Wget Proxy: How to Use Wget With a Proxy (Env Vars, .wgetrc, Auth and SOCKS)

Command-line guide · Last reviewed 1 October 2026 · 14 min read

A wget proxy setup comes down to one of three places: the http_proxy and https_proxy environment variables, a few lines in .wgetrc, or -e commands on the command line. This guide shows each one with working commands, how to pass a username and password with --proxy-user and --proxy-password, how to skip the proxy for some hosts, what to do about SOCKS (GNU Wget doesn’t support it), and how to run recursive downloads through rotating residential proxies or a sticky session. Every option is checked against the GNU Wget manual.

How Wget picks a proxy for each URL

Wget is a non-interactive downloader for HTTP, HTTPS and FTP. Its manual says it supports proxy servers, which can lighten network load, speed up retrieval and give access from behind firewalls. There is no single “proxy” switch that takes an address. Instead, Wget looks for a proxy URL that matches the scheme of each URL it is about to fetch.

For every URL, Wget first checks whether proxies are turned off (--no-proxy or use_proxy = off) and whether the host is listed in no_proxy. If neither applies, it takes the proxy for that scheme: https_proxy for https:// URLs, http_proxy for http:// URLs and ftp_proxy for ftp://. A value set in .wgetrc or with -e wins over the environment variable of the same name.

wget https://example.com/file.zip
  |
  |-- --no-proxy, or use_proxy = off?     -> connect directly
  |-- host listed in no_proxy?            -> connect directly
  |-- https:// URL -> https_proxy  (.wgetrc / -e first, then environment)
  |-- http://  URL -> http_proxy
  |-- ftp://   URL -> ftp_proxy
  v
proxy  http://v2.proxyempire.io:5000/
  |   http://  URL: sends the request for the full URL to the proxy
  |   https:// URL: CONNECT example.com:443, then TLS end to end
  v
example.com  -->  sees the proxy's exit IP, not yours

Two details catch most people out. First, the proxy URL itself starts with http:// even in https_proxy. Wget speaks plain HTTP to the proxy and, for an HTTPS site, asks it to open a tunnel with the CONNECT method, so the page is still encrypted end to end between Wget and the site. Second, Wget reads the lowercase variable names. HTTPS_PROXY in capitals is not what it looks for on Linux and macOS.

Set a Wget proxy with environment variables

The manual calls environment variables the standard way to tell Wget where the proxy is. They also work for many other command-line tools, which is why most people start here. Set https_proxy as well as http_proxy, because most downloads today are HTTPS and Wget won’t fall back from one to the other.

# for this shell session
export http_proxy="http://USERNAME:PASSWORD@v2.proxyempire.io:5000/"
export https_proxy="http://USERNAME:PASSWORD@v2.proxyempire.io:5000/"
export no_proxy="localhost,.internal.example.com"

wget https://example.com/file.zip

# for one command only
https_proxy="http://USERNAME:PASSWORD@v2.proxyempire.io:5000/" wget https://example.com/file.zip

# remove them again
unset http_proxy https_proxy no_proxy

• http_proxy and https_proxy hold the URLs of the proxies for HTTP and HTTPS connections. It is fine, and common, to point both at the same proxy.
• ftp_proxy is the proxy for ftp:// URLs. The manual notes it is often set to the same URL as http_proxy.
• no_proxy is a comma-separated list of domain suffixes that should not use the proxy. The manual’s example is .mit.edu, which sends every host under mit.edu direct.

To make the setting permanent for your user, add the export lines to ~/.bashrc or ~/.zshrc. If you only want it for Wget, and not for every other tool that reads the same variables, use .wgetrc instead, covered below.

On Windows, Wget reads the same variables. Set them with set in Command Prompt or $env: in PowerShell, and in PowerShell run wget.exe, not wget. Microsoft’s documentation lists wget as a built-in alias for Invoke-WebRequest in Windows PowerShell 5.1, so typing wget there runs a different program that doesn’t understand any of Wget’s options.

:: Command Prompt
set https_proxy=http://USERNAME:PASSWORD@v2.proxyempire.io:5000/
wget https://example.com/file.zip

# PowerShell: call wget.exe, not the wget alias
$env:https_proxy = "http://USERNAME:PASSWORD@v2.proxyempire.io:5000/"
wget.exe https://example.com/file.zip

Use a proxy on the Wget command line

When you want a proxy for one command without touching the environment, use -e (long form --execute). The manual says it runs a command as if it were part of .wgetrc, after the file has been read, so it takes precedence over whatever the file says. Use one -e per setting.

wget -e use_proxy=on \
     -e https_proxy=http://v2.proxyempire.io:5000/ \
     -e http_proxy=http://v2.proxyempire.io:5000/ \
     --proxy-user=USERNAME --proxy-password=PASSWORD \
     https://example.com/file.zip

You will often see this written as wget -e use_proxy=yes -e http_proxy=host:port URL. It works, with two caveats worth knowing:

• use_proxy is already on by default. The sample wgetrc in the manual lists use_proxy = on as the default value. You only need -e use_proxy=on if a system or user wgetrc has turned it off. The manual documents on/off and 1/0; Wget’s source also accepts yes and no.
• -e http_proxy alone does nothing for an HTTPS URL. An https:// download reads https_proxy. Setting only http_proxy and downloading from an HTTPS site sends the request straight from your own IP, which is the most common “wget ignores my proxy” report. Set both.

If you leave out http:// in the proxy value, Wget adds it for you, but writing it keeps the command clear. Don’t write https:// or socks5:// in front of the proxy address; see common errors for what Wget says when you do.

Wget proxy username and password

Most paid proxies, ProxyEmpire’s included, need a username and password. The GNU Wget manual gives two ways to send them, and notes that for proxies only the Basic authentication scheme is implemented:

1. In the proxy URL: put USERNAME:PASSWORD@ in front of the host, the pattern shown in Figure 2. Wget decodes percent-encoding in this part of the URL, so a password containing @ or : must be written as %40 or %3A.
2. With options: --proxy-user=USERNAME --proxy-password=PASSWORD on the command line, or proxy_user and proxy_password in .wgetrc. No encoding is needed, which makes this the easier choice for passwords with special characters.

If you give both, Wget’s source uses the options instead of the URL, but only when both the user and the password options are set. Supplying just --proxy-user quietly falls back to whatever is in the URL. For HTTPS downloads, Wget sends the credentials on the CONNECT request that opens the tunnel, so the website itself never receives them.

Think about who can see the password. The manual warns that a password on the command line, in an option or inside a URL, is visible to anyone on the system who runs ps, and it also ends up in your shell history. On a shared server, put the credentials in ~/.wgetrc and make the file readable only by you. If the proxy still answers with 407, our guide to fixing 407 Proxy Authentication Required walks through the causes.

Wget proxy settings in .wgetrc and /etc/wgetrc

The startup file keeps proxy settings out of your commands. According to the manual, Wget first reads a global file, /usr/local/etc/wgetrc by default, or the same path under another prefix if Wget was installed elsewhere. Distribution packages usually use /etc/wgetrc; Debian’s wget package, for example, ships that file. Wget then reads the file named in the WGETRC environment variable, or $HOME/.wgetrc if that variable isn’t set. The user’s file is read last, so it overrides the global one, and -e overrides both.

# ~/.wgetrc   (protect it: chmod 600 ~/.wgetrc)
use_proxy = on
http_proxy = http://v2.proxyempire.io:5000/
https_proxy = http://v2.proxyempire.io:5000/
proxy_user = USERNAME
proxy_password = PASSWORD
no_proxy = localhost,.internal.example.com

A few rules from the manual make the file easier to work with. Command names are case-, underscore- and minus-insensitive, so https_proxy, https-proxy and httpsproxy are the same. --config=FILE reads a different startup file for one run, which is handy for keeping one file per proxy or location, and --no-config skips the startup files entirely, which is a quick way to test whether a forgotten setting in one of them is the problem.

Use the global file only when every user on the machine should go through the same proxy, such as a build server behind a corporate gateway. For personal credentials, keep them in your own ~/.wgetrc.

Skip the proxy: –no-proxy and no_proxy

• --no-proxy turns proxies off for that run, even if the *_proxy variables are set. The .wgetrc equivalent is use_proxy = off, and -e use_proxy=off does the same from the command line.
• no_proxy keeps the proxy on but lists domain suffixes that should go direct, separated by commas. It works as an environment variable or as a .wgetrc command, and the startup-file value overrides the environment.

A typical list covers local and internal hosts, for example localhost and .internal.example.com, separated by a comma. As with the other variables, Wget reads the lowercase name, no_proxy.

Does Wget support SOCKS proxies?

No. The GNU Wget manual (version 1.25.0 at the time of writing) says Wget supports proxies for HTTP and FTP retrievals and documents only the http_proxy, https_proxy and ftp_proxy settings, all of which take an HTTP proxy URL. The word SOCKS does not appear anywhere in it. If you write socks5:// into one of those settings, Wget stops with an “Unsupported scheme” error. The Wget2 manual doesn’t document SOCKS either.

You have three practical options:

1. Use the provider’s HTTP endpoint. Many providers accept HTTP and SOCKS5 on the same gateway. ProxyEmpire does: v2.proxyempire.io:5000 takes HTTP, HTTPS and SOCKS5 with the same username and password, so Wget can simply use it as an HTTP proxy. Our SOCKS vs HTTP proxy guide explains when the difference matters.
2. Wrap Wget with proxychains-ng. Its documentation says it hooks the network functions of dynamically linked programs and sends their connections through SOCKS4a, SOCKS5 or HTTP proxies. Add the proxy to proxychains.conf and run proxychains4 wget URL. Its sample config expects numeric IPv4 addresses in the proxy list, so resolve a hostname first. Our proxy chaining guide covers the config file in detail.
3. Use curl for that download. curl supports SOCKS directly: give -x a proxy URL that starts with socks5h://, which lets the proxy resolve the hostname, as in Figure 6. Add -O to save the file under its remote name. See cURL with a proxy for the full set of options.

# proxychains-ng: /etc/proxychains.conf (or ~/.proxychains/proxychains.conf)
strict_chain
proxy_dns
[ProxyList]
socks5  203.0.113.10  1080  USERNAME  PASSWORD

proxychains4 wget https://example.com/file.zip

# curl over SOCKS5, remote DNS, save with the remote file name
curl -x socks5h://USERNAME:PASSWORD@v2.proxyempire.io:5000 -O https://example.com/file.zip

Test the exit IP through the proxy

Before a long download or a recursive job, check which IP address the outside world sees. Fetch a service that echoes your address, once with the proxy and once without:

# through the proxy (settings from the environment or .wgetrc)
wget -qO- https://api.ipify.org; echo

# direct, for comparison
wget --no-proxy -qO- https://api.ipify.org; echo

# show response headers and Wget's own messages
wget -S -O /dev/null https://example.com/

-q turns off Wget’s progress output and -O - (written here as -qO-) prints the downloaded document to standard output instead of saving it. If the two commands print the same address, the proxy isn’t being used. The usual reasons are that only http_proxy is set for an HTTPS URL, the variable is in capitals, or a .wgetrc contains use_proxy = off.

Without -q, Wget prints “Proxy request sent, awaiting response…” instead of “HTTP request sent” when a request goes through a proxy. -S prints the headers the server sent, and -d gives full debug output if your build was compiled with debug support. In scripts, check the exit status; the manual defines these codes:

Recursive downloads through a rotating or sticky gateway

With ProxyEmpire, the host and port never change: v2.proxyempire.io, port 5000, for rotating residential and mobile proxies. Location and session live in the proxy username, which you copy from the Connection Builder in the dashboard’s Proxy Manager. You choose rotating (a new IP on every request), sticky (the same IP until you rotate it or the device behind it goes offline) or custom rotation (a new IP on a timer you set, up to two hours). With Wget, that just means a different --proxy-user value.

# many independent public files: rotating username, one file per connection
wget -r -l 2 -np -w 1 --random-wait --no-http-keep-alive \
     -e https_proxy=http://v2.proxyempire.io:5000/ \
     --proxy-user=ROTATING_USERNAME --proxy-password=PASSWORD \
     https://example.com/reports/

# a site that sets cookies or ties a session to one IP: sticky username
wget -r -l 2 -np -w 1 \
     -e https_proxy=http://v2.proxyempire.io:5000/ \
     --proxy-user=STICKY_SESSION_USERNAME --proxy-password=PASSWORD \
     https://example.com/reports/

The options are all from the manual. -r turns on recursive retrieval, with a default maximum depth of 5; -l 2 limits it to two levels. -np (--no-parent) stops Wget climbing above the starting directory. -w 1 waits one second between retrievals, and --random-wait varies that wait between 0.5 and 1.5 times the value. While recursing, Wget respects the site’s robots.txt.

Why --no-http-keep-alive on the rotating run? The manual explains that Wget normally keeps one TCP connection open and fetches several documents from the same server over it. For an HTTPS site that connection is a CONNECT tunnel, and RFC 9110 describes a tunnel as a blind relay of bytes. The proxy can’t change the exit IP in the middle of it, so every file sent down that tunnel shares one IP. Turning keep-alive off makes Wget open a new connection, and a new tunnel, for each file, so a rotating username can give each file its own IP. It costs one extra connection setup per file.

Our guide to sticky vs rotating proxies goes deeper into picking a session type. Whichever you choose, keep a sensible -w and -l: a recursive Wget job can fetch far more than you expect, and residential bandwidth is billed per GB.

Wget2 proxy differences

GNU Wget2 is the successor to GNU Wget, maintained by the same project. It reads the same http_proxy, https_proxy and no_proxy environment variables, but some options differ:

If a script written for Wget suddenly ignores --proxy-user, check whether wget on that machine is really Wget2 (wget --version tells you) and switch to the --http-proxy-user form.

Common Wget proxy errors and fixes

When a message doesn’t match any of these, run the same URL with --no-proxy. If it fails direct as well, the problem is the site or the URL, not the proxy. If it works direct and fails through the proxy, compare the proxy settings, one at a time, with the examples above.

Where ProxyEmpire fits

ProxyEmpire works with Wget as a standard HTTP proxy with a username and password: host v2.proxyempire.io, port 5000, no IP whitelisting to configure. The exit can be a residential IP from a pool of 30M+ or a 4G/5G mobile IP from 4M+ on our rotating mobile proxies, targeted by country, region, city, ZIP, ISP or carrier and ASN at no extra charge, rotating per request or sticky until you rotate it. Uptime is 99.9%, shown on the public status page, and support is available 24/7 from real people. Residential starts at $3.50/GB pay-as-you-go and falls to $1.50/GB, unused bandwidth rolls over, and a $1.97 trial lets you run the tests in this guide first.

Wget proxy FAQ

References

1. GNU Wget 1.25.0 Manual — Proxies, HTTP Options, Download Options, Startup File, Exit Status. gnu.org/software/wget/manual/wget.html
2. GNU Wget Manual — Proxies (section 8.1). gnu.org/software/wget/manual/html_node/Proxies.html
3. GNU Wget Manual — Wgetrc Location. gnu.org/software/wget/manual/html_node/Wgetrc-Location.html
4. GNU Wget2 — wget2 manual (docs/wget2.md). gitlab.com/gnuwget/wget2
5. proxychains-ng — README and proxychains.conf. github.com/rofl0r/proxychains-ng
6. curl — man page, -x/–proxy and SOCKS schemes. curl.se/docs/manpage.html
7. Microsoft Learn — Invoke-WebRequest (Windows PowerShell 5.1), aliases. learn.microsoft.com/powershell/module/…/invoke-webrequest
8. sudo — sudoers manual, env_reset. sudo.ws/docs/man/sudoers.man
9. IETF — RFC 9110, “HTTP Semantics”, the CONNECT method. rfc-editor.org/rfc/rfc9110