The journey of a request
When you type a URL without a proxy, your device looks up the website's IP address through DNS, opens a TCP connection to it, negotiates TLS if it's HTTPS, and sends an HTTP request. The website sees your public IP address as the source of that connection.
With a proxy, the destination of that first connection changes. Your device connects to the proxy server instead, and asks it to make the connection to the website on your behalf. From the website's point of view, the connection comes from the proxy.
How exactly that "asking" happens depends on the proxy protocol. There are three main mechanisms worth understanding.
1. Plain HTTP forwarding
For unencrypted http:// URLs, your client sends the full request to the proxy, including the absolute URL:
GET http://example.com/page HTTP/1.1
Host: example.com
Proxy-Authorization: Basic dXNlcjpwYXNzThe proxy reads the request, opens its own connection to example.com, sends the request (minus the proxy-specific headers), receives the response and relays it back. Because the traffic is plain text, the proxy can read and even modify everything. That's why plain HTTP through an untrusted proxy is dangerous.
2. HTTPS through a CONNECT tunnel
Almost all websites now use HTTPS. For these, the client asks the proxy to open a raw tunnel using the CONNECT method:
CONNECT example.com:443 HTTP/1.1
Host: example.com:443
Proxy-Authorization: Basic dXNlcjpwYXNzIf the proxy agrees, it replies HTTP/1.1 200 Connection established, opens a TCP connection to the website, and from then on simply shovels bytes in both directions. Your client then performs the TLS handshake directly with the website through the tunnel.
The key consequence: the proxy can't read the contents of your HTTPS traffic. It sees the hostname you asked to connect to (and usually the SNI in the TLS handshake), how much data flows and when, but not the URLs, headers or page contents. This is true for almost every commercial "HTTP proxy" you buy. See HTTP vs HTTPS proxies for the naming confusion around this.
3. SOCKS5
SOCKS5 is a lower-level protocol. Instead of speaking HTTP, the client sends a short binary handshake: which authentication method it wants, then a request to connect to a host and port. After that, the proxy relays raw bytes, just like a CONNECT tunnel. SOCKS5 can also relay UDP, which HTTP proxies can't, and it can resolve DNS on the proxy side so your local network never sees which domains you look up.
What the website sees
With a correctly configured proxy, the website sees:
- The proxy's IP address as the connection source.
- Whatever HTTP headers your client sends. A well-behaved commercial proxy adds nothing. Badly configured or "transparent" proxies may add headers such as
X-Forwarded-FororViathat reveal your real IP or the fact that a proxy is in use. See proxy anonymity levels. - Your TLS fingerprint, browser fingerprint and cookies, which pass through unchanged.
What your ISP or network sees
Your ISP or office network sees that you're connected to the proxy's IP and port, and how much data you transfer. With HTTPS or SOCKS5 tunnels, it doesn't see the content. With plain HTTP, it can see everything. Unless you use SOCKS5 with remote DNS, or a proxy-aware browser, your DNS lookups may also be visible. See DNS leaks and proxies.
Proxy tip: A practical next step is to run a few requests through a commercial pool and watch what changes. Geonode supports HTTP, HTTPS and SOCKS5 and lets you switch between rotating and sticky sessions from the same endpoint. We walk through it in our Geonode proxies guide.
How rotating proxy gateways work
Commercial rotating proxies add another layer. You don't connect to an individual proxy; you connect to a gateway (also called a backconnect server, super proxy or entry node):
- Your client connects to
gate.provider.com:portand authenticates. - The gateway parses targeting parameters, often encoded in your username, such as country, city or session ID.
- The gateway selects an exit node (a residential device, mobile modem or datacenter IP) that matches.
- Your traffic is relayed from the gateway to the exit node and out to the website.
Because you only ever talk to the gateway, the provider can change the exit IP on every request, keep it fixed for a sticky session, or swap a failing node without you changing anything. This architecture is explained further in backconnect proxies and what is proxy rotation.
Where residential IPs plug in
In a residential network, the exit node is a real consumer device running the provider's software, connected over a persistent link back to the provider's infrastructure. When the gateway assigns your request to that device, the device opens the connection to the website from its home broadband line, which is why the website sees a residential IP. The extra hops explain why residential proxies are slower than datacenter proxies.
Ports and authentication
A proxy listens on a specific port, commonly 8080, 3128, 8000, 1080 for SOCKS, or a provider-specific port that may encode the country or session type. See proxy ports explained.
Proxies authenticate you either with a username and password (sent in the Proxy-Authorization header or the SOCKS5 handshake) or by checking that your connection comes from a whitelisted IP. See proxy authentication methods.
Seeing it for yourself
You can watch the whole exchange with curl's verbose flag:
curl -v -x http://USER:PASS@proxy.example.com:8080 https://httpbin.org/ipYou'll see the CONNECT request, the proxy's 200 response, the TLS handshake, and finally the JSON showing the proxy's IP. Our curl proxy guide covers more options.
Where the extra milliseconds go
A proxy adds at least one extra hop, and you can measure exactly where the time is spent. curl's timing variables split a request into stages:
curl -s -o /dev/null -x http://USER:PASS@proxy.example.com:8080 \
-w "connect: %{time_connect}s\ntls: %{time_appconnect}s\nfirst byte: %{time_starttransfer}s\ntotal: %{time_total}s\n" \
https://example.comRead the numbers like this:
- connect is the TCP connection to the proxy, not the website. A high value means the proxy is far away or overloaded.
- tls covers the CONNECT exchange plus the TLS handshake with the website through the tunnel. Rotating gateways choose an exit node at this stage, which is why residential proxies often look slowest here.
- first byte adds the website's own processing time.
- total includes downloading the response.
Run the same command without -x to get a direct baseline. The difference is your proxy overhead.
One more thing worth knowing: connection reuse changes the picture. A long-running client with keep-alive pays the connect and tunnel cost once per connection, not once per request, so a scraper often feels much faster through a proxy than a series of one-off curl commands suggests. The trade-off is that reused connections keep the same exit IP, which matters for rotation (see what is proxy rotation).
For fair benchmarking across providers, read how to test proxy speed. The CONNECT method itself is specified in RFC 9110, the current HTTP semantics standard.
Summary
- A proxy is a relay: you connect to it, it connects to the site.
- HTTP URLs are forwarded in readable form; HTTPS URLs go through an encrypted CONNECT tunnel.
- SOCKS5 is a lower-level relay that supports any TCP traffic and UDP.
- Commercial rotating proxies use gateways that pick an exit IP for you.
- The IP changes; your browser fingerprint and behaviour don't.
Ready to choose? Start with our guide to the best proxies.
Editorial note: Proxy providers change their pools, features and prices often, so treat any figures here as typical ranges at the time of writing and confirm current terms with the provider before you buy.