Every header a site receives from you.
One request, one answer: your IP, its country and network, and every header in the order it arrived. Headers that give a proxy away are flagged. Same answer as JSON from curl, Python or Node. No signup, nothing stored.
Asking the echo
This browser, right now. Nothing is stored.
- IP address
- -
- Country
- -
- Network (ASN)
- -
- HTTP
- -
- TLS
- -
| Header | Value |
|---|---|
| Waiting for the answer | |
Asked from this page with fetch, so the list includes Origin and Sec-Fetch headers a normal page load would not send. Headers our CDN and web server add on the way in are removed, and Accept-Encoding is hidden because the CDN rewrites it.
Check a proxy from the command line
Point any client at the same endpoint through your proxy. The answer is the JSON this page reads.
curl
curl -sS -x "http://USER:PASS@HOST:PORT" https://api.proxymint.com/headersPython requests
import requests
proxy = "http://USER:PASS@HOST:PORT"
r = requests.get("https://api.proxymint.com/headers",
proxies={"http": proxy, "https": proxy}, timeout=15)
seen = r.json()
print(seen["ip"], seen["country"], seen["verdict"])
for h in seen["proxy_headers"] + seen["client_flags"]:
print(h["name"], "=", h["value"], "-", h["why"])Node.js
// npm install undici
import { fetch, ProxyAgent } from 'undici';
const dispatcher = new ProxyAgent('http://USER:PASS@HOST:PORT');
const res = await fetch('https://api.proxymint.com/headers', { dispatcher });
const seen = await res.json();
console.log(seen.ip, seen.country, seen.verdict, seen.proxy_headers);Only need the exit address for a script? /ip answers it as one line of text:
curl -sS -x "http://USER:PASS@HOST:PORT" https://api.proxymint.com/ipAn answer looks like this. headers is a list of pairs so order and repeated headers survive; asn, http_version and tls_version are null when we cannot read them, never a guess.
{
"ip": "203.0.113.24",
"country": "US",
"asn": 64500,
"http_version": "HTTP/2",
"tls_version": "TLSv1.3",
"scheme": "https",
"method": "GET",
"path": "/headers",
"headers": [
["Host", "api.proxymint.com"],
["User-Agent", "curl/8.7.1"],
["Accept", "*/*"]
],
"proxy_headers": [],
"client_flags": [
{ "name": "User-Agent", "value": "curl/8.7.1",
"why": "The default user agent of an HTTP library. Many sites block it on sight." }
],
"verdict": "clean",
"note": "Over https:// an HTTP proxy only tunnels the encrypted connection ..."
}Up to 60 requests a minute per IP. Proxy list in the wrong shape for your tool? The proxy format converter turns colon lists into URLs.
Headers that give a proxy away
- X-Forwarded-For. The address chain of every hop before the last one. The first entry is often your real IP. A proxy that sends it is called transparent.
- Forwarded. The standard version of the same thing (RFC 7239): client address, protocol and proxy chain in one header.
- Via. Names the proxy in the path, often with its software and version, for example 1.1 squid.
- X-Real-IP, Client-IP, True-Client-IP. One address a proxy or load balancer says is the original client.
- Proxy-Connection. A proxy-only header that should never reach a site. Old clients and proxies leak it, and it marks the request as proxied.
- Proxy-Authorization. Your proxy login. It should end at the proxy; if the echo shows it, the proxy passed your password on. Change it.
Over https:// an HTTP proxy only tunnels the connection and cannot add any of these, so a flag there means your own client sent it. What our gateway forwards, measured per scheme, is in proxymint Lab #1. Headers are one signal of many; the rest, from IP type to time zone, are in how websites detect proxies, and what to do when a site still says no is in proxy detected errors.
Headers are clean but the site still knows? Run the proxy check for DNS, WebRTC, IPv6 and time zone leaks, and read DNS leaks through a proxy.
Common questions
Send one request through the proxy to an echo endpoint and read what comes back: curl -x "http://USER:PASS@HOST:PORT" https://api.proxymint.com/headers. The answer is JSON with your exit IP, its country, every header in the order it arrived and a list of the headers that give a proxy away.
For an https:// address an HTTP proxy opens a CONNECT tunnel and relays encrypted bytes. It never sees the request, so it cannot add Via or X-Forwarded-For. Over https:// the headers in the answer are the ones your own client sent.
A transparent proxy passes your real IP on in X-Forwarded-For or a similar header. An anonymous proxy hides your IP but still announces itself with Via or Proxy-Connection. An elite proxy adds nothing, so the request looks like it came straight from the exit IP.
If it is the default of an HTTP library, such as python-requests/2.32 or curl/8.7, many sites block it on sight. The echo flags those. Set a current browser user agent, and send the other headers that browser would send with it.
No. The endpoint answers and keeps nothing. The only state is a per-IP request counter for the rate limit of 60 requests a minute, which resets every minute.