PROXYRADAR DEVELOPER GUIDES
How to Block Proxy & VPN Traffic Without Blanket Bans
To handle proxy and VPN traffic, classify the public IP on your backend and apply a policy for the specific action being attempted. A positive IP result can trigger verification, a rate limit or a review; it does not have to become a site-wide ban.
Start with the action, not just the IP label
Consider what is at risk in the current request. Reading a public help page is different from creating many accounts, claiming a limited promotion or changing an account’s security settings. Choose a response proportionate to the action and to the other signals available in your application.
VPNs have legitimate uses, including privacy and access to business networks. Hosting addresses can belong to payment callbacks, monitoring services, crawlers and other applications. Blocking them all can disrupt useful traffic as well as unwanted traffic.
A practical policy table
The following table is a starting point for designing your own rules, not a claim that an IP category determines a visitor’s intent.
| Situation | Possible response | Reason |
|---|---|---|
| Ordinary public browsing with a proxy signal | Allow, while applying your normal abuse controls. | The network label alone may not justify interrupting the visit. |
| Repeated signups plus a positive proxy result | Rate limit or request additional verification. | The classification adds context to behavior already observed. |
| Known customer signing in through a VPN | Use account-aware verification if needed. | A changed network can be legitimate. |
| Hosting traffic on a machine-to-machine route | Verify the request’s credentials or signature. | Network type does not replace endpoint authentication. |
| Tor traffic on a sensitive action | Apply your published policy, with an alternative route where appropriate. | The action and your application requirements determine the response. |
| Lookup unavailable | Use an explicit unknown-state policy. | An error is neither a positive nor a negative classification. |
Keep the overall flag and categories separate
In ProxyRadar, proxy: 1 is a broad classification that includes hosting. It can also be positive without a more specific category. If your policy concerns all positive results, evaluate the overall flag. If your policy is specifically about VPN or Tor, read the relevant category and recognize that a false or unavailable category is not proof that the connection is clean.
Likewise, known_bot describes a supported crawler network. It is not a universal bot verdict, and you should not use it to bypass authentication or grant access to private data.
Make failure behavior part of the policy
Your integration should return three application states: positive, negative and unknown. Invalid API credentials, quota limits, timeouts and service errors belong in the unknown path. Do not silently translate them into proxy: 0.
For a low-risk action, you may choose to continue with other controls when the classification is unavailable. For a more sensitive action, you may request verification or ask the user to retry. Document that choice in your application so an API outage does not accidentally change your access policy.
Roll out in four steps
- Observe: add the lookup at a defined point and record the application decision without changing access yet.
- Review: investigate positive results and compare them with your own abuse reports. Include legitimate business and hosting connections.
- Apply: enable one rule at a time. Prefer a reversible response before a permanent account restriction.
- Revisit: track false-positive reports, unknown results and successful appeals. Update the policy when your traffic or product changes.
Keep a useful decision record
Record the time, relevant category, action attempted and the policy rule that was applied. Store only what you need for your operational purpose, and avoid logging API credentials. If a customer reports an incorrect restriction, this record helps you distinguish a detection result from an application-rule mistake.
Use the browser checker for an individual investigation. For production integration, follow the API reference and the Python, Node.js and PHP examples.
Put the guide into practice.
Check an IP in your browser or start with 1,000 free API queries per day.