The Web Proxy Autodiscovery Protocol

WPAD certainly isn't new technology. In fact, it's been around for many years. However, it seems that many system administrators are unaware of its magic. Simply put, WPAD allows you to offer proxy information to users in your network without ever touching their computers. The feature is supported by most browsers, and in general, it "just works".

Although proxy information can be sent over DHCP, unfortunately, not all clients honor those settings. For maximum compatibility, it's best to have a local DNS record that points the domain "wpad" to a Web server. You put a configuration file named wpad.dat in the root level of that Web server, and clients get proxy information automatically, assuming they're configured to do so. (Most are by default; this is what your browser refers to as automatically detecting proxy settings.)

Here's a simple wpad.dat file:

function FindProxyForURL(url, host)
   if (isPlainHostName(host) ||
       dnsDomainIs(host, "") ||
       (host=="") )
       return "DIRECT";
       return "PROXY my.proxy.server.address:8080";


For more detailed information on how to configure your custom wpad.dat file, check out

And, for more information on the Web Proxy Autodiscovery Protocol itself, see




Comment viewing options


security risk

Jostein's picture

WPAD is a security risk!
On a windows (AD) network it is a risk not to implement it. Or not add a dns entry called wpad.

If ordinary users are allowed to add computers to AD, it is possible to add a computer with the name wpad. Then it would get a entry in dns pointing to that computer. If the user of that computer sets up a hack proxy, he can monitor all web access (even https), without users noticing anything... Man-in-the-middle-attack!

Windows also have (or had, don't know if it is fixed) the flaw that if it didn't find address it would try

security of wpad implementation really depends on the admin

Anonymous's picture

While that may be true, the question becomes this: why are ordinary users allowed to add computers to AD? If you have a compromised sys admin account, that's a totally different thing. Btw, the only reason why this (what you mentioned) would work is because the AD implementation is so open: not only are ordinary users able to add hosts, but the name resolution (dns/netbios) is also foobared. For example, dynamic DNS of whatever DNS service you run is enabled (it is enabled by default on Windows DNS). Any formidable admin can fix name resolution issues, as well as ordinary users being able to add to AD - though these issues are separate and you can fix them independently of each other (one should think that adding stuff to AD is related to name resolution, but not the same topic).

And, on those last few lines, I personally don't think that's a flaw: thats how you implement department/sub-domain proxies too.

If one allows name resolution incorrectly, then that stuff you mentioned can happen. Then again, it really depends how you designed your infra.

Advanced playground

speedj's picture

Only a few gotcha's:

For maximunm compatibility you should provide that the url
is active and has to be a "application/x-ns-proxy-autoconfig" mime-type.

You can achieve some redundancy using:
It means that if does not respond (not squid itself, but it seams to be wether or not the proxy host responds to icmp pings - for most implementations), use it. If not use, else go directly to the destination.

beware of pitfalls with

Anonymous's picture

beware of pitfalls with regards to IPv6 implementations on different systems and browsers. ie: firefox might return the 128bit ip6-address from myIpAddress()

Personally agree with this.

Jay Yaneza's picture

Personally agree with this. WPAD method for proxy implementation is great. Ever tried to work with Linux GW implementation + SQUID + Windows Desktops? It's a headache when you need to tell the Windows Update clients to go through proxies if all other connections need to GW is blocked with exception of the proxy IP address. With WPAD, this is seamless ... and the updates are faster since they're cached by SQUID!