How to Detect Tor Traffic on Your Site
Tor fully anonymises a visitor's origin. Learn how to detect Tor traffic by correlating against the live exit list, and how to respond without blocking legitimate users.
Tor traffic is worth identifying because it represents the strongest consumer anonymity there is — the origin is completely hidden. The good news is that Tor is one of the more detectable anonymisers, because its exit nodes are public. Here's how to detect it well.
Why Tor is detectable
Unlike a private VPN, Tor publishes the list of relays, including the exit nodes that deliver traffic to your site. If a request comes from an IP on that list, it's Tor. The catch is freshness: the list changes constantly. (For the mechanics, see what is a Tor exit node.)
Check whether an IP is a Tor exit node
How to detect it reliably
- Live exit-list correlation. Match the IP against the current Tor exit list, refreshed continuously — not a stale snapshot.
- Recent-relay history. Catch IPs that very recently served as exits.
- Reinforcing context. ASN and reputation signals back up the verdict.
The Tor exit node detection tool does the correlation for you, and the signal is included in the proxy detection API.
Responding to Tor traffic
A blanket Tor ban has real costs — journalists, activists and privacy-minded users rely on it. So tie your response to the sensitivity of the action:
| Action | Suggested handling |
|---|---|
| Browsing / reading | Allow or log |
| Account signup | Challenge / verify |
| Login | Step-up authentication |
| Payment / withdrawal | Block or manual review |
Implementation tips
- Check server-side so the result is trustworthy.
- Combine with other signals. Tor plus a brand-new account plus rapid actions is far more telling than Tor alone.
- Log even when you allow. A Tor flag is valuable context during incident investigation.
Bottom line
Detect Tor traffic by correlating visitor IPs against the live, continuously-refreshed exit list, reinforced with ASN and reputation context. Then block, challenge or log based on the action — preserving Tor's legitimate uses while protecting high-risk operations.