What it is
When traffic is forwarded through a proxy, the TCP connection your server accepts comes from the proxy, not the player — so without help every player appears to share a handful of addresses. PROXY protocol solves it by prefixing each forwarded connection with a short header containing the original source address. The receiving server reads that header before the application protocol begins.
Why it matters for Minecraft
Almost every server-side moderation tool is keyed on IP. Bans, alt-account detection, per-IP rate limits, geo plugins and anti-VPN plugins all break silently the moment every player shares an address — they do not error, they just stop being meaningful. PROXY protocol is what keeps them working once you put protection in front.
A useful side effect
Once a server requires the header, connections that arrive without one are rejected. A vanilla client hitting your raw backend IP sends ordinary Minecraft packets, fails the parse and is dropped — so enabling it also closes the bypass path around your protection. Setup is one line: see the Velocity and BungeeCord guides.
Common questions
Is PROXY protocol a paid feature?+
It depends on the provider, and it is worth checking before you commit. Arvoris includes it on every plan including the free tier; some services gate real client IPs behind paid plans, which means the free tier quietly breaks your ban list.
Do I need PROXY protocol between my proxy and my backend servers?+
No. Velocity and BungeeCord pass player information to their backends through their own forwarding. PROXY protocol is only needed on the hop where the protection service hands connections to your proxy.