Glossary · Networking
X-Forwarded-For
X-Forwarded-For is a widely used but non-standard HTTP request header in which proxies and load balancers record the IP address they received a request from, building a comma-separated chain; RFC 7239 (2014) standardised the same idea as the Forwarded header.
Reviewed 30 Oct 2026
# Replace echo.example with a header-echo endpoint you controlcurl -s -x "http://USERNAME_pool-arcfast_country-de:PASSWORD@proxy.arcproxies.io:8000" http://echo.example/headerscurl -s -x "http://USERNAME_pool-arcfast_country-de:PASSWORD@proxy.arcproxies.io:8000" https://echo.example/headersWhat the headers look like
| Header | Example | Status |
|---|---|---|
X-Forwarded-For | X-Forwarded-For: 192.0.2.60, 198.51.100.17 | De facto; no RFC |
Forwarded | Forwarded: for=192.0.2.60;proto=https;by=203.0.113.43 | RFC 7239 |
Each intermediary appends the address it received the request from, so the left-most entry claims to be the original client. Forwarded also carries the protocol and host, and lets a proxy put an obfuscated identifier starting with an underscore in place of a real address.
Who adds it
Mostly the site's own infrastructure: a reverse proxy, load balancer or CDN adds it so that the application behind it can log the visitor's address rather than the balancer's. Forward proxies can add it to plain-HTTP requests they forward; whether they do is a configuration choice and the root of the anonymous proxy levels.
Over HTTPS through a CONNECT tunnel, a forward proxy cannot add it: the request is encrypted between your client and the site.
Why servers should not trust it blindly
RFC 7239 is explicit that the header cannot be relied on, because any node on the path, including the client, can write it. A server should only believe entries added by proxies it operates — in practice, reading the chain from the right and stopping at the first address that is not one of its own.
What to verify with any proxy
Send one request over http:// and one over https:// through the proxy to a header-echo endpoint you control, and look for X-Forwarded-For, Forwarded and Via in what arrives. Do this for any provider, ARC included, rather than relying on a description. The same request shows which exit address the site saw; test proxy location covers the rest of the check.
FAQ
Questions
Something not covered? Write to contact@arcproxies.io.
What is the difference between X-Forwarded-For and Forwarded?
X-Forwarded-For is a de facto header that carries only addresses. Forwarded, defined in RFC 7239, carries the client address, the proxy's interface, the original host and the protocol in one field, and allows obfuscated identifiers instead of real addresses.
Can X-Forwarded-For be faked?
Yes. Any client can send the header with any value, which is why servers should only trust entries appended by their own proxies and treat the rest as claims.
Does every proxy add X-Forwarded-For?
No. Reverse proxies and load balancers commonly add it for their backends. Forward proxies may or may not for plain HTTP, and cannot for HTTPS sent through a CONNECT tunnel.
Does X-Forwarded-For reveal my real IP when I use a proxy?
Only if a proxy in the chain writes your address into it. Over HTTPS through a tunnel your forward proxy cannot; for plain-HTTP targets, check with a header-echo endpoint which headers arrive.
Sources & review
Last reviewed by the ARC Proxies team. Prices are read from the live catalog at build time.
- [1]IETF: RFC 7239: Forwarded HTTP Extension
- [2]IETF: RFC 9110: HTTP Semantics
In practice