I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header that is sent by our system to its server. According to the website, by examining the Via or X-Forwarded-For header, one can conclude whether the client is using a proxy or not. When I visited the website without using any proxy, it showed both of these headers as not present (which was expected). But, when I visited this website again, this time using the Tor Browser, still the two headers were not present! No sign of proxy at all.

I have a very vague idea about the working of Tor, but I am not sure why the headers are unable to detect the proxy when using the Tor Browser! Can anyone explain the reason for the same in layman's terms? Also, if Tor offers this level of anonymity, is there any other way to detect a Tor proxy?

  • 1
    for a discussion on how tor works you may want to see security.stackexchange.com/q/36571/21234
    – Shurmajee
    Commented Jul 6, 2013 at 11:35
  • 3
    @qbi - I appreciate the edit to change "TOR" with "Tor", but to be fair it used to be written as an acronym TOR of The Onion Router, however, according to Wiki: "...the current project no longer considers the name to be an acronym, and therefore does not use capital letters". Just thought to mention this, as I couldn't comment on your suggested edit I was approving (only possible on rejection). We see the old acronym still being used by many. ;)
    – TildalWave
    Commented Jul 7, 2013 at 20:21
  • Well, the FAQ entry makes it perfectly clear: »Tor is not spelled "TOR".«
    – qbi
    Commented Jul 7, 2013 at 22:18
  • Yeah. It's clear now. Thanks! Man, there's a lot more out there to learn about Tor. :P Commented Jul 7, 2013 at 23:09
  • Just for your future reference, this is a much more complete proxy check website: whatismyipaddress.com/proxy-check
    – Gaia
    Commented Oct 3, 2013 at 3:18

4 Answers 4


Tor simply repeats requests as an anonymous transparent HTTP proxy, meaning it does not attach typical proxy headers (such as Via or X-Forwarded-For), or in any other way modify HTTP requests or responses (besides being "onion routed, encrypted and decrypted" through the Tor network).

As for identifying clients connecting through Tor network, the easiest to detect such clients on the web server end is to query the public TorDNSEL service that publishes Tor exit nodes:

TorDNSEL is an active testing, DNS-based list of Tor exit nodes. Since Tor supports exit policies, a network service's Tor exit list is a function of its IP address and port. Unlike with traditional DNSxLs, services need to provide that information in their queries.

Previous DNSELs scraped Tor's network directory for exit node IP addresses, but this method fails to list nodes that don't advertise their exit address in the directory. TorDNSEL actively tests through these nodes to provide a more accurate list.

This TorDNSEL querying can be automated e.g. in your web application, and example code in many programming languages can be found on the Internet. For example, here is some sample code demonstrating how to do that in PHP.

If you're going to implement this Tor checking in your web application, then I recommend you cache query results locally for some time it's reasonable to expect the exit nodes didn't change in the meantime, not to constantly repeat same queries and add an additional lag to your responses.

Edit to add: One more way to optimize this Tor exit node querying and avoid using TorDNSEL all the time is to do a reverse DNS lookup beforehand, and try and match it against a list of major known Tor exit node hosts. This can be actually quite effective, as a lot of major exit node hosts never change and they can operate a large number of exit nodes all using same or similar rDNS names. For example, you could try matching rDNS names to your list using regular expressions, LIKE SQL operator, or similar. Some of the known Tor exit node hosts (real examples) will match these names:


This is the list that I'm using. As you see, it's far from being complete, but it is a start and you can always add more entries as you detect them to follow an easily matched pattern. As it is meant to merely optimize querying, it doesn't really need to be complete, but each match will most certainly speed things up. Hope this helps!

  • If the exit nodes don't change and are well known, how long until web services which choose to block proxies (for legal or whatever reasons) start blocking Tor traffic? I was under the impression Tor usage didn't advertised itself so blatantly...
    – Gaia
    Commented Oct 3, 2013 at 3:16
  • 1
    @Gaia - Tough to judge, since they do change, but majority of traffic actually goes through large hosts that might use clearly identifiable DNS names, like in those few examples listed. It would depend greatly on the ability of individual services to query TorDNSEL, but my guess would be you can filter out roughly 3/4 of Tor clients cheaply by doing faster rDNS lookups, and the rest then through querying TorDNSEL. Implementations will vary in effectiveness and reaction time, though. It is however possible to do it real-time, with some smart local caching in place.
    – TildalWave
    Commented Oct 3, 2013 at 3:31

The X-Foreward-For-header is sent optionally (and purposefully) by proxies. If a proxy tries to hide the identity of its user, it won't sent this header.

The Onion Network is specifically designed for the purpose of keeping the users identity hidden. It will never reveal the IP address or any other data that could show the users identity.


A small note here:

While going through the Wikipedia article on Proxy Servers, I found out that even if the proxy servers are not using the header lines such as HTTP_VIA, HTTP_X_FORWARDED_FOR, or HTTP_FORWARDED, it is still possible for a website to suspect a proxy if the packets sent by the client include a cookie from a previous visit that did not use the high-anonymity proxy server.


You can detect it with the Firefox resource bundle. You just have to be aware of JavaScript programming.

The resource:// URI scheme is used by Firefox to call on-disk resources from internal modules and extensions.

But some of these resources may also be included to any web page and executed via a script tag. Mozilla developers is not considering the resources as a fingerprinting vector, despite the fact that some of them can reveal things that the user does not wish to reveal. For example, differences in built-in preferences files clearly indicates if you are using Windows, Linux or Mac, even if you're behind Tor.

Try this URL in the Tor browser: https://www.browserleaks.com/firefox

  • Although this was correct, resource:// is no longer exposed in Tor browser.
    – forest
    Commented Jul 5, 2018 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .