Websites detect proxies mostly by the address. They look it up in lists of proxies, VPNs, Tor exits and hosting networks, and check what that one address has done before. Then they read what the connection itself shows: proxy headers, the fingerprint of the software that connects, the timing of the handshakes, behavior and browser leaks.
Residential proxies are detected too. Detection vendors list residential proxy exits, a research team catches them by timing, and Cloudflare scores their traffic request by request. On October 22, 2026, an IP reputation check flagged 98.9% of the 4,469 working free proxies we track on home and business networks.
How do websites detect proxies?
A site, or a service it pays for, reads several signals and weighs them together. These are the ones that vendors and researchers document:
| Signal | What the site reads | Works over https |
|---|---|---|
| Address lists | Whether the address is a known proxy, VPN, Tor exit or hosting range | Yes |
| Address reputation | Abuse reports against that one address | Yes |
| Proxy headers | Via, Forwarded or X-Forwarded-For in the request | No, plain http only |
| TLS fingerprint | Which software opened the encrypted connection | Yes |
| HTTP/2 fingerprint | The client's settings values and header order | Yes |
| Timing | The gap between the TCP and TLS round trips | Yes |
| Behavior | Request rate and how pages are loaded | Yes |
| Browser leaks | WebRTC addresses and the automation flag | Yes, in a browser |
The rest of this page takes them in that order, with the source for each.
The address: lists and reputation
Most detection starts with a lookup. MaxMind's Anonymous IP database marks addresses as public proxies, hosting providers, Tor exit nodes or residential proxies. IP2Location's IP2Proxy sorts them into nine types, residential proxies among them. Cloudflare gives its Enterprise customers ready-made lists of open proxies, anonymizers and VPNs.
These lists work address by address, so a known proxy on a home network is listed like any other. We measured this on the free proxies our checker tracks:
The free proxies on home and business networks even carried more abuse reports: 96.4%, against 73.0% on datacenter networks. The largest of those networks were carriers such as PLDT in the Philippines, Korea Telecom and Cox Communications.
Headers, on plain http only
The HTTP standard asks every proxy to announce itself. RFC 9110 says: "A proxy MUST send an appropriate Via header field". RFC 7239 defines a Forwarded header that can carry "the originating IP address of a request", and many proxies send X-Forwarded-For instead.
Free proxies follow that rule more often than not. On October 22, 2026, 86.0% of the 3,089 free proxies that relayed a plain HTTP request to our test server named a proxy in a header. Our guide to the anonymous proxy detected message breaks those grades down.
Over https, headers drop out. The browser asks the proxy for a tunnel with the CONNECT method, and RFC 9110 then limits the proxy to "blind forwarding of data". HTTP Archive's Web Almanac 2024 counted 98% of mobile requests on encrypted connections. So on most sites, headers say nothing about the proxy.
Fingerprints of the software that connects
The same tunnel passes your TLS handshake through unchanged. That handshake lists ciphers, extensions and curves in an order typical of the software that built it. JA3 turns five of those fields into a 32-character MD5 fingerprint. JA4+, its successor from FoxIO, is a suite of fingerprints that are "both human and machine readable".
Cloudflare reads both for its Enterprise Bot Management customers. Its help page calls the fingerprint "a stable identifier across different destination IPs, ports, and certificates". In plain words, it follows the software from one proxy address to the next. Our guide to JA3 and JA4 explains the fields.
HTTP/2 adds a second fingerprint. In a 2017 white paper, Akamai showed that the SETTINGS values a client sends, and the order of its pseudo-headers, identify the client software.
Timing: how residential proxies give themselves away
A residential proxy leaves a trace in its path. A team from EURECOM, KAUST and Amadeus describes it in a 2023 study: residential proxies "break the tcp session between client and server but maintain the tls one end-to-end". The server's TCP handshake ends at the proxy device, while the TLS handshake travels on to the real client.
So the server measures both round trips and compares them. In a four-month campaign, a gap above 50 milliseconds marked a residential proxy request. In earlier work by the same group, 96.57% of residential proxy connections showed a gap above 88.5 milliseconds. The method catches any proxy that splits the connection this way, VPNs and Tor included. It is also the subject of a US patent application, published in November 2023.
The method has blind spots. Some mobile networks split TCP connections too, and the authors found those can look like proxies. Browsers and phone hotspots changed the measurement "only marginally".
Behavior, request by request
Cloudflare set out its own approach in a 2024 post. Every hour, its model was classifying "more than 17 million unique IPs" that took part in residential proxy attacks. It also found that 4 of 5 requests from those networks came straight from the households' own devices.
That second number shapes the method. Cloudflare names data center addresses and known open proxies as the simplest IP signals. For residential addresses, its model "identifies residential proxy abuse without resorting to IP blocking", because blocking "can cause false positives for legitimate users".
Leaks from the browser
Two browser features can undo a proxy from the inside. RFC 8828 warns that WebRTC's connection checks "will bypass the proxy and reveal the public IP address of the client" when direct internet access is allowed. A browser under automation also says so: navigator.webdriver is true, for example in Chrome started with --headless, as MDN documents.
Can websites detect residential proxies?
Yes, by three routes. Lists cover them: MaxMind has an is_residential_proxy flag, IP2Proxy a residential type, and Spur sells data to "detect VPNs, residential proxies, and bots". Timing catches the split connection. Behavior models score the requests themselves.
What a residential address changes is the cost of a mistake. Real households share these addresses, so a site that blocks one blocks them too. That is why Cloudflare judges each request. Our page on datacenter and residential proxies covers the rest of the difference.
How to check what a site can see from your proxy
You need the proxy you use and a browser set up to use it. Then work through these checks:
- Look up the address the site sees. Connect through the proxy and open our IP lookup. Use the exit address it shows, not the gateway name you connect to. The result gives the network type and whether the address is a known proxy.
- Check the headers. Paste the proxy into our anonymity checker. It shows whether the proxy passes your address on, names a proxy, or adds nothing to a plain http request.
- Check for a WebRTC leak. Open our WebRTC leak test in the same browser. It shows whether the browser hands out an address other than the proxy's.
- Check the reputation. Our lookup gives no fraud verdict. FFraud's free proxy and VPN detection test shows whether an address is detected as a proxy, VPN, Tor node or datacenter host.
The checks have passed when the lookup shows the network you expect, the anonymity checker shows elite, and the leak test shows only the proxy's address. The common mistake is to check the gateway instead of the exit. A rotating proxy changes its exit, so check the address a site sees at that moment.
What this means if you buy proxies
Detection is the best reason to stay away from free proxies: 99.1% of the 7,251 working ones we checked on October 22, 2026 were already flagged. A residential proxy uses addresses that internet providers assign to home connections. These are still proxies, and the lists, timing and behavior checks above apply to them as well.
If a site's rules allow a proxy for your work, our residential proxies start at $0.50/GB for one GB.
What this page could not check
- We measured free public proxies only. We tested no paid proxy, no VPN and not our own network.
- Network type is our own best guess, so a few hosting networks may sit in the home and business group.
- The flags come from one IP reputation check. Other vendors can reach other verdicts, and none says how often it catches residential proxies.
- Sites do not say which signals they use or how they weigh them.
- The timing research is one group's work, and its threshold moves with mobile networks.
- We will check every number on this page again by January 22, 2027.
Sources
- MaxMind, GeoIP Anonymous IP database documentation, read October 22, 2026.
- IP2Location, IP2Proxy database, read October 22, 2026.
- Cloudflare, Managed IP Lists, updated April 16, 2026.
- Cloudflare, "Using machine learning to detect bot attacks that leverage residential proxies", June 24, 2024.
- Spur, documentation home page, read October 22, 2026.
- IETF, RFC 9110, "HTTP Semantics", June 2022: the Via header and the CONNECT method.
- IETF, RFC 7239, "Forwarded HTTP Extension", June 2014.
- IETF, RFC 8828, "WebRTC IP Address Handling Requirements", January 2021.
- HTTP Archive, Web Almanac 2024, Security chapter, November 11, 2024.
- Cloudflare, "JA3/JA4 fingerprint", updated May 6, 2026.
- Salesforce, JA3 README; FoxIO, JA4+ README; both read October 22, 2026.
- Akamai, "Passive Fingerprinting of HTTP/2 Clients", white paper, Black Hat Europe 2017.
- E. Chiapponi, M. Dacier and O. Thonnard, "The Impact of the Client Environment on Residential IP Proxies Detection", ACM IMC 2023 poster.
- EURECOM, US patent application 2023/0379363 A1, "Proxy detection systems and methods", November 23, 2023.
- MDN, "Navigator.webdriver", updated November 5, 2024.
- FFraud, proxy and VPN detection test, read October 22, 2026.
- HProxy, free proxy measurements of October 22, 2026, and our IP lookup capture of the same day.
