How to Test a Proxy: Speed, Anonymity, Geolocation and Leaks

Step 1. Check the proxy string format

A surprising share of "dead proxy" reports are formatting mistakes: login and port swapped, a missing colon, a tool expecting ip:port:login:password when you pasted login:password@ip:port. Rule this out first, because every later test depends on it.

Paste your list into the free TrueSocks proxy checker. It parses the common formats (ip:port, ip:port:login:password, login:password@ip:port, and full socks5:// or http:// URLs), shows the host, port and credentials for each line, flags lines that cannot be valid and converts the whole list into the format your software expects.

• Impossible addresses, such as an octet above 255, are a typo, not a broken proxy.
• Private ranges like 192.168.x.x or 10.x.x.x are not reachable from the internet.
• No login and password usually means the proxy uses IP allowlisting: your own IP must be authorized on the provider side.

Step 2. Test connectivity with curl

curl is the quickest neutral test because it removes your browser, extensions and app settings from the picture. Send a request through the proxy to any service that returns your public IP. Below, ip.example.com is a placeholder: use any IP echo service you trust.

# HTTP(S) proxy
curl -x http://login:[email protected]:8000 https://ip.example.com

# SOCKS5 proxy, DNS resolved on the proxy side
curl -x socks5h://login:[email protected]:8000 https://ip.example.com

# verbose output to see where it fails
curl -v -x socks5h://login:[email protected]:8000 https://ip.example.com

Note the h in socks5h://. With plain socks5://, curl resolves the domain name on your machine and sends only the IP to the proxy, which means your own DNS resolver sees every site you visit. With socks5h:// the proxy resolves names itself. If the protocol is new to you, read what is a SOCKS5 proxy.

Reading common errors

• Connection timed out: wrong host or port, or an outgoing firewall on your side blocks that port.
• 407 Proxy Authentication Required: wrong login or password, or your current IP is not on the allowlist.
• Connection reset or empty reply: protocol mismatch, for example speaking SOCKS5 to an HTTP port or the other way round.
• Could not resolve proxy: a typo in the hostname, or a space or line break copied with the string.

Step 3. Verify the exit IP and geolocation

The IP returned in step 2 must be the proxy address (or, for some ISP and residential setups, a different exit IP from the same network), never your home or office IP. Write it down: you will use it in the next checks.

Then look that exit IP up in two or three geolocation services. Websites do not know where a server physically stands; they read commercial IP databases, and those databases do not always agree. One may show the right country and city, another a neighboring region, a third the registration address of the network owner.

1. 1Compare country, region, city and ASN (the network owner) across several databases.
2. 2If all agree on the country, you can rely on it for geo-targeted work.
3. 3If they disagree, check what your actual target sees: many sites show the detected region in the header, in shipping options or in account settings.
4. 4Check the connection type field if the database has one: hosting, ISP, residential or mobile. It should match what you bought.

Step 4. Measure latency and throughput against the real target

Generic speed tests measure the path to a test server, which tells you little about the path to the site you actually work with. Two numbers matter, and they are different:

• Latency (time to connect and time to first byte): decides how snappy browsing feels and how many requests per minute a scraper can make. Most proxy work is latency-bound.
• Throughput (megabits per second): matters for large downloads, video and media-heavy pages, rarely for scraping HTML.

curl -x socks5h://login:[email protected]:8000 -o /dev/null -s \
  -w "connect: %{time_connect}s  ttfb: %{time_starttransfer}s  total: %{time_total}s\n" \
  https://target.example.com/

Run it five to ten times and look at the spread, not the best result. Then run the same command without -x to see how much the proxy adds on top of the site's own response time. Distance dominates latency: a proxy in Germany will answer a German site faster than a proxy on another continent, whatever its bandwidth. If you need a specific region, pick proxies in that country, for example the US or Germany.

Expect residential and mobile proxies to be slower and more variable than datacenter and ISP ones. That is the nature of home and carrier networks, not a defect. The trade-offs are explained in residential vs datacenter proxies.

Step 5. Check the anonymity level

HTTP proxies are traditionally grouped into three anonymity levels, depending on which headers they add to your requests. To test, send a request through the proxy to a header echo service (any page that prints the request headers it received) and look for the headers below.

Private proxies from a reputable provider should behave as elite. If you see X-Forwarded-For with your own IP, stop using that proxy for anything sensitive. Keep in mind that header anonymity says nothing about whether a site can tell the IP is a proxy: that is decided by IP reputation and network type, covered below.

Step 6. Test for WebRTC and DNS leaks in the browser

A proxy can pass every command-line test and still leak in a browser. Open a leak test page in the exact browser profile you will use, with the proxy active, and check two things.

WebRTC leak

WebRTC powers in-browser calls and can discover local and public addresses to set up direct connections. In some configurations it reveals your real public IP even though page traffic goes through the proxy. Antidetect browsers usually let you replace the WebRTC address with the proxy IP or disable it per profile; regular browsers need a setting or an extension. Setup details are in our antidetect browser proxy setup guide.

DNS leak

A DNS leak means domain names are resolved by your local ISP resolver instead of through the proxy. The site sees a proxy IP in one country and a DNS resolver in another. Use remote DNS (socks5h, or the "proxy DNS" option in your browser or app) and confirm on the leak test page that the listed resolvers match the proxy region, not your home provider.

• Also compare browser timezone and language with the proxy country.
• Test after every browser or extension update: settings sometimes reset.

Step 7. Check IP reputation and blacklists

An IP that is online, fast and anonymous can still be useless if the target already distrusts it. Look the exit IP up in a few public blacklist and IP reputation services: they show whether the address appears on spam lists and how fraud-scoring systems classify it. A listing on an email spam blacklist matters little for browsing, while a high fraud score matters a lot for social networks and ad platforms.

The final and most honest test is the target itself. Open the site through the proxy, go through a normal user path and run a small batch of requests from your tool. Immediate captchas, 403 Forbidden or 429 Too Many Requests responses on the very first requests mean the address or the proxy type does not fit that platform. For demanding platforms, ISP proxies or residential proxies usually pass where datacenter IPv4 proxies do not.

What to do if a proxy fails the test

1. 1Re-run step 1 and step 2: most failures are format, protocol or authorization errors.
2. 2If the proxy works in curl but not in your app, the problem is the app settings: protocol, DNS mode or a leftover system proxy.
3. 3If the geolocation or reputation is wrong for your target, request a replacement address.
4. 4If several addresses of the same type fail on one platform, the type itself is wrong for that site: switch to a different one from the catalog.