The headers that give a proxy away#
| Header | What it leaks | Level that sends it |
|---|---|---|
| X-Forwarded-For | The client's real IP address | Transparent |
| Via | That a proxy is in the path, sometimes its software | Transparent, anonymous |
| X-Proxy-ID, Forwarded | Proxy identity or the original client | Transparent, anonymous |
| none | Nothing | Elite |
How to check#
Request a header-echo service through the proxy and inspect the response. Any header naming a proxy or an address that is not the exit means the level is not elite. Do it for HTTP as well as HTTPS: with HTTPS the proxy cannot add headers inside the encrypted request, so plain HTTP is where leaks show.
How it works at ProxShift#
ProxShift gateways and dedicated addresses are elite: they strip incoming proxy headers, add none of their own and never terminate TLS.