Proxy anonymity levels: transparent, anonymous and elite proxies

The three levels describe what a proxy adds to your requests. A transparent proxy passes your real IP address on to the site and says it is a proxy; an anonymous proxy hides your address but still says it is a proxy; an elite (high-anonymity) proxy adds neither. They only apply to plain http:// requests: over HTTPS, which most sites use, a proxy cannot add anything to your request, so every proxy behaves as an elite one. What gives a proxy away today is its address and your own browser, not its headers.

Answer · The live comparison uses prices checked up to Oct 24, 2026; every figure in the text keeps the date it was checked.

What each level sends

A proxy that forwards a plain HTTP request can add lines (headers) to it before passing it on. Two matter here. X-Forwarded-For, or its standard form Forwarded, carries the address the request came from (MDN: X-Forwarded-For, RFC 7239). Via names each proxy the request passed through, and the HTTP standard says a proxy must send it (RFC 9110, section 7.6.3).

So an elite proxy is one that leaves out the Via line the standard asks for. Office and school proxies, and the caching proxies some networks run, are usually transparent on purpose: they exist to filter or speed up traffic, not to hide anyone.

Why HTTPS makes the levels mostly beside the point

For an https:// page, your software asks the proxy to open a tunnel to the site, then sends its request through the tunnel, encrypted (HTTP vs SOCKS5 proxies explains the tunnel). The proxy cannot read that request, so it cannot add a header to it; the site receives exactly the headers your own software sent. The same goes for any SOCKS proxy, which relays bytes without reading them. The levels were made for an older web of plain HTTP, and they live on mostly in the labels of free proxy lists.

What a site actually checks

• The address itself. Sites and anti-bot services know which address ranges belong to hosting companies, so a datacenter address reads as a server however clean its headers are. Addresses that appear on public proxy lists, or that carried abusive traffic, end up on block lists. Residential and mobile addresses cost more partly because they come from household and phone connections, not hosting networks (why residential proxies are expensive).
• Your browser. A browser reveals plenty on its own: cookies from earlier visits, a time zone or language that does not match the proxy’s country, and, through WebRTC, sometimes your real local or public address. A proxy changes none of that.
• Your name lookups. If your computer looks up site names itself rather than through the proxy, your own network’s DNS server sees every site, and the lookup does not come from the proxy’s side (SOCKS4 vs SOCKS5 covers which settings fix it).

How to check a proxy yourself

Fetch a page that prints back the headers it received, such as http://httpbin.org/headers, through the proxy, over plain http:// so the proxy has the chance to add something. If you see your own address, or Via, X-Forwarded-For or Forwarded, the proxy is not elite. Then load an address-check page in the browser you will use, to see which address and location the site sees.

Free lists and paid proxies

Free proxy lists label each entry with a level because their entries are often open proxies that nobody configured for privacy, and many pass your address on. A paid proxy is normally set up not to, but the label does not replace the test above, and it says nothing about who else can see your traffic. Are free proxies safe? covers that risk; the box above shows what paid datacenter addresses, shared or dedicated, and traffic from a paid residential pool cost today.