· 5 min read
How websites see your IP address
A website does not need to ask for your IP address: it arrives with the connection, because the server needs somewhere to send its reply. What matters is what else comes with it, and what a site can and cannot infer.
On this page
It arrives with the connection#
A website never has to ask for your IP address. Opening a connection means sending packets, and every packet carries a sender address, because the server needs somewhere to send its reply. By the time your browser has said hello, the server already knows the public address of whatever it is talking to. It is not a permission you gave, and no setting in your browser withholds it.
What can change is whose address that is. Without anything in between, it is yours. Behind a VPN or proxy, it is the VPN's or proxy's. And on most home networks it is your router's, shared by every device in the house: see public vs private IP addresses.
When something sits in front of the site#
Most large sites do not talk to visitors directly. A CDN, load balancer or reverse proxy accepts the connection first, and the application behind it sees the proxy's address instead of yours. To pass the original along, the proxy adds a header. The oldest and most widely used is X-Forwarded-For, which the MDN documentation describes as non-standard but universal. A standardised replacement, Forwarded, is defined in RFC 7239.
X-Forwarded-For: 203.0.113.42, 198.51.100.10
203.0.113.42 the client the first proxy saw
198.51.100.10 a proxy that forwarded the request onwardThis site's HTTP header viewer shows exactly what your browser sent and what the server added, in plain language. It is the quickest way to see the chain on a real request.
What else travels with it#
The address is one clue among many. An ordinary page request also carries:
| Signal | What it tells a site |
|---|---|
| IP address | The network, an estimated region, whether the connection looks residential or like a data centre |
User-Agent and client hints | Browser, version, operating system, device class |
Accept-Language | Your preferred languages, which sites use to guess your country |
| TLS handshake | Which protocol versions and ciphers your browser offers: a fingerprint of the software |
| Cookies | Whatever the site or its third parties set on an earlier visit |
Referer | The page you came from, unless the referrer policy trims it |
Together these are far more identifying than the address alone. Change one and the others still recognise you.
A fraud system or ad network does not rely on a single signal. It correlates all of them, which is why a browser fingerprint can single you out with no cookie at all, and why changing only your IP address does not make you anonymous.
Addresses your browser can leak
Web pages can also ask the browser for connection details through WebRTC, the technology behind in-browser calls. If it is not restricted, a page can discover the local network addresses and, on some setups, the real public address even behind a VPN. The leak test checks for this, for IPv6 leaks and for DNS leaks in one run.
What a VPN changes, and what it does not#
- Changes: the public address every website sees, and the address your ISP can associate with your browsing. The ISP still sees that you are connected to the VPN, and how much data.
- Does not change: cookies, logged-in accounts, the browser fingerprint, or anything you type into a form. It also does not change the address the VPN provider sees, so the provider has to be trusted in place of your ISP.
You can confirm a change directly: check your address on the home page with the VPN off and on, then run the VPN, proxy and Tor check on the result. If the second address is reported as a VPN or a data-centre network, that is what sites will conclude too, and some will block or challenge it.
What sites do with an address#
- Geo-targeting and geo-blocking: choose a language, a currency, a catalogue, or refuse service, from an estimated location. See how accurate that estimate is.
- Rate limiting: cap requests per address. Everyone behind one shared address shares the cap.
- Fraud and security scoring: compare today's address with previous ones and with lists of known abusive networks. The blacklist check shows what those lists say about an address.
- Analytics: many analytics tools truncate or discard the address before storing anything, others keep it. It depends on the tool and its configuration, and on the site's privacy policy.
If you build sites: reading the client address#
Read the address from the connection first. Only read a forwarded header when you know a proxy you control put it there, and take the entry that proxy appended rather than the client's. This site does the same thing: it is configured with which proxy header to trust, and uses no other. Log the address only if you need to, hash it if you can, and remember that it may count as personal data where you operate.
// Express: trust exactly one proxy hop, then read the address
app.set("trust proxy", 1);
app.get("/whoami", (req, res) => res.type("text").send(req.ip));Common questions#
Can a website see my private IP address?
No. The private address is rewritten by your router and never leaves your network. The one exception is a browser feature, WebRTC, that can be made to reveal local addresses, which modern browsers now obscure with random names.
Does incognito or private browsing hide my IP?
No. It only stops your browser from keeping history and cookies afterwards. The address is the same.
Can a site tell that I am using a VPN?
Often, yes, when the address belongs to a known VPN or hosting network. It cannot see what is inside the tunnel.
Try it on your own connection
Sources and further reading
- MDN: X-Forwarded-For — The de facto proxy header and its trust problem.
- RFC 7239: Forwarded HTTP Extension — The standardised replacement for X-Forwarded-For.
Keep reading
- FundamentalsWhat is an IP address?An IP address is the label that lets devices find each other on a network. What one looks like, who assigns it, and what it can and cannot reveal about you.
- LocationCan an IP address reveal your location?No. IP geolocation is an estimate built from registry data and inference, often correct to the country and rarely to the street. How it works and why it goes wrong.
- Addressing and routingWhat is NAT, and what is CGNAT?NAT lets a whole network share one public IP address. How the translation table works, what carrier-grade NAT changes, and why NAT is not a firewall.
- Addressing and routingPublic vs private IP addressesYour devices have a private address from your router and share one public address with the internet. The ranges, how NAT links them, and how to tell which is which.
Published by My IP Address