Protocols

What is HTTP Proxy?

An HTTP proxy is a server that forwards HTTP requests on a client's behalf, parsing the protocol rather than blindly relaying bytes. The client sends the full target URL in the request line, or issues a CONNECT to tunnel an HTTPS session. Proxies conventionally listen on ports such as 8080 or 3128; port 80 belongs to the origin web server.

Two request shapes cover almost everything. For plaintext HTTP the client sends an absolute-form request line, GET http://example.com/page HTTP/1.1, along with a Host header, and the proxy resolves the name, opens its own connection to the origin and returns the response. For HTTPS the client sends CONNECT example.com:443 HTTP/1.1, the proxy answers 200 Connection Established, and from that point it relays raw bytes in both directions. TLS is negotiated end to end through that tunnel, so the proxy learns the hostname and the byte counts, nothing of the content.

Authentication is part of the protocol. A proxy that requires credentials answers 407 Proxy Authentication Required with a Proxy-Authenticate header, and the client retries carrying Proxy-Authorization, usually Basic with base64 of user:password. The 407 and the more familiar 401 are different failures - one is the proxy refusing you, the other is the destination site - and confusing them sends people debugging the wrong hop. Providers commonly allow IP allowlisting instead, where the proxy accepts any request from a registered source address and sends no header.

Because it understands HTTP, the proxy can also add to it. Transparent and anonymous proxies append Via and X-Forwarded-For headers that disclose the original client address or the fact that a proxy is in the path, while elite proxies pass the request through without those additions. Some intermediaries insert the legacy Proxy-Connection header. Any of this is visible to the destination, which is why anonymity checkers exist. They report which headers arrived and whether your real address came with them.

The protocol boundary is where an HTTP proxy stops. It handles HTTP and, via CONNECT, tunnels TCP to whatever ports it permits, which is often only 443. SOCKS5 sits lower and relays arbitrary TCP plus UDP association, so anything that is not HTTP-shaped belongs there. One more caveat is the hop between client and proxy, which stays plaintext unless the proxy itself terminates TLS, so Basic credentials on an untrusted network are readable by anyone on the path.

Where you meet it

You configure one constantly without thinking about it: curl -x http://user:pass@host:8080, the http_proxy and https_proxy environment variables, Chrome's --proxy-server flag, or the proxy fields in Scrapy and Playwright. The https_proxy variable trips people up, since it names the proxy used for https:// URLs rather than implying the connection to the proxy is encrypted. When requests fail, read the status code first - a 407 is your credentials, a 403 is the destination.

Common questions

Is traffic through an HTTP proxy encrypted?

The link to the proxy is not, unless the proxy speaks TLS itself. For an https:// destination the client opens a CONNECT tunnel and negotiates TLS with the origin server, so the page content stays encrypted and the proxy only learns the hostname and port. Plain http:// traffic passes through readable, headers and body included.

What port does an HTTP proxy run on?

There is no reserved port. Common conventions are 8080, 3128 and 8888, and commercial providers assign their own, frequently in high ranges. Port 80 is the default for web servers rather than for proxies, so a plan listing 80 is describing the destination protocol, not the port you should connect to.

HTTP proxy or SOCKS5, which should I use?

Use HTTP when your traffic is web traffic and you want the proxy to read headers or apply per-URL rules. Use SOCKS5 when you need arbitrary TCP, UDP, or a protocol the proxy should not interpret. Many providers expose the same endpoint on both, differing only by port number.

Related terms

HTTPS Proxy
An HTTPS proxy carries encrypted TLS traffic between a client and a destination site, usually by opening a tunnel with the HTTP CONNECT method to port 443. The proxy relays raw bytes without reading the request path, headers or body. The term also describes a proxy whose own listening port accepts a TLS-encrypted client connection.
SOCKS5
SOCKS5 is a session-layer proxy protocol, defined in RFC 1928, that relays TCP connections and can relay UDP datagrams for any application rather than only web traffic. It negotiates an authentication method first, then takes a target given as an IPv4 address, an IPv6 address or a domain name and forwards bytes without interpreting them.
SOCKS4
SOCKS4 is the earlier version of the SOCKS proxy protocol. It relays TCP connections only and addresses targets by raw IPv4 address, with no authentication beyond a user ID string the proxy may ignore. The SOCKS4a extension adds hostname support. SOCKS5 superseded it, and current clients keep SOCKS4 only for legacy endpoints.
SSL/TLS
SSL and TLS are the protocols that encrypt and authenticate traffic between a client and a server. SSL is the deprecated original; TLS is what runs today, with TLS 1.2 and TLS 1.3 the only versions current software should negotiate. The handshake proves the server's identity with a certificate, then agrees the keys used for the session.
HTTP/2
HTTP/2 is a binary version of HTTP that carries many concurrent requests as multiplexed streams over a single TCP connection and compresses headers with HPACK. It keeps HTTP's methods, status codes and header semantics unchanged, so only the wire format differs. Browsers negotiate it during the TLS handshake through ALPN, advertising the identifier h2.
HTTP/3
HTTP/3 is HTTP carried over QUIC, which runs on UDP and builds the TLS 1.3 handshake into the transport itself. It keeps HTTP semantics and HTTP/2-style multiplexing while removing TCP's head-of-line blocking, so a lost packet stalls only its own stream. Clients discover it from an Alt-Svc header or an HTTPS DNS record and negotiate it as h3.
QUIC
QUIC is an encrypted transport protocol that runs over UDP instead of TCP and carries HTTP/3 traffic, normally on UDP port 443. It combines the transport and TLS 1.3 handshakes into one exchange and multiplexes independent streams without head-of-line blocking. The protocol identifies a connection by an ID rather than by an address and port pair.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.