Proxy Checker:
Detect Proxy, VPN and Anonymizer Connections
Run a free proxy checker to scan your connection for signs of a proxy server or anonymizer across 15 HTTP headers, classify transparent and anonymous proxy signatures, and cross-check against WebRTC leak data. We'll also show you exactly what this test can and can't tell you about VPN usage specifically — most proxy checkers don't.
Quick Answer: What Does a Proxy Checker Actually Detect?
A proxy checker examines HTTP headers like X-Forwarded-For, Via, Client-IP, and 12 others that reveal an old-style explicit proxy in the connection path. Transparent proxies expose your real IP in headers; anonymous proxies hide it but leave telltale headers behind. Here's the part most tools don't tell you: a well-configured modern VPN produces the exact same clean signature as no proxy at all, because VPNs don't work at the HTTP header layer. This tool is upfront about that limit and cross-checks WebRTC leak data to catch what headers alone miss.
--
Proxy Headers
--
Forwarded IPs
--
Connection
--
Protocol
--
WebRTC
Your Connection Details
What This Scan Can't Tell You
Header scanning reliably catches old-style explicit proxies. It cannot distinguish a direct connection from a well-configured modern VPN, because VPNs don't add HTTP proxy headers at all — that's by design, not a gap in this tool. For the fuller picture, also run our WebRTC Leak Test and check whether your IP belongs to a known VPN/datacenter range with our Cloud IP Check.
Cybersecurity Threat Researcher
Jessica focuses on proxy and VPN detection, HTTP header forensics, and IP reputation analysis.
The thing worth being blunt about: a clean result here does not mean you are not on a VPN. WireGuard and OpenVPN move your traffic at the network layer and never touch the HTTP headers this page reads, so a well-configured VPN produces exactly the same signature as no VPN at all. Header inspection finds old-style HTTP and SOCKS proxies. It was never able to find the other kind, and no amount of header scanning will change that. The WebRTC check below reaches a public STUN server to ask what address your browser would advertise in a peer connection; when that differs from the address above, something is leaking past the tunnel.
What does answer that question is the address itself: which operator announces it, and whether that operator is a hosting company. That is a different lookup. Every routable address belongs to an autonomous system, identified by an ASN — the operator that announces the block to the rest of the internet. A residential ISP and a hosting company look completely different at that level, which is the check that actually answers “is this a VPN”. The links beside each result go straight to it.
Last reviewed 12 August 2026 · Headers read from this request only · Nothing sent to any third party
View All ArticlesWhat Is a Proxy Checker and How Does It Work?
A proxy checker analyzes your HTTP connection to determine whether your traffic passes through an intermediary server before reaching the destination. Every time your browser connects to a website, it sends a set of HTTP headers. Proxy servers — whether intentionally configured by you or transparently injected by your ISP or corporate network — often modify these headers or add new ones that reveal the presence of an intermediary.
Our tool examines 15 HTTP headers known to indicate proxy activity, including X-Forwarded-For (the most common, carrying the original client IP), Via (which identifies the proxy software and version), Client-IP, the standardized Forwarded header per RFC 7239, and CDN-specific headers like CF-Connecting-IP (Cloudflare) and True-Client-IP (Akamai).
Based on which headers are present, the tool classifies your connection as transparent, anonymous, or showing no legacy proxy signature — and compares your visible IP against any forwarded IPs found in headers to see whether your real address is exposed. One important caveat we'll return to throughout this page: "no legacy proxy signature" is not the same as "definitely no VPN," which is exactly the kind of nuance most proxy checkers gloss over. For deeper header analysis, use our HTTP Headers Analyzer.
15 Headers, Scanned Honestly: Most proxy checkers test 2-3 headers and stop there. Ours scans 15 simultaneously, including CDN-specific headers from Cloudflare and Akamai — and tells you plainly when a "clean" result reflects a genuine direct connection versus simply the limit of what headers can reveal. Check your complete privacy picture with our Browser Leak Test, which adds 20+ fingerprinting checks.
Transparent vs Anonymous vs Elite Proxy: Classification Explained
Understanding proxy classification matters for anyone relying on proxies or VPNs for privacy. The classification depends entirely on which HTTP headers the proxy adds, modifies, or removes when forwarding your request.
Transparent Proxy
A transparent proxy passes your request through an intermediary but does not hide your identity. It adds the X-Forwarded-For header containing your real IP address and may add a Via header identifying the proxy software. The destination server sees both the proxy's IP and your real IP. These are commonly used by ISPs for caching, corporate networks for content filtering, and CDNs for load distribution. They offer zero anonymity.
Anonymous Proxy
An anonymous proxy hides your real IP address from the destination server — it omits your IP from X-Forwarded-For. It still sends headers that reveal proxy usage, such as Via or Proxy-Connection, or shows unusual header ordering. The destination knows you're using a proxy but can't determine your real IP from headers alone.
Elite Proxy / High-Anonymous — and Why This Is the Category That Matters Most
An elite proxy removes all proxy-identifying headers. Your connection appears identical to a direct connection with no intermediary — and this is the crux of the whole limitation this page is upfront about: a properly configured modern VPN falls into this exact same category, because it never adds HTTP proxy headers in the first place. There is no header-level test that separates "no proxy at all" from "elite proxy or clean VPN" — they produce the same signature by definition. Any tool claiming to definitively rule out VPN usage from headers alone is overstating what it can actually verify.
| Type | Real IP Visible | Proxy Headers | Detectable via Headers? |
|---|---|---|---|
| Transparent | Yes | X-Forwarded-For, Via | Yes — easily |
| Anonymous | No | Via, Proxy-Connection | Yes — via header presence |
| Elite Proxy | No | None | No — identical to direct |
| Well-Configured VPN | No | None | No — identical to direct |
Important: Since elite proxies and clean VPNs are invisible to header scanning, catching them requires different methods entirely — WebRTC leaks (test with our WebRTC Leak Test), IP reputation and datacenter detection (check with our IP Fraud Checker and Cloud IP Check), and TLS fingerprinting (see our JA3 Fingerprint tool). No single check, including this one, is a complete answer on its own.
The 15 HTTP Headers Our Proxy Checker Scans
Each header in our scan serves a specific purpose in proxy communication. Understanding what each one reveals helps you evaluate a proxy or VPN's actual anonymity level and identify potential leaks.
Primary Proxy Headers
- X-Forwarded-For (XFF): The most widely used proxy header, carrying the original client IP and potentially a chain of proxy IPs separated by commas. Example:
X-Forwarded-For: 203.0.113.50, 198.51.100.10. It's a de facto standard, not an official IETF specification, and the leftmost value can be forged by anyone before it reaches a trusted proxy — which is exactly why this tool doesn't treat its presence alone as proof of a personal proxy. - Via: Identifies the proxy software, version, and sometimes protocol. Example:
Via: 1.1 proxy.example.com (Squid/6.6). This header reveals proxy usage even if your IP is hidden — and it's one of the more reliable signals this tool checks for. - X-Real-IP: Set by reverse proxies (especially Nginx) to carry the original client IP, typically used server-side to identify the real visitor behind a reverse proxy or load balancer.
- Client-IP: An older header used by some proxy implementations to carry the client's original IP. Less common than X-Forwarded-For but still checked.
- Forwarded: The official standardized header per RFC 7239 (2014), intended to eventually replace the X-Forwarded-* family. Uses structured syntax:
Forwarded: for=203.0.113.50;proto=https;by=198.51.100.10. More informative than X-Forwarded-For but still less widely adopted a decade later.
Secondary and Infrastructure Headers
- Proxy-Connection: A non-standard header sent by some proxy clients instead of the standard Connection header. Its mere presence indicates a proxy in the chain.
- X-Forwarded-Proto: Indicates whether the original request used HTTP or HTTPS. Set by SSL-terminating proxies and load balancers. Example:
X-Forwarded-Proto: https. - X-Forwarded-Host: Contains the original Host header value from the client's request. Set by reverse proxies serving multiple domains.
- CF-Connecting-IP: Cloudflare-specific header carrying the visitor's real IP as seen at Cloudflare's edge. Because Cloudflare sets this itself and overwrites any client-supplied version, it's trustworthy in a way generic X-Forwarded-For isn't — which is exactly what this tool uses to resolve your real IP correctly if this page is served through Cloudflare.
- True-Client-IP: Akamai's equivalent of CF-Connecting-IP, carrying the real client IP through Akamai's edge network.
- X-Cluster-Client-IP: Used by load balancer clusters to preserve the original client IP across distributed infrastructure.
Check your IP reputation with our Blacklist Check and verify domain ownership with our WHOIS Lookup. Analyze full server headers with our Headers Analyzer.
Beyond Headers: How Websites Actually Detect VPNs and Proxies
HTTP header scanning is genuinely just the first layer, and — worth repeating, since it's the single most important thing to understand on this page — it's a layer that a well-configured VPN sails through undetected by design. Modern anti-fraud systems, streaming services, and serious websites combine several other techniques to catch what headers miss.
IP Reputation and Datacenter Databases
Services like MaxMind, IPQualityScore, and Spur maintain databases of known VPN, proxy, and datacenter IP address ranges. When you connect to a website, your IP can be checked against these in real time — so even with completely clean headers, your IP itself may still be flagged as belonging to a known VPN provider's infrastructure. Check this with our IP Fraud Checker and Cloud IP Check.
WebRTC IP Leaks
WebRTC can expose your real IP address through browser APIs that operate outside a VPN or proxy tunnel entirely. Even with headers completely clean, a WebRTC leak reveals your true ISP IP to the website — which is exactly why this tool cross-references WebRTC data rather than relying on headers alone. Test yours with our WebRTC Leak Test.
TLS Fingerprinting (JA3)
Your browser's TLS handshake creates a unique fingerprint called JA3. Some VPN clients and proxy software subtly alter this fingerprint, making automated or proxied traffic distinguishable from a typical browser connection even when headers and IP reputation look clean. Check yours with our JA3 Fingerprint tool.
Behavioral and Timing Analysis
Websites analyze request patterns, latency characteristics, and behavioral signals. Datacenter-hosted proxies often show unnaturally low latency and consistent request timing. Timezone mismatches between your browser and IP geolocation are another common flag. Browser fingerprinting through canvas, audio, and WebGL data provides persistent tracking even through proxy rotation.
The Complete Picture Needs More Than One Check: (1) This proxy checker for legacy header signatures, (2) WebRTC Leak Test for IP exposure a VPN wouldn't otherwise reveal, (3) IP Fraud Checker and Cloud IP Check for reputation and datacenter-range detection, (4) Browser Leak Test for fingerprinting, (5) DNS Lookup for DNS leak detection. No single tool, including this one, tells the whole story alone. Read our IP reputation score guide for more.
Proxy Headers Injected by CDNs: Cloudflare, Akamai, and AWS
One of the most common sources of confusion in proxy detection is headers added by CDN (Content Delivery Network) infrastructure. If the website you visit sits behind Cloudflare, Akamai, or AWS CloudFront, your request passes through their edge servers — and these services add proxy-style headers even though you personally aren't using a proxy.
Cloudflare adds CF-Connecting-IP and X-Forwarded-For to every request passing through its network. W3Techs put Cloudflare in front of 24.2% of all websites in its 28 July 2026 survey, so seeing these headers is extremely common and, on its own, tells you nothing about whether the visitor is using a proxy — only that the site uses Cloudflare.
Akamai adds True-Client-IP and X-Forwarded-For. Large enterprise sites, including many banking portals and e-commerce platforms, use Akamai's CDN. Again, these headers reflect the website's infrastructure choice, not the visitor's proxy status.
Our proxy checker is built to tell these apart: it distinguishes CDN-injected headers from genuine legacy proxy indicators, and — since this page itself may be served through a CDN — it specifically uses trustworthy CDN-set headers like CF-Connecting-IP to resolve your real IP correctly rather than showing you the CDN's own edge IP by mistake. Verify your SSL certificate chain with our SSL Checker.
Use Cases: Who Needs a Proxy Checker?
Proxy detection serves different purposes depending on your perspective — checking your own anonymity, protecting a website, or debugging network infrastructure.
VPN and Proxy Users should test their connections to check for legacy proxy header leaks and cross-reference with a WebRTC leak test — remembering that a completely clean result here confirms the absence of old-style proxy headers, not the presence (or absence) of VPN usage itself. Follow up with our WebRTC Leak Test for the piece this tool can't cover.
Website Administrators use proxy header detection as one signal among several to identify suspicious traffic and enforce access policies — but should not rely on it alone, precisely because it misses clean VPN traffic entirely. E-commerce platforms combine it with IP reputation checks to reduce payment fraud; streaming services layer it with datacenter-range detection to enforce content licensing. Our tool shows exactly what a header-only check would and wouldn't catch from your own visitors.
Network Engineers debug proxy configurations by verifying which headers their own proxy servers add. Misconfigured reverse proxies can leak internal IPs through X-Forwarded-For chains or expose backend server details through Via headers. Our scan surfaces these configuration issues directly. Detect Tor connections with our Tor Detector tool.
Check your browser information, hardware exposure, and cookie data for a complete privacy picture. Protect accounts with our Password Generator. Learn about clearing your digital footprint.
How to Achieve Elite-Level Anonymity — and Verify It Properly
If your goal is a connection that shows no proxy indicators at all, here's the full verification workflow — not just the header check, which is only step 2 of 7:
- Step 1: Choose a premium VPN or residential proxy service that doesn't inject proxy headers. Avoid free proxies — they almost always add headers or inject ads.
- Step 2: Run this proxy checker to confirm zero legacy proxy headers are present. Remember: this result will look identical whether you're using a well-configured VPN or no VPN at all — that's expected, not a failure of the tool.
- Step 3: Check your IP fraud score and run a Cloud IP Check. If the IP resolves to a known datacenter or flagged VPN range, websites will treat it accordingly regardless of clean headers.
- Step 4: Verify no WebRTC leak exposes your real IP — this is the check that actually catches a misconfigured VPN, since headers won't.
- Step 5: Match your browser timezone and language to your VPN's location. A VPN exit in London with a browser timezone of America/New_York is a clear mismatch signal.
- Step 6: Run the full Browser Leak Test to check canvas, audio, WebGL, and font fingerprinting exposure.
- Step 7: Check IP blacklist status to rule out reputation issues unrelated to proxy detection entirely.
Read our guides on IP reputation for email marketing, fixing 550 RBL errors, and cold emailing IP reputation.
Understanding Proxy Detection in E-Commerce and Fraud Prevention
Online businesses lose significant revenue annually to fraud involving masked IP addresses. Understanding how proxy detection works from the website's side helps both fraud-prevention teams and privacy-conscious users understand the same problem from opposite ends.
Payment processors like Stripe, PayPal, and Adyen check buyer IPs against proxy and VPN databases during transaction processing — but note this relies on IP reputation databases, not header scanning, precisely because header scanning misses clean VPN traffic. A purchase from a known VPN IP range can trigger additional verification: 3D Secure challenges, manual review, or a decline. This is why legitimate VPN users sometimes hit payment friction on e-commerce sites even with headers that look completely clean.
Sophisticated fraud-prevention systems combine several signals at once: proxy header detection, IP reputation and datacenter-range checks, device fingerprinting, behavioral biometrics, and velocity checks across accounts. A single signal — including a clean header scan — is rarely treated as conclusive on its own.
// Example: Server-side legacy proxy header detection (PHP)
$proxy_detected = false;
$check_headers = ['HTTP_VIA',
'HTTP_CLIENT_IP',
'HTTP_PROXY_CONNECTION',
'HTTP_FORWARDED'];
foreach ($check_headers as $h) {
if (!empty($_SERVER[$h])) {
$proxy_detected = true;
break;
}
}
// This alone will miss any well-configured VPN.
// Combine with an IP reputation/datacenter API for real coverage.
For website owners implementing proxy detection, we recommend header checks (this tool's approach) as one layer, IP reputation and datacenter-range queries (our IP Fraud Checker API) as a second, and WebRTC or client-side probing as a third. Layered detection catches meaningfully more than any single method, including this one, ever could alone.
Frequently Asked Questions About Proxy Detection
Q What is a proxy checker?
A proxy checker scans HTTP headers to detect legacy proxy and anonymizer usage. It examines 15 headers like X-Forwarded-For, Via, and Client-IP to classify your connection as showing a transparent proxy, anonymous proxy, or no legacy proxy signature.
Q Why does my VPN show as "No Proxy Detected" when I know I'm using one?
This is expected. Modern VPNs route your whole connection at the network layer and never add HTTP proxy headers like Via or Proxy-Connection — so a well-configured VPN and a direct connection look identical to a header scan. Cross-check with our WebRTC Leak Test and Cloud IP Check for the fuller picture.
Q What is the difference between transparent and anonymous proxy?
A transparent proxy forwards your real IP in headers — the website sees both the proxy and your real address. An anonymous proxy hides your IP but still sends headers indicating proxy usage. An elite proxy removes all proxy indicators, making it indistinguishable from a direct connection — the same signature a clean VPN produces.
Q Can websites detect my VPN?
Sometimes — through IP reputation and datacenter-range databases, WebRTC leaks, TLS fingerprinting, and timezone mismatches, rather than through headers alone. Our tool checks headers and WebRTC; use our IP Fraud Checker and Cloud IP Check for the reputation and range-based signals headers can't show.
Q What headers reveal proxy usage?
Via, Client-IP, Proxy-Connection, and the standardized Forwarded header (RFC 7239) are the most reliable legacy indicators. X-Forwarded-For is common but usually reflects CDN infrastructure rather than a personal proxy. Our tool scans 15 headers and separates the two categories clearly.
Q Why do I see proxy headers when I am not using a proxy?
CDNs like Cloudflare and Akamai add headers like CF-Connecting-IP and X-Forwarded-For to route traffic through their edge servers — roughly a quarter of all websites use Cloudflare alone. Corporate firewalls and ISP transparent proxies can also inject these headers. These reflect infrastructure, not your personal proxy status.
Q What is an elite proxy?
An elite proxy (high-anonymous) strips all proxy headers, making the connection appear direct — the identical signature a well-configured VPN produces. Neither can be confirmed or ruled out through headers alone; WebRTC leaks, IP reputation, and behavioral analysis are what actually catch them.
Q How do I hide that I use a VPN?
Use a VPN with residential-quality IPs, disable WebRTC, match timezone and language to your VPN's location, use an IP not flagged in reputation databases, and clear cookies. Run this proxy checker plus our WebRTC and Cloud IP Check tools, since headers alone won't confirm the full picture.
Q Is using a proxy or VPN illegal?
In most countries, using proxies and VPNs is completely legal. Some countries restrict VPN usage. Using a VPN or proxy for illegal activity is illegal regardless of the tool — the tool itself is neutral. This checker is meant to help you understand your own connection, not to encourage any particular use.
Related Privacy & Security Tools
Is Your Connection Actually Anonymous?
15 Header Checks, Plus the Honest Limits — One Free Scan
Our proxy checker scans HTTP headers, classifies legacy proxy signatures, cross-checks WebRTC, and tells you plainly what it can't confirm — so you know exactly what else to check.