How Websites Detect Proxies
Updated:
Websites detect proxies by comparing several signals: which ASN the IP belongs to and whether it is blacklisted, whether latency and TCP traits fit the claimed device, whether the browser sends proxy headers or leaks its real IP through WebRTC, and whether time zone and language match the IP's location. A single signal rarely decides anything. What raises suspicion is inconsistency between signals. This guide walks through each one, shows which you can control and ends with a checklist for a consistent proxy setup. The aim is stable, legitimate proxy use, not getting around a platform's rules.
Detection is scoring, not a switch
Most platforms do not have a simple proxy on/off filter. They collect signals, add up a risk score and decide whether to allow, challenge, limit or block. A clean datacenter IP with a correctly configured browser usually passes on ordinary sites; the same IP with a mismatched time zone and a WebRTC leak quickly scores higher.
It also means no proxy type makes an account immune to restrictions. A proxy changes the IP address. Every other signal still comes from your browser, device and behaviour.
Seven signals websites commonly use
| Signal | What the site sees | Can you control it |
|---|---|---|
| ASN and IP type | Whether the IP belongs to a telecom or a host | Yes, by choosing the proxy type |
| Blacklists and reputation | Past reports of spam, attacks or fraud | Partly, through dedicated IPs and clean use |
| Latency and TCP traits | Round-trip times and packet traits that do not fit the device | Little, mainly by choosing a nearby country |
| HTTP headers | Headers such as Via or X-Forwarded-For reveal a proxy | Depends on the provider |
| WebRTC | Real or local IP exposed over UDP | Yes, through browser settings |
| DNS | Resolver in a different country from the IP | Yes, through configuration |
| Time zone, language, fingerprint | Browser reports settings that do not fit the IP | Yes, through the browser profile |
Signals from the IP address itself
ASN and IP type come first. The ASN shows whether an address belongs to a telecom or a data centre, and commercial databases add labels such as hosting, VPN, proxy or mobile. See what an ASN is.
Blacklists and reputation: an IP used for spam, password guessing or fraud may sit on block lists or carry a high fraud score. Shared proxies are prone to this because you inherit other people's history. Our guide to IP blacklists covers checking and fixing it.
Address ranges: many accounts logging in from neighbouring IPs in one /24 can be treated as related. See subnets and multiple accounts.
Signals from the connection
Latency: from Vietnam through a US proxy, each request crosses the Pacific twice. Some systems compare response times at different layers and notice when they do not fit the distance between the IP and the site. It is a weak signal alone but adds up with others.
TCP/IP traits: every operating system shapes packets slightly differently. Through an HTTP proxy, the connection to the website is opened by the proxy server, so those traits belong to the server and may differ from the OS your browser reports. You cannot really change this; just know it exists.
Headers: a poorly configured proxy may add Via, X-Forwarded-For or Forwarded headers containing your real IP. Load a header-echo page through the proxy and confirm nothing reveals your own address; if it does, raise it with the provider or switch.
Signals from the browser
- WebRTC: the browser can send STUN requests over UDP, outside the HTTP proxy, and expose your real IP. It is the most common mistake. See what a WebRTC leak is.
- DNS: if domains are resolved by your home provider instead of on the proxy side, a site may see a Vietnamese resolver alongside a US IP. See what a DNS leak is.
- Time zone and language: JavaScript reads your system time zone and browser language. A Japanese IP with an Asia/Ho_Chi_Minh time zone is an obvious mismatch.
- Browser fingerprint: screen size, fonts, graphics card and canvas. Accounts sharing one fingerprint can be linked even on different IPs.
Checklist for a consistent setup
- Match the IP type to the platform: datacenter IPv4 for tasks without logins, static ISP for valuable accounts. See IPv4 or ISP for which task.
- Use dedicated IPs so you do not inherit someone else's history, and check new ones with the IP blacklist checker.
- Pick a country close to your audience: Vietnamese accounts on Vietnamese IPs, US markets on US IPs.
- Align time zone, language and location in each antidetect profile with the IP's country.
- Block WebRTC leaks and confirm with the WebRTC leak test.
- One fixed IP per account, without switching IPs on accounts that are working fine.
- Verify inside the real profile using What is my IP.
When a site still blocks you
Some sites block all datacenter IPs, some block by country and some rate-limit per IP. If you have gone through the checklist and still get blocked, work out whether the block is about IP type, IP history or behaviour before switching proxy types. The diagnostic steps are in what to do when a website blocks your proxy. And follow the platform's terms: a proxy gives you a stable connection from the right country, not a way around the rules.
Frequently asked questions
Can a website know for certain that I use a proxy?
Usually it estimates a probability from several signals rather than knowing for sure. Datacenter IPs, proxy headers and WebRTC leaks raise it; a consistent setup lowers it.
Can dedicated proxies be detected?
Sites can still see that a datacenter IP belongs to a host through its ASN. The difference is that a dedicated IP does not carry other people's bad history.
Are ISP proxies harder to detect than datacenter proxies?
ISP proxies carry a consumer provider ASN, so they are not labelled as hosting by ASN. WebRTC, time zone and fingerprint still need to be configured correctly.
Does a VPN avoid detection better than a proxy?
Not necessarily. IPs of popular VPN services are often labelled as VPN in IP databases. The two also work differently; see our proxy vs VPN comparison.
What is the X-Forwarded-For header?
A header some proxies add to tell the destination the user's original IP. A proxy meant to change your IP should not add it, because it reveals your real address.
Dedicated IPs without someone else's history
Private IPv4 in seven countries and static ISP proxies in Vietnam and the US. One customer per IP, static for the rental period, refunds for technical faults per policy.
View pricing