{
  "schemaVersion": 1,
  "name": "TrueProxies Proxy Checker Methodology",
  "methodVersion": "2026.07.18",
  "lastReviewed": "2026-07-18",
  "canonicalTool": "https://trueproxies.com/tools/proxy-checker/",
  "maintainer": {
    "name": "Aseel Ashraf",
    "role": "TrueProxies tool maintainer",
    "organization": "TrueProxies",
    "url": "https://trueproxies.com/blog/authors/aseel-ashraf/",
    "independentReviewClaimed": false
  },
  "scope": {
    "purpose": "Server-side point-in-time testing of supported public proxy endpoints against a fixed exit-IP service and, when selected, one curated public target.",
    "maximumEntriesPerRun": 1000,
    "requiresJavaScript": true,
    "requiresHumanVerificationInProduction": true,
    "privateOrReservedProxyAddressesAllowed": false,
    "arbitraryTargetUrlsAllowed": false
  },
  "protocols": [
    {
      "id": "HTTP",
      "inputScheme": "http://",
      "checkerToProxyTransport": "Plain TCP using HTTP proxy semantics; HTTPS destinations use CONNECT.",
      "targetDns": "The fixed target authority is carried by the HTTP proxy request. The checker does not expose or certify the proxy operator's resolver implementation."
    },
    {
      "id": "HTTPS",
      "inputScheme": "https://",
      "checkerToProxyTransport": "TLS to the proxy with hostname verification and SNI, followed by HTTP proxy semantics and CONNECT for HTTPS destinations.",
      "targetDns": "The fixed target authority is carried inside the HTTPS proxy exchange. The checker does not expose or certify the proxy operator's resolver implementation."
    },
    {
      "id": "SOCKS5",
      "inputScheme": "socks5://",
      "checkerToProxyTransport": "SOCKS5 TCP negotiation with username/password authentication when supplied.",
      "targetDns": "The checker resolves the fixed target hostname before requesting the SOCKS5 connection."
    },
    {
      "id": "SOCKS5H",
      "inputScheme": "socks5h://",
      "checkerToProxyTransport": "SOCKS5 TCP negotiation with username/password authentication when supplied.",
      "targetDns": "The fixed target hostname is sent to the SOCKS5 proxy for proxy-side resolution."
    }
  ],
  "autoMode": {
    "maximumProtocolAttempts": 2,
    "ports1080And1081": ["SOCKS5", "HTTP"],
    "otherPorts": ["HTTP", "SOCKS5"],
    "attemptsHttpsProxyTransport": false,
    "attemptsSocks5h": false,
    "explicitSchemesArePreserved": true,
    "description": "Auto is a bounded convenience sequence, not protocol discovery. HTTPS proxy transport and proxy-side SOCKS target DNS require explicit schemes."
  },
  "providers": [
    {
      "id": "ipify",
      "url": "https://api.ipify.org/?format=json",
      "whenContacted": "Every endpoint attempt after proxy transport establishment.",
      "requestPath": "Through the submitted proxy.",
      "dataPurpose": "Return the public exit IP used by the proxied request.",
      "dataReceived": ["Proxy-routed HTTPS request", "Checker user-agent", "Network metadata ordinarily visible to the destination"]
    },
    {
      "id": "GeoJS",
      "urlTemplate": "https://get.geojs.io/v1/ip/geo/{exitIp}.json",
      "whenContacted": "After a valid public exit IP is observed.",
      "requestPath": "Directly from the checker service, not through the submitted proxy.",
      "dataPurpose": "Best-effort country, city, and network enrichment for the observed exit IP.",
      "dataReceived": ["Observed exit IP"],
      "credentialsReceived": false
    },
    {
      "id": "Google",
      "url": "https://www.google.com/generate_204",
      "whenContacted": "Only when the user selects Google as the target.",
      "requestPath": "Through the submitted proxy.",
      "dataPurpose": "Return initial response headers for a lightweight target-reachability observation.",
      "responseBodyDownloaded": false
    },
    {
      "id": "Wikipedia",
      "url": "https://www.wikipedia.org/",
      "whenContacted": "Only when the user selects Wikipedia as the target.",
      "requestPath": "Through the submitted proxy.",
      "dataPurpose": "Return initial response headers for a target-reachability observation.",
      "responseBodyDownloaded": false
    }
  ],
  "timeouts": {
    "proxiedRequestAttemptMilliseconds": 8000,
    "appliesSeparatelyTo": ["Exit-IP request attempt", "Selected-target request attempt"],
    "wholeEndpointDeadline": false,
    "wholeBatchDeadline": false,
    "geolocationLookupMilliseconds": 4000,
    "geolocationResponseMaximumBytes": 32768,
    "proxyHostnameResolutionMilliseconds": 8000,
    "proxyHostnameResolution": "Performed before the proxied request timer with its own eight-second checker-side deadline. Its duration is not included in the displayed proxied response time.",
    "autoQualification": "A qualifying first-mode failure may be followed by one attempt with the other bounded Auto transport, so total endpoint duration can exceed eight seconds."
  },
  "latency": {
    "exitResponseMilliseconds": {
      "start": "Immediately before opening the request through the resolved proxy endpoint.",
      "end": "After the complete small IPify response body is received and its public IP value is validated.",
      "includes": ["Proxy connection", "Applicable TLS to the proxy", "CONNECT or SOCKS negotiation", "HTTPS request", "Small response-body receipt"],
      "excludes": ["Queue wait", "Proxy-host DNS resolution", "GeoJS lookup", "Selected-target request", "Browser rendering", "Throughput testing"]
    },
    "targetResponseMilliseconds": {
      "start": "Immediately before opening the selected target request through the already selected proxy transport.",
      "end": "When the selected target's initial response headers arrive.",
      "includes": ["Proxy connection for the target request", "Applicable TLS and proxy negotiation", "Time to initial HTTP response headers"],
      "excludes": ["Target response body", "Redirect following", "JavaScript", "Cookies or account state", "Browser rendering", "Throughput testing"]
    },
    "throughputMeasured": false,
    "visitorDeviceLatencyMeasured": false
  },
  "targetReachability": {
    "curatedTargets": ["Google", "Wikipedia"],
    "acceptedInitialStatusRange": {
      "minimum": 200,
      "maximum": 399
    },
    "notAcceptedInitialStatusRange": {
      "minimum": 400,
      "maximum": 599
    },
    "responseBodyDownloaded": false,
    "redirectsFollowed": false,
    "wordingBoundary": "A 4xx or 5xx target response is reported as not accepted for this request. It is not described as proof that the exit IP was blocked."
  },
  "publicErrorCodes": [
    "INVALID_FORMAT",
    "PRIVATE_ADDRESS",
    "DNS_FAILED",
    "AUTH_REQUIRED",
    "CONNECT_REFUSED",
    "NETWORK_UNREACHABLE",
    "TLS_FAILED",
    "TARGET_DNS_FAILED",
    "TARGET_CONNECT_FAILED",
    "TARGET_TLS_FAILED",
    "TARGET_TIMEOUT",
    "TARGET_FAILED",
    "TARGET_NOT_ACCEPTED",
    "TIMEOUT",
    "BAD_RESPONSE",
    "CANCELLED",
    "UNKNOWN"
  ],
  "dataHandling": {
    "submittedProxyLines": "Sent over HTTPS to an isolated checker service, retained only in the expiring in-memory job queue, and removed after processing or cancellation.",
    "credentials": "Used only to open the requested proxy connection. Excluded from displayed labels, normal result payloads, aggregate share links, application logs, analytics, and machine-readable methodology.",
    "jobCapability": "Kept in the submitting page's memory and, when browser session storage is available, stored there so the same tab can reconnect after a refresh. Excluded from exports, analytics, and aggregate shares.",
    "exitIpAndLocation": "Returned to the requesting browser as result evidence. They are excluded from analytics and aggregate share links.",
    "csvExport": "Created locally with masked endpoint labels and spreadsheet-formula neutralization.",
    "jsonExport": "Created locally from an explicit versioned result projection without credentials, raw submitted lines, job IDs, or job capabilities.",
    "copyWorking": "An explicit local action may copy the original working lines, including credentials. The interface discloses that behavior before use.",
    "analytics": "Only consent-gated allowlisted event names and coarse buckets may be emitted. Proxy lines, hosts, ports, credentials, exit IPs, locations, messages, job IDs, and capabilities are prohibited."
  },
  "limitations": [
    "This is a server-side point-in-time connectivity diagnostic, not an anonymity, privacy, reputation, uptime, or future-availability certificate.",
    "The checker does not measure bandwidth, sustained throughput, upload speed, download speed, concurrent capacity, or cost per successful byte.",
    "SOCKS testing covers TCP only. UDP ASSOCIATE, UDP applications, BIND, and provider-specific authentication extensions are outside scope.",
    "Target evidence comes from one lightweight server request. It does not reproduce browser fingerprints, JavaScript, cookies, CAPTCHA handling, accounts, application state, or every destination URL.",
    "GeoJS data is third-party best-effort enrichment and may be missing, stale, approximate, or inconsistent with provider labels.",
    "Auto is intentionally bounded and does not try HTTPS proxy transport or SOCKS5H. Use the provider's explicit scheme for those modes.",
    "Results originate from the checker service's network location; a visitor, another region, another resolver, or another client can observe different timing and reachability.",
    "This methodology is maintained by TrueProxies and is not represented as an independent audit or third-party certification.",
    "No benchmark, provider ranking, success rate, or performance comparison is implied by this methodology contract."
  ]
}