How WPAD works
When automatic proxy detection is enabled, a compatible client looks for a Proxy Auto-Configuration (PAC) file. Depending on the client and network, it may obtain the file URL from DHCP option 252 or use DNS to resolve a wpad hostname in the local domain.
Client → DHCP option 252 or DNS "wpad" → PAC file
PAC rule → PROXY proxy.example.com:8080
→ DIRECTThe client downloads the PAC file and calls its FindProxyForURL function for each destination. The result can name a forward proxy, provide several fallback proxies or say DIRECT to bypass the proxy. If a proxy is selected, the website sees that proxy’s IP address rather than the client’s public IP.
WPAD vs PAC and transparent proxies
WPAD finds configuration. The PAC file contains the actual routing rules.
| Method | How configuration is found | Client behavior |
|---|---|---|
| WPAD | DHCP or DNS discovery | Evaluates the discovered PAC file |
| Manual PAC | Administrator supplies a URL | Evaluates the specified PAC file |
| Transparent proxy | No PAC file required | Traffic is intercepted by the network |
A transparent proxy can process eligible traffic without the application knowing its address. WPAD requires support from the operating system, browser or application.
Why WPAD matters for proxy users
- Rules may bypass the proxy. A PAC file can send intranet traffic directly while routing public websites through a proxy.
- Application support varies. Some programs follow system proxy settings while others require an explicit host and port.
- Authentication may still be required. WPAD discovers settings but doesn’t necessarily provide proxy authentication credentials. Missing credentials can produce a 407 error.
- Explicit settings can take precedence. The order between manual settings, PAC URLs and WPAD depends on the client.
Using WPAD safely
Only enable WPAD on networks whose DHCP and DNS infrastructure you trust. An attacker who controls discovery can supply a PAC file that routes traffic through an unwanted proxy.
Administrators should control registration of the wpad hostname, restrict changes to DHCP settings and review PAC rules. Traditional DNS-based WPAD often retrieves wpad.dat over HTTP, so local network security matters. Disable automatic detection on devices that don’t need it, especially when they regularly join unmanaged networks.
FAQ
Is WPAD the same as a PAC file?
No. WPAD is the discovery method, while a PAC file contains the rules that select a proxy or direct connection for each URL.
Should I disable WPAD?
It depends. Disable it if your network doesn’t intentionally provide automatic proxy settings. A managed workplace network may require it, so check with the administrator first.
Can WPAD decrypt HTTPS traffic?
No, not by itself. WPAD can direct HTTPS connections through a proxy, but decrypting their contents requires a separately configured interception proxy and a certificate trusted by the device.