothing of the kind. They are a description of what two header fields look like by the time the message reaches the destination, and you can measure them in about ten seconds.

The first field is Via. RFC 9110 section 7.6.3 defines its value as one or more protocol-and-recipient identifiers, each identifying a distinct intermediary, appended in order as the message travels. Its presence at the destination is therefore proof that the message passed through at least one intermediary — it is an intermediary announcing itself by design, not a leak.

The second field carries your original address. The long-standing convention is X-Forwarded-For, and RFC 7239 — the Forwarded HTTP Extension, a Standards Track document from June 2014 — replaced that and its siblings with a single Forwarded field carrying four parameters: for, by, host and proto. The same document is unusually blunt about the stakes, noting that the client address is considered to be privacy sensitive by many people and that the default configuration for the by and for parameters should use obfuscated identifiers.

Transparent   Via: 1.1 proxy.example.net
              Forwarded: for=203.0.113.47      <-- your address, forwarded intact

Anonymous     Via: 1.1 proxy.example.net       <-- an intermediary, but not who
              (no Forwarded, no X-Forwarded-For)

Elite         (neither field present)          <-- nothing in the headers to see

That last remark is worth taking seriously. Because the tiers are not standardised, a listing that says elite is making a claim about someone else’s software with no authority behind it. The claim is testable, though, and testing it takes four steps:

The PXM2 proxy checker runs exactly that test for you, over both protocols, and reports what arrives rather than what was promised.

The Four Jobs Proxies Are Actually Deployed For

Strip away the vendor categories and the benefits lists, and proxies are deployed to do four things. Every real deployment is some combination of these, and which combination is available to you is decided entirely by the role — which is why the honest way to present them is alongside the role that can perform them, rather than as a menu you get to choose from.

Reading down that list explains a lot of the noise around the term. Two of the four jobs — caching and load distribution — have nothing to do with hiding anybody, which is why network engineers and people shopping for an IP address frequently discover mid-conversation that they have been using the same word for different machines. Only the fourth job is what most people arrive at this page looking for, and it is the one where the choice that matters is not the proxy but the network the exit address sits on. Every PXM2 proxy is a forward proxy doing that fourth job through a real 4G or 5G carrier connection; if that is the half of the question you are on, the live proxy list is the next step, and how to set up a mobile proxy is the configuration walkthrough.

What a Proxy Server Is Not

Four corrections account for most of the remaining confusion, and each one is a case of a neighbouring technology being mistaken for this one.

• A proxy is not encryption. A plain HTTP proxy forwards your request in cleartext and can read and modify every part of it. On an HTTPS request the confidentiality comes from TLS running end to end through the tunnel, which would protect you identically with no proxy in the path at all. The proxy contributes nothing to it.
• A proxy is not a VPN. A proxy is configured per application: your scraper uses it, your email client does not, and the two exit through different addresses without either of them being wrong. A VPN creates a virtual network interface at the operating-system level and captures everything. Different scope, different failure modes, different right answers. The full comparison is here.
• A proxy is not NAT, and not a firewall. Both of those operate below the application layer. Neither parses a request-target, neither knows what a Host field is, and neither can add a Via header, because neither is reading HTTP at all. A router rewriting addresses is doing something structurally different from an intermediary reading your messages.
• A proxy is not anonymity. It changes the address the destination logs. It changes nothing about the cookies your client sends, the fingerprint your TLS stack presents, or the account you log into thirty seconds later. An address swap under an otherwise unchanged client is a rename, not a disguise.

None of that makes proxies weak. It makes them specific. A proxy is an intermediary that terminates your connection and opens its own, and once you know who chose it and which fields it rewrites, you know everything the term itself can tell you — the rest is a question about which network the far end sits on.

Explore Real Mobile Proxies

Need a forward proxy with a clean cellular carrier address? PXM2 runs dedicated 4G/5G modems:

Frequently Asked Questions

Related Guides

Proxy fundamentals

Core mobile proxy guides