What Is a Proxy Server? How It Works, With Examples

Definition: a proxy server is an intermediary computer that sends requests to websites on behalf of another device, under its own IP address. Your app sends a request to the proxy, the proxy sends it on to the website from its own IP address, and the answer comes back the same way. "Proxy" means acting on behalf of another; that is the proxy server meaning in networking: one machine making requests for another (see MDN's glossary entry Proxy server).

What each side sees:

• The website sees the proxy's IP address and everything your app puts in the request: headers, cookies and any account you sign in with.
• The proxy sees your IP address and the hosts you connect to. For plain HTTP pages it can also read the requests; for HTTPS pages it sees only the host name.

What does a proxy server do? Three jobs, alone or together: it forwards requests under its own IP, it can filter them (an office proxy that blocks some sites), and it can cache answers so repeated requests load faster.

Proxy server vs web server vs firewall

The difference is the job: a proxy forwards requests, a web server answers them with the site's pages, and a firewall decides which traffic may pass at all.

Sources MDN for the proxy and the web server, Cloudflare for the firewall and the WAF, as linked (October 2026).

Three terms network vendors use for these boxes:

• Full proxy: a proxy that ends your connection and opens a separate one of its own to the server, so it handles each side on its own, rather than passing packets through.
• Secure web gateway (SWG): a company's forward proxy, often run as a cloud service, that filters staff web traffic by policy, scans it for malware and logs use.
• Next-generation firewall (NGFW): a firewall that adds application awareness and intrusion prevention to rules on addresses and ports; companies often pair one with a secure web gateway.

A typical request crosses all three: your device → firewall → proxy → web server. They also overlap: a "proxy firewall" inspects application traffic while relaying it, and a web application firewall (WAF) usually works as a reverse proxy in front of a site's web servers (Cloudflare: What is a WAF?).

How to define a proxy service and a proxy address

A proxy service is the same idea sold as a product: a provider runs the servers and IP addresses, and you connect to them with credentials, usually paying for the traffic or the IPs you use. A proxy address is the host name (or IP) and the port your app connects to, written as host:port. You enter it in your browser, your operating system or your script, with a username and password if the proxy asks for them. With ProxyField, the gateway address and your credentials or allowlist are in your account once the payment is confirmed. Proxy not working?

A proxy server works in 5 steps: your app sends the request to the proxy, which checks who you are, connects to the website, receives the answer and passes it back.

1. Your app sends the request to the proxy's address and port, not straight to the website.
2. The proxy checks your credentials: a username and password, or your IP on its allowlist.
3. The proxy opens its own connection to the website from its IP address.
4. The website answers the proxy, the only connection it sees.
5. The proxy returns the answer to your app.

Explained simply: a proxy is a friend who makes a phone call for you. The shop hears your friend's number, not yours, and your friend tells you the answer.

See the 5 steps in one command. api.ipify.org replies with the IP address that reached it:

# Without a proxy: prints your own public IP
curl https://api.ipify.org
# Through a proxy (steps 1-5): prints the proxy's IP, not yours
curl -x gate.proxyfield.io:7000 -U "<login>:<password>" https://api.ipify.org

Add -v to the second command and you see step 1 for an HTTPS site: CONNECT api.ipify.org:443, the request that asks the proxy to open a tunnel.

What step 1 looks like on the wire. The first line your app sends to a proxy is one of two:

HTTPS through a proxy. For an HTTPS site, your app asks the proxy to open a tunnel with the HTTP CONNECT method. The proxy relays encrypted bytes: it sees the host name and port, not the page content. Not every proxy supports CONNECT, and some allow it only to port 443 (MDN: Proxy servers and tunneling; the standard is RFC 9110, section 9.3.6 CONNECT).

Logging in to a proxy (step 2), in general. Under the HTTP standard, a proxy that wants credentials answers 407 Proxy Authentication Required with a Proxy-Authenticate header, and the client sends the request again with a Proxy-Authorization header carrying the username and password (RFC 9110, section 15.5.8). curl's -U and the user:password@ part of a proxy URL fill that header for you. This is how HTTP proxies work in general, not a description of any one provider's gateway; a proxy that uses an IP allowlist skips the exchange.

Forward vs reverse proxy. A forward proxy works for the client: you choose it, and it stands between you and the sites you visit. A reverse proxy works for a website: it sits in front of the site's servers, as a CDN or load balancer does (Cloudflare: A primer on proxies). The proxies you buy from a provider are forward proxies.

How your app finds the proxy: settings or a PAC file. You either type the proxy's host:port into the app's or system's proxy settings, or point them at a PAC (proxy auto-config) file. A PAC file is a short JavaScript file with one function, FindProxyForURL(url, host), that returns for each address either DIRECT or the proxy to use; MDN says to serve it with the MIME type application/x-ns-proxy-autoconfig. MDN's example:

function FindProxyForURL(url, host) {
  if (isResolvable(host)) {
    return "DIRECT";
  }
  return "PROXY proxy.example.com:8080";
}

Where to enter a PAC address on Windows, macOS, iPhone, Android and Firefox: Automatic Proxy Setup: PAC Script and Configuration URL.

With rotating proxies, step 3 picks a different residential IP for each request.

You probably use a proxy already: the five examples below differ in who runs the proxy and which IP address the website sees.

The first two are infrastructure most people never notice. The last three are the ones you set up yourself, and they are what proxy providers sell.

Use a proxy when an app needs a different IP address or location, or many IP addresses at once; skip it when what you need is encryption.

Business uses:

• web scraping and public data collection;
• price monitoring across shops and regions;
• SEO and SERP monitoring: checking rankings as searchers in each region see them;
• ad verification: checking that ads show where and how they should;
• social media monitoring;
• regional content and website checks, and testing tools from a selected region.

Personal uses: changing your visible location, and keeping your own IP address away from the sites you visit.

When not to use one:

• You need encryption. On public Wi-Fi, a VPN protects all your traffic; a proxy does not encrypt by itself.
• The only option is a free open proxy. You don't know who runs it, and the operator can see your IP and read and change any unencrypted traffic that passes through it.

Why do hackers use proxy servers? To hide where their traffic comes from. That is why many websites score the reputation of every IP address that connects, and why reputable providers publish an acceptable-use policy and act on abuse reports. What is lawful depends on what you do through the proxy: see whether proxies and web scraping are legal.

More on the trade-offs: Should I Use a Proxy Server? Advantages, Disadvantages and When Not To and What Are Proxies Used For?

A VPN encrypts all the traffic from your device and gives every app one exit IP; a proxy reroutes one app's traffic, does not encrypt it by itself, and can give you many IPs, including a new one per request. The full comparison, with speed, safety and cost, is in proxy vs VPN, and for scraping and geo-testing in Residential Proxy vs VPN.

Tor sends your traffic through a chain of volunteer-run relays with layered encryption, so no single relay knows both who you are and where you are going. It is free and strong for privacy but slow. You don't pick the exit relay's city; pinning a country takes a manual setting (ExitNodes in Tor's torrc configuration file), and many sites challenge traffic from Tor exit relays.

A proxy hides your IP address from the website, but not from the proxy operator, and it does not hide your cookies, logins or browser fingerprint.

Proxies are often sorted into three anonymity levels by what they add to the request headers: X-Forwarded-For and Via, or the standard Forwarded header that replaces them (RFC 7239).

What each of those headers tells the website, per MDN:

ProxyField's gateway adds no Via, X-Forwarded-For or Forwarded header; the headers your own client sends pass through.

These levels describe headers only. A website can still recognize a proxy by its IP reputation, and it recognizes you by your account, your cookies and your browser fingerprint, whatever the level. More: Proxy anonymity levels, What Is a Transparent Proxy? and Does a Proxy Hide Your IP Address?

There are five common ways to hide or change the IP address a website sees, and each fits a different need:

• Proxy: changes the IP for one app; depending on the provider, it can give a new IP per request or an IP in a chosen country, region or city. For many IPs that look like ordinary home users, use residential proxies.
• VPN: changes the IP for the whole device and encrypts the traffic, with one exit IP at a time.
• Tor: hides where your traffic comes from behind several relays; slow, and often challenged by websites.
• Mobile data: switching from Wi-Fi to your phone's cellular connection gives you the carrier's IP, often shared with many other users.
• Router restart: many home connections get a new dynamic IP after the router reconnects, but some ISPs keep the same one for weeks (How to Get a New IP Address).

You cannot "fake" an IP address and still receive the answers: the website sends its reply to the address in the request. Every working method borrows another real address instead. Free tools that promise to hide your IP carry the same risk as free proxies: someone pays for the servers, and you often cannot tell who.

An IP address is the number that identifies a device on a network so that data can reach it, for example 203.0.113.7. Four related terms explain what a website learns from yours:

• Public vs private IP: your public IP is the one the internet sees, assigned by your internet provider. Private IPs (such as 192.168.1.20) are used only inside your home or office network.
• NAT (network address translation): your router translates the private addresses of all your devices into one public IP.
• ISP: the internet service provider, the company that connects you to the internet and assigns your public IP (ISP meaning).
• ASN (autonomous system number): the number of the network that announces an IP range on the internet, such as an ISP or a hosting company. It is how a website can tell a home connection from a datacenter.

Can two devices have the same IP address? Yes, behind NAT. Every device in a home shares the router's public IP, and mobile carriers use carrier-grade NAT, so many phones can share one public address. Mobile 4G/5G proxies run traffic through such carrier networks.

A MAC address is different: it identifies a network card on the local network and never reaches the website. What a proxy's own address is: What Is a Proxy IP Address?

A static IP address stays the same until you give it up; a dynamic IP is reassigned by your internet provider from time to time, for example after the router reconnects. Most home connections have dynamic IPs, which is why your IP address can change without anything on your side changing.

Proxies have the same split. With ProxyField, a rotating proxy changes the IP on every request or keeps it for a sticky session of 30 s to 36 h. A dedicated static residential (ISP) proxy or a dedicated datacenter proxy IPv4 address stays yours for a 30-day term, which you renew yourself in the dashboard.

Proxy hosting means running proxy servers as a service, or renting access to them. You can host proxy software on your own server, which gives you one IP address and the upkeep, or rent from a provider that runs the servers and the IP addresses for you and bills you for use. Renting is the usual choice when you need many IPs, or IPs in other countries.

You need a proxy when an app needs other IP addresses than yours; for privacy alone, a VPN is the better fit. Match the task to the tool:

• Privacy on public Wi-Fi → a VPN.
• Browsing from one other country now and then → a VPN or a single proxy.
• Many IPs, a new IP per request, city targeting, or scraping sites that block datacenter ranges → residential proxies or mobile 4G/5G proxies, usually as rotating proxies; for apps that are not browsers, SOCKS5 proxies.
• The same IP for weeks (an allowlisted login, a long-running session) → a dedicated static residential (ISP) proxy or a dedicated datacenter proxy.
• Large volumes on sites that do not block datacenter ranges → rotating datacenter proxies.

This is the usual fit of each IP type, not a rule: test your own targets before you scale up. All four types side by side: Types of Proxies.

A good first provider lets you buy 1 GB without a subscription, test on your own target, and get help with the setup. ProxyField's Easy Trial is 1 GB of residential traffic for $2.95 (mobile $3.45), with no minimum purchase and no subscription, on the same pool as a 1 TB order; the traffic never expires, and 24/7 live chat helps with setup and integration. All purchases are final, so buy 1 GB first: the rest never expires, and you only buy more once the test passes.

What to buy first: 1 GB of residential traffic, no subscription. What 1 GB covers (1 GB = 1,000 MB; page weights vary, so measure yours):

Which type a beginner should buy for which job:

What to check before your first purchase, and ProxyField's answer:

What the first purchases cost (residential; the tier rate applies to the whole purchase):

Cheaper than the big brands' $4/GB at every volume: residential proxies cost $2.95/GB for 1 GB and fall to $1.95/GB from 1,000 GB, with no subscription. All tiers: pricing.

Pass or fail, in numbers. Before you buy more, test 1 GB on the pages you actually need (public pages only, and follow the site's terms):

1. Set your pass mark first: the share of normal pages your job needs, for example 9 in 10.
2. Send 200–500 requests to your target at the rate you plan to run, with a new IP per request.
3. Count the answers: normal pages against CAPTCHA pages and 403, 429 or 503 replies.
4. Price a usable page: price per GB × page weight ÷ share of normal pages. A 2 MB page costs about $0.0059 at $2.95/GB; at 9 in 10 normal pages, a usable page costs about $0.0066, and about $0.0043 from 1,000 GB at $1.95/GB.
5. Pass: buy the volume you need. Fail: slow down or fix your headers and browser first, because a proxy changes only the IP.

Your first request, in 5 steps:

When a beginner should not buy residential proxies: if a site works fine from server IPs, rotating datacenter proxies cost $0.29/GB down to $0.22/GB; if all you want is privacy on public Wi-Fi, a VPN is the right tool. Not sure how much you need? Start with 1 GB: what you don't use stays on your balance, and the next purchase gets the rate of its own volume tier.

Guides in this series:

• What a proxy hides: What Is an Anonymous Proxy? · Does a Proxy Hide Your IP Address? · Proxy anonymity levels: elite, anonymous, transparent · Hide proxy servers and incognito proxies · What Is a Transparent Proxy?
• IP addresses: What Is a Proxy IP Address? · How to Get a New IP Address · ISP meaning
• Should you use one: Advantages, disadvantages and when not to · What Are Proxies Used For?
• Proxy vs other tools: Proxy vs VPN · Residential Proxy vs VPN
• Next series: Types of Proxies: Residential, Datacenter, ISP and Mobile
• Legal and safety (a related series): what data is legal and safe to scrape