A loopback address is a special IP address that always points back to the same device. The best-known example is 127.0.0.1 on IPv4, often paired with the hostname localhost. Traffic sent to a loopback address never leaves the machine, so it is used for local services, testing, and internal control channels.
In cyber security, loopback addresses matter because they define what should stay local and what can be routed elsewhere. Proxy rules often exclude loopback so browser traffic to local admin tools or development services is not sent through an external relay. Attackers may try to abuse misconfigured loopback handling to reach local interfaces, while defenders use it to safely bind services only to the host. In proxy-abuse cases, excluding only loopback means nearly all other web traffic can still be intercepted.