A proxy server is an intermediary computer that forwards requests between a client and other servers, hiding the client’s address or controlling, filtering and caching the traffic.
How proxy servers work
Instead of connecting directly to a website, the client sends its request to the proxy, which makes the connection on its behalf and relays the response. The destination sees the proxy’s IP address, not the user’s. Main types:
- Forward proxies serve clients – for example a corporate web gateway that filters sites and scans downloads.
- Reverse proxies sit in front of web servers, terminating TLS, balancing load and often hosting a web application firewall.
- Transparent proxies intercept traffic without client configuration.
- Protocols – HTTP proxies use the CONNECT method to tunnel HTTPS, while SOCKS5 (RFC 1928) can relay arbitrary TCP and UDP traffic.
Unlike a VPN, a proxy usually handles only specific applications and does not necessarily encrypt traffic.
Why proxy servers matter for security
Defenders use proxies to enforce policies, inspect traffic and log web access. Attackers use them to hide their origin and bypass geo-based or IP-based controls. Residential proxies – traffic routed through home devices – are especially valuable to criminals for credential stuffing, ad fraud and account takeover, because the requests look like ordinary users. Many such networks are built from infected computers, routers and Android TV boxes: in 2024 an international operation dismantled the 911 S5 botnet, which sold access to around 19 million compromised IP addresses. Misconfigured open proxies are also abused to relay spam and attacks.
Best practices
- Never expose internal proxies to the internet without authentication.
- Route corporate web traffic through a secure gateway and log it centrally.
- Treat logins from known residential proxy and anonymiser ranges as higher risk.
- Avoid free public proxies, which can read or modify unencrypted traffic.
