Glossary · Networking
Transparent proxy
A transparent proxy, in the terminology of RFC 9110 an interception proxy, is an intermediary that the client did not choose: it sits on the network path and filters or redirects outgoing web traffic without being configured in the client's software.
Reviewed 30 Oct 2026
Three meanings of the term
| Usage | Meaning | Where it comes from |
|---|---|---|
| Interception proxy | Placed on the path by the network operator; the client does not know or choose it | RFC 9110, section 3.7 |
| Non-modifying proxy | Changes nothing beyond what authentication and identification require | RFC 2616 (1999), since replaced; RFC 9110 now speaks of transforming and non-transforming proxies |
| Proxy-list anonymity level | Forwards the client's own IP in a header such as X-Forwarded-For | Informal industry usage; see anonymous proxy |
When someone says transparent proxy, ask which one they mean. Network engineers almost always mean the first.
Where interception proxies are found
RFC 9110 names the two classic places: public network access points, to make users sign in or accept terms before reaching the wider internet, and corporate firewalls, to enforce usage policies. Schools and some mobile networks use them for filtering and caching.
Why HTTPS limits interception
An interception proxy can read and rewrite plain HTTP, which is why RFC 9110 warns that network intermediaries are indistinguishable at protocol level from an on-path attacker. With HTTPS it sees only the destination name and encrypted bytes. To read the content it must present its own certificate, which browsers reject unless the organisation has installed its root certificate on the device — common on managed company laptops.
Transparent vs configured proxies
A proxy you configure — an HTTP proxy, a SOCKS5 endpoint or ARC's gateway — is the opposite case: your client knows it is there, authenticates to it and opens HTTPS through it with HTTP CONNECT, so TLS stays end to end. The broader comparison with VPNs is in proxy vs VPN.
FAQ
Questions
Something not covered? Write to contact@arcproxies.io.
Is a captive portal a transparent proxy?
A captive portal usually relies on one. The hotel or café network intercepts your first web requests and redirects them to a sign-in or terms page until you accept, which is the interception behaviour RFC 9110 describes.
Can a transparent proxy see my HTTPS traffic?
It can see which host you connect to and how much data passes, but not the pages or form contents, unless it terminates TLS with its own certificate. Your browser warns about that unless the device trusts the interceptor's root certificate.
Is ARC a transparent proxy?
No. ARC is a proxy you choose and configure: your client is pointed at the gateway and authenticates with a username and password. Nothing is intercepted on your network.
How can I tell if my network uses an interception proxy?
Signs include certificate warnings or an unfamiliar certificate issuer on HTTPS sites, a Via header on plain-HTTP responses, and redirects to a sign-in page. Comparing the issuer of a site's certificate on and off the network is the most direct check.
Sources & review
Last reviewed by the ARC Proxies team. Prices are read from the live catalog at build time.
In practice