Free web proxies ranked by what their homepages actually send (HSTS, CSP, cookies, third-party scripts) and what their privacy policies say they keep, measured October 2026.
We ranked six web proxies on what you can check yourself: the security headers and cookies their homepages sent when we measured them in October 2026, and how specifically their written policies say what is logged and for how long. TrickyBird ranks first on both. AnyProxy is second: strong headers but no Content-Security-Policy, ad scripts on the free tier, and a policy that does not promise a deletion window. KProxy is last because its certificate was for another domain.
Context
How we ranked: a web proxy sees everything you open through it, so "safe" means two things you can verify before trusting one. First, the homepage measurement (5 Oct 2026; TrickyBird 12 Oct): HTTPS enforcement (HSTS), cookies set before you click anything, Referrer-Policy, X-Frame-Options, Content-Security-Policy, and third-party script hosts. Second, how precisely the operator's own policy describes logging and retention. We did not audit anyone's servers; nobody outside an operator can. AnyProxy publishes this list and ranks itself in it, so treat our placement with suspicion. That is why every ranking below points to a dated test or measurement, including the tests AnyProxy lost. On this list we are not first.
Quick picks
Full breakdown
Its security page lists the access-log fields (shortened IP, hostname of each request, status, bytes, timing) and a 48-hour limit, and says page paths and cookies are not logged. Homepage: HSTS with preload, strict CSP, X-Frame-Options DENY, no cookies on landing, only Google Tag Manager and Cloudflare scripts. Its FAQ says WebRTC is not handled, so a page using it can see your real IP.
Homepage: HSTS two years with preload, no cookies on landing, Referrer-Policy same-origin, X-Frame-Options SAMEORIGIN, TLS 1.3. Weak points: no Content-Security-Policy, and the free tier loads Google ad and Monetag ad scripts. Its privacy policy says it can record destination hosts, session IDs and a hashed IP, and does not promise deletion after a fixed period.
States a concrete retention period (logs for law-enforcement requests kept 60 days), which is more specific than AnyProxy's policy. Homepage: HSTS one year, no cookies on landing, X-Frame-Options, but a CSP that allows unsafe-inline and unsafe-eval and a permissive Referrer-Policy; TLS 1.2.
Strongest HTTPS among competitors (HSTS with preload, TLS 1.3) and only Google scripts as third parties, but one cookie on landing and no Referrer-Policy, X-Frame-Options or CSP. Per-session switches to strip scripts and block cookies are a real privacy plus.
Sends two conflicting HSTS headers, and browsers obey the first, max-age=0, which turns HTTPS enforcement off. Two cookies on landing; seven third-party script hosts including ad and user-report services. It does send a CSP. BlockAway measured identically.
On 5 Oct 2026 www.kproxy.com presented a certificate issued for *.yanacyber.fr, so browsers warn "Your connection is not private". Do not click through that warning to use a proxy.
FAQ
You’re a regular
You’ve used AnyProxy on {d} different days. Pro makes it faster, cleaner and keeps it free for others.
$39 a year · just $3.25 a month
Cancel anytime. Every Pro plan helps keep AnyProxy free for people who can’t pay.
Back again
One tap from your phone, no app store, no account. It is the same site in its own window.
Three taps in Safari
Pro sign-in is separate inside the installed app on iPhone.
Back again
One click on the toolbar opens the site you are on through AnyProxy. Free, from the Chrome Web Store.
Only storage, context menu and active tab permissions. No traffic is read outside the click.
Allow AnyProxy notifications?
We send a few sponsored notifications a week. They help keep AnyProxy free. Turn them off anytime in your browser.