Proxy Anonymity Levels

Proxy anonymity levels are a three-tier classification that proxy vendors and free-proxy lists still use to describe how much a proxy tells the target about the client behind it. A transparent proxy passes your real IP along in an `X-Forwarded-For` header and announces itself with `Via`. An anonymous proxy admits it is a proxy but hides the origin address. An elite or high-anonymity proxy sends neither marker, so the request looks like it came straight from the exit IP.

The mechanism is just request headers, and the target inspects them server-side like any other input. The tell-tale set is small: `Via`, `X-Forwarded-For`, `Forwarded`, `X-Real-IP`, `Client-IP`, `X-Proxy-ID` and a stray `Proxy-Connection`. MDN describes `X-Forwarded-For` as "a de-facto standard header for identifying the originating IP address of a client connecting to a web server through a proxy server", with `Forwarded` as the standardized version that sees much less use (read 2026-07-27). MDN also warns that untrusted values in that header cannot be relied on for security decisions, which cuts both ways: a target cannot fully trust what it sees, and a scraper cannot assume a clean header set means it is invisible.

For modern scraping the taxonomy is close to useless. Every commercial residential, ISP and mobile gateway is elite by construction, because the vendor terminates your connection and originates a fresh one from the exit node. There is no forwarding chain left to leak. Meanwhile detection moved down and up the stack: TLS handshake fingerprints, HTTP/2 settings frames and header ordering, then behavioral scoring across the session. An anonymity rating says nothing about any of that. It answers a 2010 question.

Where it still earns its keep is sanity-checking a cheap or free pool before you trust it. Point the proxy at an endpoint that echoes the request headers back, either a public one such as httpbin.org/headers or a small handler you control, and confirm that no forwarding header carries your real address. Do it across a sample of exits, not one, because pools are rarely uniform. Then stop there. Passing a header echo test tells you the proxy is not leaking; it tells you nothing about whether the exit IP is already flagged, which subnet it sits in, or how the gateway's TLS stack looks to a defended target.