Measured 9 September 2026 from a Hetzner server in Helsinki. Script and raw results are open.
“Transparent”, “anonymous”, “elite”: every proxy list uses the three words, almost nobody explains what they measure, and the lists are wrong often enough that we stopped trusting them. So we pulled 300 proxies from the most-starred free list on GitHub and tested each one ourselves.
The short version: 13 % were alive, and one in four of the live ones handed our real IP address straight to the target site.
What the three levels mean
A proxy sits between you and the website. The website sees the proxy’s IP address as the source of the connection. The question is what else it sees.
| Level | Target sees your real IP | Target can tell a proxy is in use | How |
|---|---|---|---|
| Transparent | yes | yes | proxy adds X-Forwarded-For: <your IP> or X-Real-Ip: <your IP> |
| Anonymous | no | yes | proxy adds Via, Proxy-Connection, X-Proxy-Id or a chain in X-Forwarded-For |
| Elite (high-anonymity) | no | no | proxy forwards the request untouched |
These are HTTP headers. They exist only on plain http:// requests. On https://, the proxy opens a tunnel (CONNECT) and cannot read or add anything inside it, so header leaks are impossible; the site still sees the proxy’s IP and can still judge it by reputation, but nothing about you.
That last point matters more than the levels: a transparent proxy is only transparent on HTTP. Most of the web is HTTPS. But the moment your scraper follows a redirect to an http:// URL, or fetches one insecure resource, the leak happens.
How we tested
- Fetched the
http,socks4andsocks5lists from the TheSpeedX/PROXY-List repository on GitHub, and took the first 200, 40 and 60 entries. - Through each proxy, requested
http://httpbin.org/get?show_env=1, which echoes back every header it received and the source address it saw. - Compared the echo with our own IP address.
- Then requested the same endpoint over
https://to see whether the proxy tunnels TLS at all. - 12 proxies in parallel, 12-second timeout each. One request per proxy.
A trap we fell into, so you don’t have to. httpbin.org sits behind an AWS load balancer that adds X-Forwarded-For, X-Forwarded-Port and X-Forwarded-Proto to every request, proxy or not. Our first pass counted those and concluded that zero proxies were elite. A control request with no proxy showed the same headers. The corrected rule: ignore the load balancer’s own headers, and count X-Forwarded-For as proxy-added only when it carries more than one address. If you build a proxy checker, run it once without a proxy first.
Results
| HTTP | SOCKS5 | SOCKS4 | All | |
|---|---|---|---|---|
| Tested | 200 | 60 | 40 | 300 |
| Alive (answered within 12 s) | 27 | 9 | 4 | 40 (13 %) |
| Tunnels HTTPS | 5 | 3 | 1 | 9 |
| Transparent (leaks your IP) | 10 | 0 | 0 | 10 |
| Anonymous (reveals a proxy) | 5 | 0 | 0 | 5 |
| Elite | 12 | 9 | 4 | 25 |
Median response time of the live ones: 2.6 s. The slowest 10 % took over 6.4 s. For comparison, the same request with no proxy takes 0.2 s.
Why the 260 dead ones died
| Reason | Count |
|---|---|
| No answer within 12 s | 162 |
| Connection refused | 33 |
| Wants a username and password (407) | 19 |
| SOCKS handshake failed | 19 |
| Connection dropped mid-request | 11 |
| Answered, but not with the page | 13 |
| Other | 3 |
Free lists are aggregated from scanners. An entry means “port was open when someone scanned it”, not “this is a proxy you can use”.
What the transparent ones actually sent
Four examples, as received by the target (our IP replaced with OUR.IP):
X-Forwarded-For: OUR.IP, 140.238.14.161
X-Real-Ip: OUR.IP
Proxy-Connection: Keep-AliveVia: 1.1 lb-1-24-7 (squid/3.5.27)
X-Forwarded-For: OUR.IP, 176.111.37.5X-Forwarded-For: 66.151.34.89
X-Real-Ip: OUR.IPThe third one is instructive. X-Forwarded-For looks clean, it contains only the proxy’s own address. X-Real-Ip gives you away anyway. A checker that only looks at X-Forwarded-For calls this proxy anonymous.
Every transparent proxy in the sample was an HTTP proxy. That is not a coincidence:
Why SOCKS proxies scored 100 % elite
SOCKS works below HTTP. It relays bytes and never looks at them, so it cannot add a header even if it wanted to. All 13 live SOCKS proxies came out elite. That does not make them safer in general; it means header leaks are the wrong thing to test on SOCKS. The leak to test on SOCKS is DNS: with socks5:// your own machine resolves the hostname before sending the IP to the proxy, and your resolver sees every site you visit. socks5h:// lets the proxy resolve. See our curl reference for the details.
What the Via headers said
Seven proxies announced themselves in Via:
1.1 lb-1-24-7 (squid/3.5.27)
1.1 191.44.125.9 (Mikrotik HttpProxy)
1.1 fly.io, 1.1 fly.io
HTTP/1.1 forward.http.proxy:3128
5a75d536b40d56d5.asia-south1-c/panwepxTwo are MikroTik routers with the built-in web proxy switched on, almost certainly someone’s office or home router that was never meant to be public. One is a Squid instance from 2017. One is a Fly.io app. The last one is a Palo Alto Networks proxy in a Google Cloud region. This is what “free proxies” are: misconfigured equipment belonging to people who do not know you are using it.
What this means in practice
- Do not trust the level printed on a free list. Of the 40 live proxies, 10 leaked our IP. The lists we took them from label most entries “anonymous” or “elite”. Test it yourself; the script takes one minute per hundred proxies.
- Test on HTTP, not HTTPS. An HTTPS test cannot detect a header leak, because the proxy cannot see the request. Every “proxy anonymity checker” that only loads an HTTPS page is checking nothing.
- Check more than
X-Forwarded-For.X-Real-Ip,Via,Proxy-Connection,X-Proxy-Id,Forwarded,X-Originating-Ip,Client-Ip,True-Client-Ipall appear in the wild. - Run a control. Your echo endpoint may add headers of its own. Ours did.
- Elite is not the same as undetectable. Elite means the headers are clean. The IP address still belongs to a datacenter, a router or a cloud region, and sites that block by address reputation do not care about headers. See what happens without a proxy: a perfectly clean request from a datacenter IP was blocked by five of nine sites.
Paid proxies
Commercial residential proxies are HTTP or SOCKS5 gateways with authentication, and they should all score elite; a provider that leaks the customer’s IP would not stay in business. We verify this for each provider we test with exactly this script, and the result goes into the review. If a provider’s number is missing from a review, the test has not been run yet, and the review says so.
Method notes: single request per proxy over plain HTTP, then one over HTTPS; 12 concurrent; 12 s timeout; 9 September 2026, 09:21–09:27 UTC, from AS24940 (Hetzner, Helsinki). Free-proxy lists change hourly; the exact set of addresses is in the raw JSON. Levels recomputed after the load-balancer correction described above; the original miscount is preserved in the file’s notes.