X-Forwarded-For
An HTTP header a proxy can add to name the original client's IP, and the single biggest tell that separates an anonymous proxy from a transparent one.
X-Forwarded-For is a header that carries the address of the client a request was forwarded on behalf of. It exists for a legitimate reason: a server sitting behind a load balancer needs some way to recover the real visitor's IP. But when a forward proxy adds it, the header quietly hands the destination the very address the proxy was supposed to hide.
This is what proxy anonymity grades actually measure. A transparent proxy passes your real IP straight through in X-Forwarded-For or a related header, so it changes your route but not your identity. An anonymous proxy hides your IP but still announces that a proxy is in use. An elite proxy sends neither tell, so the request looks like an ordinary direct connection.
For anyone choosing a proxy, this header is the difference between privacy and the illusion of it. An address can change where traffic appears to come from and still leak who is behind it in one header, which is why the anonymity grade matters as much as the IP itself.
It is not the only header that does this, which matters when you go looking. Via names the intermediary and its protocol version. Forwarded, standardised in RFC 7239, packs the client, the protocol and the host into one structured field. X-Real-IP is a widely used single-value variant. Proxy-Connection is a non-standard leftover that some clients still emit and which announces a proxy by its mere presence. Checking only for X-Forwarded-For and finding none proves less than people assume.
The header also accumulates rather than being replaced, which is how chains become visible. Each proxy in a path can append the address it received from, producing a comma-separated list that reads as a route. A destination reading a value with several entries can see not just that you were proxied but roughly how many hops were involved.
Worth noting that the header is entirely legitimate in its intended setting. A reverse proxy or load balancer sitting in front of a site's own servers has to pass the real visitor's address inward somehow, or every request would appear to come from the load balancer. The problem is not that the header exists; it is a forward proxy adding it on the way out, where it defeats the entire purpose of being there.
And because it is just a header, it can be forged in both directions. Anything can send an arbitrary value, which is why a site should never trust it from an untrusted source, and equally why the absence of it is a claim about your proxy rather than a guarantee about your privacy.
How HProxy handles it
Our checker inspects exactly these headers on every free proxy and grades it elite, anonymous or transparent from what it actually sends, rather than trusting the label a source attached to it.
Frequently asked questions
How do I check if my proxy sends X-Forwarded-For?
Send a request through it to any endpoint that echoes back the headers it received, then read the response. Look for your own public address anywhere in it, and for Via, Forwarded, X-Real-IP or Proxy-Connection alongside. Your address present means transparent; absent but with one of those headers present means anonymous; none of them present means elite.
Can I just remove the header myself?
No, because you are not the one adding it. A transparent proxy inserts it after your request has left, so nothing you configure on your side prevents it. The only remedy is a proxy that does not add it, which is what the anonymity grade describes.
Is X-Forwarded-For a security problem?
It is on the receiving end, and for the opposite reason. Any client can send an arbitrary value, so a server that trusts the header from an untrusted source can be fed a false client address, which breaks IP-based rate limiting or access control built on it. Servers should only trust it from proxies they operate.
Why would a proxy add this header at all?
Because in its intended role it is necessary. A reverse proxy or load balancer in front of a site's own servers must pass the real visitor's address inward, or every request would appear to originate from the load balancer and logging and rate limiting would be useless. The header is doing its job there; the problem is a forward proxy adding it on the way out.
Back to the full glossary.