Transparent Proxies

Transparent Proxies

A transparent proxy forwards requests through its server but reveals the user's original IP address to the website. It can do this by adding the address to an HTTP header, a field carrying information alongside the request. Connecting through a different IP therefore does not necessarily hide your own address.

The term belongs to the older classification of proxy anonymity levels. Elite / High Anonymity behavior has become the norm for modern commercial proxies: the service does not forward the client's original IP or add headers announcing proxy use. The Transparent category is mainly useful for understanding older descriptions and labels in public proxy lists.

How the website learns your IP

Suppose your public IP is 198.51.100.24 and the proxy reaches the website from 203.0.113.80. The proxy opens the connection to the website, so the website sees the proxy's address as the connection source.

When forwarding an unencrypted HTTP request, however, the proxy can add X-Forwarded-For: 198.51.100.24. The website then receives two addresses: the proxy IP from the connection and your IP from a field inside the request.

A request travels from a device at 198.51.100.24 through a proxy at 203.0.113.80 to the website. The website receives the proxy IP from the connection and the user's original IP in X-Forwarded-For.
The proxy connects from its own IP but also sends the user's address inside the HTTP request.

An IP-checking page may display only the connection address. You would see the proxy IP even though your own address also reached the website. To check for this disclosure, compare the forwarded value with the public IP you use to connect to the proxy: the presence of X-Forwarded-For alone does not prove that it contains your real address. A website does not have to trust a header supplied by another party, but when the value is your IP, the information has already arrived.

Why preserve the original address?

Proxies also perform tasks that do not require anonymity. Within an organization's network, a proxy can restrict website access, filter requests, or store responses that allow caching so it can serve them again without fetching them from the origin server.

When a request passes through several systems belonging to one organization, the next system may need to know which client sent it. Passing on the original address helps with request accounting and access rules. That is a deliberate infrastructure choice. It does not suit a customer buying a proxy to hide their IP from outside websites.

Another meaning of “transparent”

In network documentation, a transparent proxy can also mean a proxy through which traffic is routed automatically. The user does not enter a proxy address in the browser; network equipment sets the route. An administrator can use this arrangement to direct devices through a shared filtering system.

Here, the word describes how the connection is arranged. In the anonymity classification, it describes the disclosure of an IP to a website. These are independent properties: manual proxy setup does not guarantee that the address stays hidden, and automatic redirection alone does not mean it is forwarded in HTTP headers.

What changes with HTTPS?

The X-Forwarded-For example applies to a request the proxy can read. For a normal HTTPS connection through an HTTP proxy, the application opens a tunnel using CONNECT. The request to the website, including its headers, then travels inside an encrypted TLS connection. A proxy that only relays those encrypted bytes cannot insert your IP into it.

A corporate gateway that decrypts HTTPS works differently: the user's device must trust its certificates for inspection to proceed without certificate errors. A Transparent result from a plain HTTP test therefore cannot automatically be applied to HTTPS carried through a tunnel.

Back to the knowledge base