What Is an HTTP Proxy?

NIST defines a proxy as "software that receives a request from a client, then sends a request on the client's behalf to the desired destination" (NIST glossary, from SP 800-86). An HTTP proxy is that software for web requests: it speaks HTTP, the protocol of the web (MDN: Proxy servers and tunneling).

• What it is: an address, host and port, such as gate.proxyfield.io:7000, often with a username and password.
• What the site sees: the proxy's IP, not yours.
• What the proxy sees: the full request for http:// pages; only the host name for https:// pages.
• What "HTTP" names: the protocol the proxy speaks, not the IP behind it. Residential, mobile and datacenter proxies can all be HTTP proxies.

Every scraping library takes an HTTP proxy as one URL. In Python requests, the same http:// proxy URL goes under both keys, and HTTPS pages pass through it in a CONNECT tunnel:

# pip install requests
import requests

proxy = "http://<login>-country-us-city-new_york:<password>@gate.proxyfield.io:7000"
proxies = {"http": proxy, "https": proxy}

for _ in range(3):
    r = requests.get("https://api.ipify.org", proxies=proxies, timeout=30)
    print(r.status_code, r.text)   # 200 and the exit IP the site sees, not yours

What to expect: 200 and an IP in New York on each line. With per-request rotation, each request can leave from a different IP; a sticky session keeps one IP for 30 seconds to 36 hours. A wrong password returns 407 Proxy Authentication Required instead (fixes). More: Python requests with a proxy and Scrapy proxy setup.

An intercepting proxy is an HTTP proxy that runs on your own machine and holds each request until you forward it. Burp Suite's Proxy tool and the open-source mitmproxy both listen on 127.0.0.1:8080 by default: you point a browser or app at that address, and every request appears in the tool, where you can change a header, a cookie or a form field before it reaches the server, or resend it with changes.

A typical check: a login form sends username=alex&password=.... With interception on, you change username to a long string or a quote character, forward the request, and see whether the server validates the input or returns an error that leaks details. Do this only on systems you own or are authorized to test.

mitmproxy --listen-port 8080
# in a second terminal:
curl -x http://127.0.0.1:8080 --cacert ~/.mitmproxy/mitmproxy-ca-cert.pem https://example.com

To read HTTPS, the tool decrypts and re-encrypts the traffic with its own certificate authority, which you install on the test device (mitmproxy serves it at http://mitm.it once the device uses the proxy). That is the difference from a normal HTTP proxy, which only tunnels HTTPS. For regional tests rather than inspection, give the browser a remote proxy instead, for example in Playwright:

from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(proxy={"server": "http://gate.proxyfield.io:7000",
                                       "username": "<login>-country-us-city-new_york", "password": "<password>"})
    page = browser.new_page()
    page.goto("https://api.ipify.org")
    print(page.inner_text("body"))  # the IP the site sees

What happens depends on whether the URL is http:// or https://.

Plain HTTP. The client sends the whole request to the proxy, with the full URL in the request line, the "absolute form" (RFC 9112, section 3.2.2):

GET http://example.com/page HTTP/1.1
Host: example.com
Proxy-Authorization: Basic VVNFUjpQQVNT

The proxy reads the request, opens a connection to example.com, sends the request from its own IP and returns the response. Because it reads the request, it can see the URL and headers, and some proxies cache or change them.

HTTPS. The client first asks the proxy to open a tunnel:

CONNECT example.com:443 HTTP/1.1
Host: example.com:443
Proxy-Authorization: Basic VVNFUjpQQVNT

The proxy connects to example.com on port 443 and replies 200 Connection established. From then on it copies bytes both ways, and the TLS handshake runs between your client and the site (RFC 9110, section 9.3.6). The proxy sees the host name and the amount of data, not the pages, headers or form fields. Many proxies allow CONNECT only to port 443, so a tunnel to another port may be refused (MDN).

Most sites now serve HTTPS, so most traffic through an HTTP proxy is CONNECT tunnels. The differences between an HTTP proxy, an HTTPS proxy and an "SSL proxy" are in what an SSL proxy is.

A proxy that reads a request can add headers that tell the site a proxy is in the path:

A proxy can add them to plain HTTP requests, but it cannot touch the encrypted request inside a CONNECT tunnel. Proxies are graded by which of them they send, see elite proxies, and the headers your own client sends are covered in web scraping headers.

Paid HTTP proxies check who you are in one of two ways:

• Username and password. The client sends them in the Proxy-Authorization header, base64-encoded, on every request or CONNECT. If they are missing or wrong, the proxy answers 407 Proxy Authentication Required (RFC 9110, section 15.5.8).
• IP allowlist. You register your server's IP with the provider, and the proxy accepts connections from it without a password. Useful for tools that cannot send credentials.

ProxyField supports both on the gateway gate.proxyfield.io:7000.

Most tools take an HTTP proxy as one URL:

http://USERNAME:PASSWORD@HOST:PORT

The scheme http:// describes the connection to the proxy, not the sites you visit: the same http:// proxy URL carries your https:// requests through CONNECT. Command-line tools and many libraries also read the HTTP_PROXY and HTTPS_PROXY environment variables; both usually point to the same http:// proxy URL.

curl -x gate.proxyfield.io:7000 -U "<login>-country-us-city-new_york:<password>" https://api.ipify.org

This request goes through a ProxyField residential IP in New York and prints the IP the site sees. Setup for other tools: curl with a proxy, Python proxies and Chrome proxy settings.

The other place you meet an "HTTP proxy" field is your operating system or browser: Windows, macOS and Linux each have a proxy setting that takes a host and port, see what proxy settings are. Company networks often set it with a PAC file instead, a small JavaScript file served as application/x-ns-proxy-autoconfig whose FindProxyForURL function picks a proxy per URL:

function FindProxyForURL(url, host) {
  if (dnsDomainIs(host, ".intranet.example")) return "DIRECT";
  return "PROXY proxy.example.com:8080; DIRECT";   // try the proxy, fall back to a direct connection
}

More in PAC files and automatic proxy configuration.

The word covers three different jobs:

An HTTP proxy does not add encryption. For HTTPS sites that does not matter much: the TLS tunnel runs from your client to the site, and the proxy cannot read the content. For plain http:// sites, the proxy, and anyone on the network between you and the proxy, can read and change the traffic. The proxy password also travels unencrypted, base64-encoded, unless the connection to the proxy itself uses TLS.

So the risk is mostly the operator. A paid provider with clear rules is a different case from a free proxy found in a public list, which may log or alter what passes through it. For privacy on an untrusted network, a VPN is the better tool: proxy vs VPN.

An HTTP proxy speaks web traffic only; a SOCKS5 proxy relays any TCP connection without reading it. For browsers, scrapers and APIs, HTTP is the simplest choice; for SSH or apps that are not web clients, SOCKS5 is the one that works. The full comparison is in SOCKS5 vs HTTP proxy.

Need HTTP proxies by country or city? ProxyField HTTP proxies run on 412M+ residential IPs in 195+ countries, with a new IP per request or sticky sessions up to 36 h, over HTTP, HTTPS and SOCKS5. Residential traffic costs $2.95/GB for 1 GB and falls to $1.95/GB from 1,000 GB, with no subscription. Start with the Easy Trial: 1 GB for $2.95. Traffic never expires, and all purchases are final.