Elite proxy

An elite proxy hides your real IP address. It also adds no header that admits a proxy is in the path. No Via, no X-Forwarded-For, no Forwarded, no X-Real-IP. The destination receives a request shaped like a direct connection from the proxy's own address. The grade is also written high anonymity or level 1. It sits at the top of the scale proxy lists use: transparent proxy, anonymous proxy, elite proxy, with distorting proxy sometimes added as a fourth.

The grade is decided by a few HTTP headers, and the standards explain why those headers exist. RFC 9110 is the HTTP specification, published in June 2022. It says a proxy must send a Via header in each message it forwards, so that forwards can be tracked and request loops avoided. It allows a pseudonym where the real host is sensitive, but it never allows silence. RFC 7239, from June 2014, standardised the Forwarded header that carries the original client address. Its own introduction says a proxy used for client anonymity will not use it. X-Forwarded-For does the same job without a standard behind it. The IANA field name registry lists Via and Forwarded as permanent headers. It had no entry for X-Forwarded-For when we checked on 2 September 2026. An elite proxy is one whose operator sends none of these, which strictly breaks one requirement of the standard.

Elite is a configuration, not a product class. Take Squid, the open source proxy. Its documentation says it appends the client address in X-Forwarded-For by default and includes Via by default. An operator turns the first off with forwarded_for delete and the second off with via off. The reference notes that the via directive needs a build compiled with http violations enabled. That name tells you how the HTTP standard views a silent proxy. Apache's mod_proxy adds X-Forwarded-For through ProxyAddHeaders, which is on by default, while its ProxyVia directive is off by default. nginx appends the client address with one proxy_set_header line and a built-in variable. The same server can be transparent one day and elite the next after one configuration change. That is why a grade is measured, never assumed.

We grade every free proxy the same way. A request goes through it to a server we control, and we read the headers that arrive. On 2 September 2026 our free proxy list held 3,042 live proxies that answer on plain HTTP. Of those, 2,390 returned a readable echo. 1,373 graded elite, 428 anonymous and 589 transparent. One graded HTTP proxy in four still hands the destination your real address.

The grade only carries meaning for a plain HTTP proxy. Only a proxy that reads your request can add a header to it. An HTTPS request through an HTTP proxy travels inside an HTTP CONNECT tunnel. RFC 9110 describes that tunnel as blind forwarding of data in both directions. A SOCKS5 proxy sits between the application and the transport layer and never reads HTTP at all. Both grade elite by construction. On 2 September 2026 our list carried 8,278 elite entries. 6,905 of them answer only on HTTPS or SOCKS. Their grade comes from the protocol, not from any care by the operator.

Elite describes the headers and nothing else. It says the request does not confess to being proxied. It says nothing about whether the address is trusted. A destination can look up which ASN owns the address in one query. An elite datacenter proxy on a hosting range is challenged on that lookup before any header is read. The grade also says nothing about your TLS fingerprint, your browser fingerprint or your request pacing. Elite removes the cheapest reason to distrust you and leaves every other one intact.

Two naming traps come with the term. In the standards, transparent proxy means something else. RFC 3040 uses it for a proxy that does not modify the request beyond what proxy authentication and identification require. RFC 9110 uses it for an interception proxy the client never configured. On a proxy list the same word means the proxy leaks your address. And elite is silent about privacy from the operator. A plain HTTP request is readable by whoever runs the proxy, elite or not. An open proxy on a free list is run by a stranger.