HTTP vs HTTPS Proxies Explained
An HTTPS proxy does not mean what most people assume. This explains CONNECT tunnelling, when a proxy can read your traffic, and how to check what yours does.
- proxy-basics
- security
- networking
The phrase "HTTPS proxy" causes more confusion than almost any other bit of proxy terminology. It sounds like it means the proxy encrypts your traffic or that your traffic is protected from the proxy. Usually it means neither.
Here is what is actually going on.
Two separate things
There are two distinct questions, and people merge them.
- Does the proxy support tunnelling HTTPS traffic? This is about whether your browser or script can reach HTTPS sites through the proxy.
- Can the proxy read the content of that traffic? This is about whether TLS is end-to-end between you and the destination.
A proxy can support HTTPS tunnelling while remaining unable to read anything, and that is the normal case.
How CONNECT works
For HTTPS through an HTTP proxy, the client does not send the request itself. It sends a CONNECT host:443 line to the proxy and asks for a raw tunnel. If the proxy allows it, the client and the destination negotiate TLS through that tunnel, and the proxy just relays bytes.
Because TLS keys are established between your client and the origin server, the proxy sees only encrypted data and metadata such as the destination hostname and the volume of traffic. It cannot read the page, the credentials or the response body.
So when a provider advertises HTTPS support, the useful reading is: "this proxy will open a tunnel to port 443." That is a capability statement, not a security guarantee.
When a proxy can read your traffic
There are cases where a proxy can see plaintext, and they are worth knowing about.
- Plain HTTP requests. No TLS, so everything is visible to the proxy.
- A decrypting proxy. If you installed a custom root certificate so the proxy could perform TLS interception, it can read and modify traffic. This is common in corporate environments and is exactly why you should never install a root certificate for a proxy you do not control.
- A malicious proxy. An open or untrusted proxy can inject scripts, alter responses, or capture form posts on plain HTTP. This is one of the main reasons to avoid free proxy lists, which we cover in What Is an Open Proxy.
If you are not doing TLS interception and the traffic is HTTPS, a normal proxy is a relay.
SOCKS5 as an alternative
SOCKS5 takes the tunnelling idea further. It operates below HTTP and carries any TCP connection, so there is no need for a special CONNECT exchange and no assumption that the payload is web traffic. For HTTPS the end-to-end TLS property is the same: the proxy relays encrypted bytes.
The practical difference is compatibility. HTTP proxies slot into web tooling and browser settings with no extra work, while SOCKS5 handles non-HTTP protocols and avoids some HTTP-level quirks. We compare them in SOCKS5 vs HTTP Proxies.
What "HTTPS proxy" should mean to a buyer
When you are evaluating a provider, translate the claim into the two questions above:
- Will it tunnel to port 443? Almost every reputable provider does.
- Is TLS still end-to-end between me and the destination? It should be. Look for no certificate warnings and no requirement to install a root certificate.
If a provider ever asks you to install a certificate to use their proxy, treat it as a red flag unless you have a clear reason to trust them with decrypted traffic.
Verifying the setup
Two checks catch most problems. First, a certificate warning when browsing through the proxy means something is intercepting TLS. Second, confirm the exit IP is what you expect, because a misconfigured tunnel can leak your real address. The LightningBytes proxy checker reports the exit IP and added latency, and the WebRTC leak test catches browser-level leaks separately.
LightningBytes proxies support HTTP and SOCKS5, with HTTPS reached through CONNECT tunnelling as described above. Details are on the residential page, and the FAQ covers common connection questions.