A forward proxy works for the people who send requests. A reverse proxy works for the website that receives them. The HTTP standard, RFC 9110, separates the two by who chose the machine. A proxy is "chosen by the client, usually via local configuration rules". A gateway, which the standard also calls a reverse proxy, is an intermediary that "acts as an origin server for the outbound connection but translates received requests and forwards them inbound to another server or servers".
We read RFC 9110, RFC 7239, Apache's proxy manual, MDN, W3Techs' usage figures and five other guides on October 13, 2026, all from our server. We also sent three ordinary requests to see reverse proxies at work in real headers.
What is the difference between a forward and a reverse proxy?
Ask who put the proxy there. If the client did, by setting it in a browser, an app or the system, it is a forward proxy. It speaks for that client, and the sites it visits see the proxy's address. If the website did, by placing it in front of its servers, it is a reverse proxy. It speaks for the site, every visitor reaches it first, and no visitor sets anything up for it.
Forward or reverse: how to tell
| Question | Forward proxy | Reverse proxy |
|---|---|---|
| Who chose it | The client | The website |
| Set up where | In the client | Before the servers |
| Speaks for | Its clients | Its servers |
| Hides | The client | The origin |
| Visitors notice | Their own setting | Nothing to set |
| Examples | Office proxies, proxy services | Cloudflare, nginx, CDNs |
RFC 9110, Apache's mod_proxy manual and MDN, read October 13, 2026
The definitions, from the HTTP standard
RFC 9110 names three intermediaries. A proxy is "a message-forwarding agent that is chosen by the client, usually via local configuration rules". Organizations use proxies to "group an organization's HTTP requests through a common intermediary for the sake of security services, annotation services, or shared caching". A gateway acts as the origin server for whoever connects to it. Gateways serve "to encapsulate legacy or untrusted information services", to speed servers up with what the standard calls accelerator caching, "and to enable partitioning or load balancing" of a service. A tunnel "acts as a blind relay between two connections without changing the messages". That is how an HTTP proxy carries an HTTPS connection it cannot read.
One case falls between the definitions. An interception proxy, also commonly known as a transparent proxy, differs from an HTTP proxy "because it is not chosen by the client". The network's operator puts it there. RFC 9110 finds such proxies "on public network access points" and "within corporate firewalls to enforce network usage policies". It acts for that operator, so the client's settings do not reveal it.
The word gateway needs care. RFC 9110 uses it for the reverse kind, and Apache's manual agrees: "A reverse proxy (or gateway)". MDN uses it for the other kind: "There are two types of proxies: forward proxies (or tunnel, or gateway) and reverse proxies". In AI chat apps, "reverse proxy" names something else again, an API relay for language models, which our page on that other meaning explains.
Apache's manual: two switches
Apache's web server can be either kind, and its manual describes both. "An ordinary forward proxy is an intermediate server that sits between the client and the origin server." "The client must be specially configured to use the forward proxy to access other sites." Its typical use is "to provide Internet access to internal clients that are otherwise restricted by a firewall". The ProxyRequests directive switches it on, and the manual opens with a warning: "Open proxy servers are dangerous both to your network and to the Internet at large." MDN estimates that "There are likely hundreds of thousands of open forward proxies on the Internet."
A reverse proxy "appears to the client just like an ordinary web server. No special configuration on the client is necessary." It decides where each request goes and "returns the content as if it were itself the origin". The ProxyPass directive sets one up, and "It is not necessary to turn ProxyRequests on in order to configure a reverse proxy." The same program does either job, and its configuration decides which.
Reverse proxies you pass through every day
Most people never set a proxy, and many of their requests still meet one. W3Techs defines a reverse proxy service as "an intermediary for a website which handles request from web clients on behalf of the website's server". On October 13, 2026, it found 31.5% of all websites behind one of the services it monitors. Cloudflare alone covered 27.0%, an 85.5% share of that market. W3Techs counts services only, so an nginx a site runs itself does not appear in these figures.
Reverse proxies leave marks in the headers. We sent three plain requests from our server, with no proxy set, and kept the lines that show who answered.
The first request went to httpbin.org, which echoes the headers its application received. We sent three, and the application saw four. The fourth, X-Amzn-Trace-Id, is the header Amazon's load balancer writes: by AWS's documentation, it "adds or updates the X-Amzn-Trace-Id header before sending the request" on. Wikipedia answered from Apache Traffic Server, "A fast, scalable and extensible HTTP/1.1 and HTTP/2 compliant caching proxy server". Its age header says the copy we got had waited 16,917 seconds, about four hours and 42 minutes, in that cache. Cloudflare's own site answered with "server: cloudflare".
One request, both kinds of proxy
A single request can meet both kinds. It leaves through the proxy its client chose, crosses the internet, and arrives at the reverse proxy the website put in front of its servers.
Client
a browser, an app or a script
Forward proxy
chosen by the client; the site sees its address
The internet
the request travels on
Reverse proxy
set up by the website; every visitor reaches it first
Origin server
answers the reverse proxy, never the client
Each hop sees only its neighbor's address. The reverse proxy sees the forward proxy, and the origin server sees the reverse proxy, unless a header carries the earlier address along. When the reverse proxy cannot get an answer from the origin, the visitor receives the reverse proxy's error instead. Two of the most-viewed reverse proxy questions on Stack Overflow are exactly that, an nginx reverse proxy returning 504 (492,211 views) and one returning 502 (158,353 views). Our guides to 504 Gateway Timeout and 502 Bad Gateway cover both.
The headers that carry the client's address
Three headers describe the path. Via names the intermediaries: "Each member of the Via field value represents a proxy or gateway that has forwarded the message." RFC 9110 makes it a duty: "A proxy MUST send an appropriate Via header field, as described below, in each message that it forwards." X-Forwarded-For carries the client's address. MDN calls it a de-facto standard and notes that the standard version, Forwarded, is "much less frequently used". RFC 7239 defines that Forwarded header so proxies can "disclose information lost in the proxying process, for example, the originating IP address of a request".
Those headers cut both ways. MDN warns that X-Forwarded-For "exposes privacy-sensitive information by design, such as the IP address of the client". A website also cannot trust what arrives in it, because anyone can write the header before the request reaches the site's own proxies. MDN's rule is strict: "Any security-related use of X-Forwarded-For (such as for rate limiting or IP-based access control) must only use IP addresses added by a trusted proxy." Our page on 429 Too Many Requests shows what rate limits count.
Proxy lists grade forward proxies by these same headers. One that passes your own address on is called transparent, and one that sends none of them is called elite. An elite proxy leaves out the Via header the standard asks of every proxy. Our page on transparent, anonymous and elite proxies covers the grades and how to test them.
What other guides get wrong
The most-voted reverse proxy question on Stack Overflow asks exactly this page's question: "What's the difference between a proxy server and a reverse proxy server?", with 616,618 views since 2008. We read five pages that rank for it.
- Oxylabs writes that a forward proxy "hides the web server's real IP address by using one of its own". A forward proxy stands in for the client. MDN puts it plainly: "Forward proxies can hide the identities of clients whereas reverse proxies can hide the identities of servers." The same page calls reverse proxies "of no particular use to consumers and regular people", while W3Techs counts Cloudflare alone in front of 27.0% of all websites.
- TheServerSide (2022, updated November 2025) says a forward proxy lets "computers isolated on a private network" reach the internet. That describes the office case only. MDN notes that a proxy "can be on the user's local computer, or anywhere between the user's computer and a destination server on the Internet".
- InstaSafe writes that "the clients in forward proxy servers belong to the internal network". Proxy services run forward proxies on the internet for clients anywhere.
- Kemp calls the forward proxy "the most common of all the proxy servers" and gives no count. The only count we found covers reverse proxy services.
- GeeksforGeeks is accurate and names the interception case: forward proxies can "operate without explicit client-side proxy configuration". It leaves out the headers above and the rule on trusting them.
Where HProxy fits
HProxy sells forward proxies. You set one in your software, and the sites you visit see its address. Residential proxies cost $0.44 per GB, ISP proxies hold one static address, datacenter proxies cost $1.58 per IP a month and mobile proxies cost $1.50 per GB. Each speaks HTTP, HTTPS and SOCKS5, and our page on SOCKS5 explains the difference. The proxy checker shows which address a site sees through one. A reverse proxy is the website's own machinery, and none of ours sits in front of anyone's site.
What we could not find out
- How many forward proxies exist. No census exists, and MDN's "hundreds of thousands" covers open ones only, as an estimate.
- How many websites run their own reverse proxy. W3Techs counts services such as Cloudflare, so a site's own nginx falls outside its 31.5%.
- What every field of Wikipedia's x-cache header means. We read the headers only.
Our next check of these figures is due by April 13, 2027.
Sources
Every page below was read on October 13, 2026, from our server.
- IETF: RFC 9110, HTTP Semantics, section 3.7 on intermediaries and section 7.6.3 on Via (June 2022).
- IETF: RFC 7239, Forwarded HTTP Extension (June 2014).
- Apache HTTP Server: mod_proxy, forward proxies, reverse proxies and the open proxy warning (version 2.4).
- MDN: Proxy servers and tunneling, X-Forwarded-For, Via and Age.
- W3Techs: usage statistics of reverse proxy services (October 13, 2026).
- AWS: request tracing for the Application Load Balancer.
- Apache Traffic Server: project page.
- Stack Overflow: proxy server and reverse proxy server, found among the highest-voted questions with "reverse proxy" in the title, through the Stack Exchange API.
- Google Keyword Planner: worldwide monthly averages, pulled October 13, 2026.
- Guides we judged, read the same day and deliberately left unlinked: Oxylabs, TheServerSide, InstaSafe, Kemp and GeeksforGeeks.
