Forward Proxy vs Reverse Proxy: What's the Difference?

Two proxies, two directions

The word "proxy" covers two very different kinds of server. The difference is whose side they're on.

• A forward proxy sits in front of clients. It makes requests to the internet on behalf of users. The websites see the proxy, not the users.
• A reverse proxy sits in front of servers. It receives requests from the internet on behalf of a website. Users see the proxy, not the servers behind it.

Every proxy you buy from a proxy provider, whether residential, datacenter or mobile, is a forward proxy.

Forward proxies in detail

A forward proxy is configured on the client side. Your browser or application knows it's using a proxy and sends requests to it.

Common uses:

• Commercial proxy services for scraping, automation and geo-testing.
• Corporate web gateways that filter and log employee browsing, block malware and enforce acceptable-use policies. These are often configured automatically with PAC files.
• Caching proxies in schools and offices that store frequently accessed content to save bandwidth.
• Privacy for individuals hiding their IP.
• Accessing content restricted by geography.

Popular software for running your own forward proxy includes Squid, Tinyproxy, 3proxy and Dante (for SOCKS). See self-hosted Squid proxy.

Reverse proxies in detail

A reverse proxy is configured on the server side. Users have no idea it's there. They type the website's address and the reverse proxy answers.

Common uses:

• Load balancing across many application servers.
• TLS termination, handling HTTPS certificates so backend servers don't have to.
• Caching static content close to users (CDNs are giant distributed reverse proxies).
• Security, hiding origin server IPs, filtering attacks, rate-limiting and bot detection.
• Compression and optimisation of responses.

Popular reverse proxies include Nginx, HAProxy, Caddy, Traefik and Envoy. Cloudflare, Akamai and Fastly operate enormous reverse-proxy networks.

Comparison table

Where the two meet

When you scrape a website protected by Cloudflare through a residential proxy, your traffic passes through both kinds: your forward proxy (the residential network) and the site's reverse proxy (Cloudflare). The reverse proxy is often where bot detection happens. It examines the IP that arrives from your forward proxy, plus your TLS fingerprint, headers and behaviour, and decides whether to let you through. That's why choosing high-trust forward proxies matters for scraping. See web unblocker proxies and avoiding IP bans when scraping.

A quick example of each

A forward proxy configuration in curl:

curl -x http://proxy.example.com:3128 https://example.com

A minimal reverse proxy in Nginx:

server {
    listen 80;
    server_name example.com;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Note the X-Forwarded-For header: reverse proxies use it to tell the backend the client's real IP. Forward proxies that add the same header are "transparent" and reveal the user. See proxy anonymity levels.

Which do you need?

If you want to hide your identity, access content as if you were somewhere else, or collect data from websites, you need a forward proxy, and usually a commercial one. Start with the best proxies guide. If you run a website and want speed, security and scalability, you need a reverse proxy such as Nginx or a CDN.

Forward proxies in corporate networks

In many organisations, every employee's web traffic goes through a forward proxy (often called a secure web gateway). It typically:

• Authenticates users, often with single sign-on.
• Enforces policies, such as blocking categories of sites.
• Scans downloads for malware.
• Logs activity for security investigations.
• Sometimes decrypts HTTPS traffic using a company-installed root certificate, so it can inspect contents.

If you're doing proxy work from a corporate laptop, your traffic may pass through the corporate forward proxy before it reaches your commercial proxy. That can cause failures (blocked ports, TLS inspection breaking certificate checks). Test from a network you control. See proxy chains.

Reverse proxies and bot protection

Reverse proxies are where most bot protection lives. When a site uses a CDN or bot management service, every request hits that reverse proxy first. It can:

• Check the client IP's reputation and ASN.
• Fingerprint TLS and HTTP/2 behaviour.
• Serve JavaScript challenges or CAPTCHAs.
• Rate-limit per IP, per session or globally.
• Pass clean traffic to the origin server.

For scrapers, this means the reverse proxy is the gatekeeper you're really dealing with. Choosing the right forward proxy type (residential, ISP, datacenter) is about getting past it. See avoiding IP bans when scraping.

Transparent and intercepting proxies

A third category worth knowing: transparent (intercepting) proxies, which sit on the network path and handle traffic without the client being configured. ISPs, schools and public Wi-Fi networks sometimes use them for caching or filtering. Because they're invisible to the client, they can surprise you when debugging. They're another reason to test proxy setups on networks you control.

How to tell which kind of proxy you're dealing with

When you're debugging, it helps to know whether a proxy in the path belongs to you, your network or the website. A few quick checks:

1. Look at your own configuration first. If your browser, system settings or code point at a proxy host and port, that's a forward proxy you chose. Also look for automatic configuration (PAC) entries. See proxy setup on Windows and proxy setup on macOS.
2. Read the website's response headers. Run curl -sI https://example.com. Headers such as cf-ray, x-cache, x-served-by or via usually mean a CDN or caching reverse proxy is answering on the site's behalf.
3. Echo your request headers. If a header-echo service shows X-Forwarded-For, Via or Forwarded values you didn't send, something between you and the site added them. The standard Forwarded header is defined in RFC 7239.
4. Compare the IP the site sees with your own. A different IP with no proxy configured on your side usually points to a transparent proxy or a VPN somewhere on the network.

Reverse proxy headers in a website's responses are normal and harmless to you as a visitor. Forward proxy headers in your requests that reveal your address are the ones to worry about; see proxy anonymity levels.

If you want to experiment with both roles safely, a small self-hosted Squid proxy on a cheap VPS makes a good lab, and Nginx on the same machine can play the reverse proxy.

Summary table

FAQ

Is a VPN a forward proxy?

Functionally it plays a similar role, acting on behalf of the client, but it works at the network layer for the whole device and adds encryption. See proxy vs VPN.

Is Cloudflare a proxy?

Yes, Cloudflare is a reverse proxy for the websites that use it.

Can one server be both?

Software like Nginx and Squid can be configured either way, but a given deployment usually plays one role.