Types of proxy servers: how HTTP differs from SOCKS5

The words "HTTP", "SOCKS4" and "SOCKS5" appear in every proxy service's description, and they tell you whether a line will work in your software. The difference between protocols comes down to three things: how software tells the proxy where to connect, who turns a domain into an IP address and what the server does with traffic next. We go through all four protocols with tables and examples, and at the end show how the protocol pairs with the address source: from MIX packages to residential lines.

How a request passes through a proxy

Any proxy stands between your software and a website. The software opens a connection to the proxy, the proxy opens its own to the site and then pipes bytes both ways, so the site sees the proxy's address and not yours. Protocols differ at the first step: the form in which software hands the request to the server.

HTTP proxy: the request is read whole

Software sends an HTTP proxy a regular request, only with a full address: GET http://site/page. The proxy parses it, goes to the site itself and returns the response. Since the server sees the whole request, it can add the service headers Via and X-Forwarded-For, and the latter holds your real IP.

By these headers public proxies fall into three levels. A transparent proxy forwards your address to the site. An anonymous one hides the address, but headers show it is a proxy. An elite one adds nothing, and to the site it looks like a regular visitor. The free list shows the level for each address, and the Type column filters elite and anonymous ones. Check your own line on the anonymity check page: it shows both headers and WebRTC leaks.

In pure form the protocol serves sites without encryption, and almost none are left. So in practice "HTTP proxy" means a pairing: plain text for http addresses and a CONNECT tunnel for everything else.

HTTPS proxy: the CONNECT tunnel

For an encrypted site, software asks the proxy to open a tunnel with the command CONNECT site:443. The proxy answers with code 200 and then passes a stream it cannot look into: TLS runs from your software to the site straight through. The server is left with the domain, time and traffic volume. There is no separate "HTTPS proxy" protocol: it is an HTTP proxy with the CONNECT command allowed, and all our HTTP lines support it.

SOCKS4 and SOCKS5: passing a stream

SOCKS works a level lower and does not look into HTTP: software names the destination address, the proxy opens a TCP connection and then pipes the stream as is. The protocol does not care what is inside: a page, mail or game traffic. SOCKS4 accepts only IPv4 addresses and lives without a password, while version 4a learned domains. Both versions turn up in old software, and SOCKS5 replaced them in new projects.

SOCKS5 added three things: login and password authorization, IPv6 addresses with domains, and UDP transfer. One detail that people often forget matters for work: either your machine or the proxy can turn a domain into an IP. If your machine does it, the DNS query leaves from your address, and that trace cancels anonymity. In curl the scheme decides this: socks5:// resolves on the client, socks5h:// on the proxy. Both commands below print the line's exit address, and the second also hides DNS:

curl -x "http://LOGIN:PASSWORD@HOST:PORT" https://ifconfig.me
curl --socks5-hostname "LOGIN:PASSWORD@HOST:PORT" https://ifconfig.me

Streaming, calls, games and QUIC need UDP over SOCKS5. Among our plans Resi Prime supports it, and the others carry TCP through the proxy.

A separate note on the modern web. More and more sites speak HTTP/3, which rides on UDP. Through a proxy with no UDP the browser falls back to HTTP/2 over TCP by itself, and the site opens as usual, just with no speed gain. Nothing breaks here, but if the browser console shows protocol h2 where you expected h3, this is why.

Protocol comparison

Speed hardly depends on the protocol: overhead for all of them fits in one packet exchange at connection. The address source and the exit channel decide, and those belong to the pool. Our measurements of German addresses show how one protocol behaves on two different pools: response time differed four and a half times.

Protocol and address source: two separate axes

Buyers often ask which is "more reliable": HTTP or SOCKS5. To a website there is no difference: it sees an incoming connection from the proxy's address and does not know which protocol you used with the server. The address source gives a line its reputation: a data center, a home provider or a cellular network. You choose the protocol for your software and the source for the site you will work with.

On per-gigabyte plans you set the protocol when creating the list in the dashboard, and the line already contains the login, password and port. If your software expects a different record format, run the list through the proxy converter.

Line record formats

The protocol also shows in the line record itself. Software accepts a proxy in two forms: an address with a port or a full link with a scheme. In a link the protocol comes first, and people often confuse it with the site's protocol: the http:// scheme in a line tells how to connect to the proxy and does not mean https sites will fail to open through it.

The SLP checker and our dashboard accept all three records, and if your software insists on one format, the proxy converter rewrites the whole list: paste, pick a template, download. The guide to manual proxy setup helps you enter a line by hand in Windows, macOS or a browser.

What to pick for a task

• Scraping and checkers. SOCKS5 with the socks5h scheme so DNS goes through the proxy, or HTTP: both suit a scraper. For thousands of threads with no traffic meter take MIX packages, for accurate location take Resi Core lines.
• Browsers and anti-detect. Use HTTP: Chromium does not pass a login and password to SOCKS5, and a profile with such a line stays without a network. We wrote more about choosing a pool for accounts in the article on backconnect proxies.
• Streaming, calls, games. You need UDP, which means SOCKS5 on Resi Prime.
• Old software with no password field. MIX packages fit: access opens by your server's IP, so there is nowhere and no need to enter a login.

How to check a line

The my IP page shows the exit address and country, and the anonymity check shows headers and anonymity level. A whole list is easier to run through the SLP checker or the Linux script from the same page: it understands both ip:port and lines with a login, detects the port's protocol by itself and flags dead lines. We ran the curl commands from this article on live lines before publishing.

All plans draw from one balance: packages by term, the rest by gigabytes, and purchased traffic lasts three months. Prices for each volume are on the plan comparison page.