Elite, Anonymous and Transparent Proxies

An elite proxy forwards your requests under its own IP and leaves out every header that would tell the website about you or about itself: no Via, no X-Forwarded-For, no Forwarded. The site's server sees one visitor, the proxy's IP, with your browser's ordinary headers. Wikipedia describes elite or high-anonymity proxies as ones that "make it appear that the proxy server is the client" (Wikipedia: Proxy server).

"Elite", "high anonymity", "level 1", and the sales names "hidden" and "incognito" all describe the same header behavior. More on the last two in hidden proxy servers and incognito proxies.

Labels are not used consistently. Some providers and proxy lists call level 2 "distorting" rather than "anonymous", and "transparent proxy" also names an intercepting proxy that a network puts in your path without any browser setting (the school and office kind). Read a label as a claim about headers and check it with the test below.

Proxy checkers classify a proxy by what a test server receives through it. They read the connecting address (REMOTE_ADDR in server terms) and the proxy headers, which servers expose as HTTP_VIA, HTTP_X_FORWARDED_FOR and HTTP_FORWARDED, plus X-Real-IP and Client-IP where a proxy sets them. An elite proxy also strips the headers that belong between you and the proxy, such as Proxy-Authorization and Proxy-Connection, and adds no From header:

The headers come from the HTTP standards and conventions: Via is "added by proxies, both forward and reverse" (MDN: Via), X-Forwarded-For is the de-facto header for the original client IP (MDN: X-Forwarded-For), and Forwarded is its standardized form (RFC 7239, 2014). Squid, the common open-source proxy, shows how one setting moves a proxy between levels: forwarded_for on (the default) appends the client's IP, off writes unknown, and delete removes the header (Squid: forwarded_for).

For a plain-HTTP request, the proxy reads the request, removes any proxy headers that came with it, adds none of its own, and sends it from its IP. For an HTTPS site, the browser asks the proxy to open a tunnel with CONNECT, and the proxy relays encrypted bytes it can neither read nor edit (MDN: Proxy servers and tunneling). A SOCKS5 proxy works below HTTP and adds no HTTP headers either.

That leads to the point most explanations skip: on HTTPS, every tunneling proxy behaves like an elite proxy. It can't add headers to a request it can't see. Since most sites now load over HTTPS, the level matters mainly for plain-HTTP targets and for proxies that decrypt traffic.

The header level is one signal among many. A site can still recognize an elite proxy by:

• its IP: IP-intelligence databases label hosting ranges, VPNs, public proxies and suspected residential proxies (MaxMind's Anonymous IP database has fields for each; MaxMind developer docs). A free "elite" proxy on a datacenter IP from a public list is labeled long before anyone reads its headers;
• mismatches: a browser time zone, language or WebRTC address that doesn't fit the IP's location;
• fingerprints: TCP/IP and TLS details or a browser fingerprint that don't match the claimed browser; see what a browser fingerprint is;
• behavior: request rate, identical paths, many accounts on one IP.

So elite is necessary for a proxy that shouldn't announce itself, and not sufficient. The IP type usually matters more: residential proxies and mobile proxies use IPs on the same networks as a site's ordinary visitors. How sites combine all of this is in can websites detect proxies.

Compare what a site sees with and without the proxy, read the headers it receives, then check the leaks that headers don't show. Start with the quick check; use your own server for a result you can trust.

1. Quick check, no server needed

# Your own IP, without the proxy
curl http://api.ipify.org

# Through the proxy: the IP should change to the proxy's
curl -x gate.proxyfield.io:7000 -U "<login>-country-us:<password>" http://api.ipify.org

# The headers a site receives through the proxy (plain HTTP, so a proxy could add headers)
curl -x gate.proxyfield.io:7000 -U "<login>-country-us:<password>" http://httpbin.org/headers

In a browser, open BrowserLeaks' IP page with the proxy on: it shows the IP, its location and the request headers your browser sent. Two limits: public echo services may hide proxy headers themselves (when we sent test Via and X-Forwarded-For headers to httpbin.org in October 2026, its /headers page showed neither), and over https:// no proxy can add headers, so an HTTPS test always looks clean.

2. Reliable check: a header echo on your own server

This short Python server prints the connecting address and every header it receives:

# echo_headers.py: run on a server you control, then request it through the proxy over plain HTTP
from http.server import BaseHTTPRequestHandler, HTTPServer


class Echo(BaseHTTPRequestHandler):
    def do_GET(self):
        body = f"Connection from: {self.client_address[0]}\n\n{self.headers}".encode()
        self.send_response(200)
        self.send_header("Content-Type", "text/plain; charset=utf-8")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)


HTTPServer(("0.0.0.0", 8080), Echo).serve_forever()

Then request it through the proxy, with ProxyField for example:

curl -x gate.proxyfield.io:7000 -U "<login>-country-us-city-new_york:<password>" http://YOUR_SERVER_IP:8080/

Read the result:

3. Check the leaks headers don't show

A clean result proves that test, not anonymity: cookies, sign-ins, browser fingerprints and the proxy operator can still identify you. Our proxy checker shows each proxy's IP, location and type, up to 100 proxies per check, and stores no requests.

The IP type and the level are separate properties. "Residential" says where the IP is registered: a home internet provider. "Elite" says which headers the provider's gateway adds. A residential proxy can be any level in principle; a provider that forwarded your IP would defeat the point of the product, and over HTTPS no headers can be added at all.

For ProxyField: you connect to gate.proxyfield.io:7000 over HTTP, HTTPS or SOCKS5 with a username and password (with an allowlisted IP, to the port you set up in the dashboard), and each request leaves through a residential IP from a pool of 412M+. The ProxyField gateway adds no Via, X-Forwarded-For or Forwarded header and removes Proxy-Authorization before the request goes to the site. The test above answers the question for any provider in a minute.

• Protocols. HTTP and HTTPS proxies can be elite if they add no headers; SOCKS5 proxies never add HTTP headers. ProxyField supports all three: SOCKS5 vs HTTP proxies explains when each fits.
• Rotating or static. Elite describes headers, not rotation. A rotating residential proxy gives a new IP per request or a sticky one for a session; with ProxyField a sticky session lasts from 30 s to 36 h. A static proxy keeps one IP for weeks; see static vs rotating proxies.
• Dedicated or shared. Elite says nothing about who else uses the IP. Rotating residential IPs are shared over time; a dedicated ISP or datacenter IP is yours alone for its term. More in shared vs dedicated proxies.

Both hide your IP from the site without announcing themselves in headers. A VPN encrypts all of the device's traffic and exits through one server, usually on a datacenter IP that IP databases often list as VPN; an elite proxy relays one app's traffic without encryption and, from a provider, can give you many IPs of the type and location you choose. The general comparison is in proxy vs VPN.

Need proxies that don't forward your IP, on home-ISP addresses? ProxyField residential proxies: 412M+ IPs in 195+ countries, HTTP, HTTPS and SOCKS5, city targeting. Start with the Easy Trial: 1 GB for $2.95, no subscription.