X-Forwarded-For

X-Forwarded-For (XFF for short) is a line in the HTTP headers of a request. An intermediate server adds the IP address the request came from. If the request passes through several such servers, the header holds several addresses separated by commas. The leftmost one usually belongs to the client.

Most often this header is added by a reverse proxy or a load balancer in front of a website. The web server only sees the address of the load balancer, so it learns the visitor's IP from XFF. A transparent proxy in an office or carrier network can do the same.

Two more headers sit next to XFF. Via shows which intermediate nodes the request passed through. Forwarded is the standard version from RFC 7239, where the client address, protocol and host go into one field, for example Forwarded: for=203.0.113.5;proto=https.

Here is how it looks in practice. You open a website, and the request goes first through the proxy and then through the website's load balancer. If the proxy adds XFF with your address, the load balancer appends the proxy address, and the web server gets both. If the proxy adds nothing, the header holds only the proxy address written by the load balancer. That is why it matters how every link in the chain behaves, not just the last one.

If you work through a proxy, these headers matter for a simple reason. If an intermediate server passes them on, the website can read your real IP from them, even though the connection came from another address. Proxies that do not add such headers and do not reveal themselves are called anonymous or elite proxies.

Keep in mind that XFF is plain text. A client can write anything into it, so websites usually trust only the part of the header added by their own server. But you cannot see from the outside how a given website behaves, so it is better to know for yourself what it receives. So treat the header neither as proof nor as protection.

Checking this is easy. Open the My IP page through the proxy and see which address, country and ISP it shows. You can also test the proxy line separately with the proxy checker. If your home IP shows up anywhere, look for the cause in the chain: the browser, the program or an intermediate server that adds headers.