# Wget Proxy: -e, Env Vars, .wgetrc and Fixes

> Use wget with a proxy three ways: -e and --proxy-user, https_proxy variables or ~/.wgetrc. Real output, no_proxy rules and a fix for each wget proxy error.

[Home](https://quanticdata.io/) / [Blog](https://quanticdata.io/blog/) / Wget Proxy: -e, Env Vars, .wgetrc and Fixes

# How to use wget with a proxy: command line, environment variables and .wgetrc

Proxies · Oct 24, 2026 · 10 min read · By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData

![Three ways to give wget a proxy, in the order they override each other: the command line with -e https_proxy and --proxy-user, the ~/.wgetrc file, and the https_proxy and http_proxy environment variables, then a check of the exit with ipinfo.io; the card lists what to verify when wget fails: http:// on port 8080, the whole username and password, no socks5:// because wget has no SOCKS support.](https://quanticdata.io/blog/wget-proxy-setup/hero.webp?v=20261024h)

On this page

- [What you need before you start](https://quanticdata.io/blog/wget-proxy-setup/#what-you-need-before-you-start)
- [Three ways to set a proxy in wget, and which one wins](https://quanticdata.io/blog/wget-proxy-setup/#three-ways-to-set-a-proxy-in-wget-and-which-one-wins)
- [Residential Premium on the command line](https://quanticdata.io/blog/wget-proxy-setup/#residential-premium-on-the-command-line)
- [One sticky session per job](https://quanticdata.io/blog/wget-proxy-setup/#one-sticky-session-per-job)
- [Environment variables: a mobile line for the whole shell](https://quanticdata.io/blog/wget-proxy-setup/#environment-variables-a-mobile-line-for-the-whole-shell)
- [Choose which requests use the proxy: no_proxy and --no-proxy](https://quanticdata.io/blog/wget-proxy-setup/#choose-which-requests-use-the-proxy-no-proxy-and-no-proxy)
- [ISP proxies in ~/.wgetrc](https://quanticdata.io/blog/wget-proxy-setup/#isp-proxies-in-wgetrc)
- [Which proxy type for which wget job](https://quanticdata.io/blog/wget-proxy-setup/#which-proxy-type-for-which-wget-job)
- [Does wget support SOCKS5?](https://quanticdata.io/blog/wget-proxy-setup/#does-wget-support-socks5)
- [Wget proxy errors and fixes](https://quanticdata.io/blog/wget-proxy-setup/#wget-proxy-errors-and-fixes)
- [Before you run large downloads](https://quanticdata.io/blog/wget-proxy-setup/#before-you-run-large-downloads)

To use wget with a proxy, pass it on the command line: `wget -e https_proxy=http://HOST:8080 --proxy-user=USER --proxy-password=PASS URL`. For every command in a shell, export `https_proxy` and `http_proxy`; for every run, write the same settings in `~/.wgetrc`. Wget talks to proxies over HTTP only: no SOCKS5.

Wget is the command-line downloader that comes with most Linux desktops and installs on macOS with `brew install wget`. It reads a proxy from three places, and most "wget ignores my proxy" questions come from not knowing which one wins. Every command and every line of output below is real: we ran GNU Wget 1.21 through QuanticData on 24 October 2026, and only the IP addresses are masked. USER and PASS stand for your credentials.

## What you need before you start

- **Wget.** `wget --version` tells you if it is there. If not: `sudo apt install wget` on Debian and Ubuntu, `sudo dnf install wget` on Fedora, `brew install wget` on macOS.
- **A proxy plan.** Residential Premium, ISP or mobile: all of them work with wget over HTTP. The table further down says which one fits which job.
- **Host, port, username and password.** In the QuanticData dashboard they are under My proxies, on the plan's page: the Endpoint generator for Residential Premium and mobile, Assigned IPs for ISP. Choose the HTTP protocol: it is the one wget speaks.

**Try it on your own targets.** Every QuanticData account gets $2 of free API usage per month.

[Start free — $2/month included](https://quanticdata.io/signup/?utm_source=blog&utm_medium=website&utm_campaign=blog-inline&utm_content=wget-proxy-setup) · [Explore Residential Proxies from $0.80/GB](https://quanticdata.io/residential-proxies/)

## Three ways to set a proxy in wget, and which one wins

| Method | What you write | Lasts for | Where the password sits |
| --- | --- | --- | --- |
| Command line | `-e https_proxy=http://HOST:8080`, `--proxy-user`, `--proxy-password` | One command | In the command, visible to `ps` and in your shell history |
| Environment variables | `export https_proxy=...`, `http_proxy`, `no_proxy` | The shell session, or every session from `~/.bashrc` | Inside the proxy URL |
| `~/.wgetrc` | `use_proxy`, `https_proxy`, `http_proxy`, `proxy_user`, `proxy_password` | Every wget run by that user | In a file only you can read (`chmod 600`) |

When more than one is set, the GNU Wget manual gives the order: the startup file overrides the environment variables, and a command run with `-e` is executed after the startup file, so it overrides both. In short, command line first, then `~/.wgetrc`, then the environment. The proxy is on by default; `use_proxy = off` or `--no-proxy` turns it off.

Two details catch people out. `https_proxy` only applies to `https://` addresses and `http_proxy` only to `http://` ones, so set both if you download both. And the value is always written with `http://` in front, even in `https_proxy`: wget opens an encrypted tunnel to the site through an HTTP proxy.

## Residential Premium on the command line

![The QuanticData Endpoint generator for a Residential Premium plan: Chile selected, Session set to Sticky with a 30-minute TTL, HTTP protocol, output format http://user:pass@host:port and the preview line on residentialpremium.quantumproxies.io:8080, with the username and password blurred](https://quanticdata.io/blog/wget-proxy-setup/quanticdata-generator-chile-proxy-url.webp)

*Country, sticky session, HTTP and the proxy URL format: the values wget needs.*

1. **Generate the line.** In the QuanticData dashboard open My proxies, then your Residential Premium plan. In the Endpoint generator choose the Country (and a Region or City if you need one), set Session to Sticky, set Session TTL (minutes) to at least the length of the job, choose HTTP and set Output format to http://user:pass@host:port. Connection details shows the same values one by one.
2. **Write the command.** `-e` runs a startup-file command, so `-e https_proxy=...` sets the gateway for this command only. Put the username and password in their own options:

```bash
wget -e use_proxy=yes \
  -e https_proxy=http://residentialpremium.quantumproxies.io:8080 \
  --proxy-user="USER-country-cl-sid-wget01-ttl-60m" \
  --proxy-password="PASS" \
  -O- https://ipinfo.io/json
```

3. **Read the output.** `Connecting to residentialpremium.quantumproxies.io` and `Proxy request sent, awaiting response... 200 OK` mean the request went through the gateway and the login was accepted. The JSON from ipinfo.io is the exit: our check left from San Javier, Maule Region, Chile, time zone America/Santiago.

![A terminal running wget with -e use_proxy=yes, https_proxy=http://residentialpremium.quantumproxies.io:8080, --proxy-user USER-country-cl-sid-wget01-ttl-60m and --proxy-password PASS; the real output shows Proxy request sent, awaiting response... 200 OK and the exit in San Javier, Maule Region, Chile, America/Santiago, with four numbered steps beside it](https://quanticdata.io/blog/wget-proxy-setup/wget-proxy-command-line-residential-premium.webp)

*The real run of 24 October 2026, IPs masked. The progress bar shares the terminal with the JSON, so it draws over the closing brace.*

`-e use_proxy=yes` is only needed when a startup file turned the proxy off, but it does no harm and makes the command self-contained. The same command works with the credentials inside the URL, `-e https_proxy=http://USER-country-cl-sid-wget01-ttl-60m:PASS@residentialpremium.quantumproxies.io:8080`, which is exactly the line the generator gives. Wget sends proxy credentials with Basic authentication, the only scheme it implements for proxies.

To see only the JSON, add `-q`: `wget -qO- https://ipinfo.io/json` is the quickest way to check where any of the setups below exits.

## One sticky session per job

The username carries the targeting and the session: `-country-cl` picks the exit country, `-sid-wget01` names the session and `-ttl-60m` keeps it for 60 minutes. A recursive download or a mirror job with `-r` or `-m` makes many requests; with a sticky session they all leave from the same IP, which is what a site that sets cookies or limits per address expects.

- **One session ID per job.** Two jobs on the same `-sid-` share one IP.
- **A lifetime longer than the job.** The generator accepts up to 1440 minutes, a full day. When the session ends, the next connection gets a new IP.
- **A new IP when you want one.** Change the session ID, for example `-sid-wget02`: the next request leaves from a different address.

## Environment variables: a mobile line for the whole shell

When every wget in a terminal, or a script that calls wget many times, should use the proxy, set the variables once. The mobile generator works like the Residential Premium one: choose the gateway (Global, USA, EU or Asia), Sticky, HTTP 8080 and the country; the username carries `-type-mobile`.

![The QuanticData Endpoint generator for a Mobile plan: Chile selected, Global gateway with USA, EU and Asia as alternatives, Sticky session, HTTP 8080 or SOCKS5 1080, and the preview line on mobile.quantumproxies.io:8080 with -country-cl-type-mobile in the username, credentials blurred; the IP whitelist section starts below](https://quanticdata.io/blog/wget-proxy-setup/quanticdata-generator-mobile-chile.webp)

*Mobile plan: gateway, sticky session and HTTP 8080 for wget.*

```bash
export https_proxy="http://USER-country-cl-type-mobile-sid-wget02-ttl-60m:PASS@mobile.quantumproxies.io:8080"
export http_proxy="$https_proxy"
env | grep _proxy
```

![A terminal exporting https_proxy and http_proxy with a QuanticData mobile sticky line, http://USER-country-cl-type-mobile-sid-wget02-ttl-60m:PASS@mobile.quantumproxies.io:8080, and listing them with env | grep _proxy, with three numbered steps beside it](https://quanticdata.io/blog/wget-proxy-setup/wget-proxy-environment-variables-mobile.webp)

*The variables wget reads, checked with env. Real output.*

- **Lowercase names.** The manual documents `http_proxy`, `https_proxy` and `no_proxy`. In our test, an uppercase `HTTPS_PROXY` or `NO_PROXY` set on its own was ignored and wget connected straight to the site.
- **To keep them**, add the two export lines to `~/.bashrc` or `~/.zshrc`. To stop using them, run `unset https_proxy http_proxy`.
- **On Windows**, wget reads the same variables: `set https_proxy=...` in Command Prompt or `$env:https_proxy="..."` in PowerShell.
- **With IP whitelist**, the mobile plan recognises your IP and no login is sent: add your IP in the IP whitelist section and use a host:port from its list as `http://HOST:PORT`.

## Choose which requests use the proxy: no_proxy and --no-proxy

Once the variables are set, every wget uses the proxy. Two switches send some requests direct, which matters for internal hosts, package mirrors or a local test server.

![A terminal with no_proxy set to localhost,127.0.0.1,.example.com: wget --spider https://www.example.com/ connects straight to www.example.com and prints HTTP request sent, and wget --no-proxy --spider https://ipinfo.io/json skips the proxy for one command, with three numbered steps beside it](https://quanticdata.io/blog/wget-proxy-setup/wget-no-proxy-rules.webp)

*Reading the output: the host after Connecting to, and HTTP request sent instead of Proxy request sent, mean a direct request.*

1. **no_proxy** is a comma-separated list of hosts and domain endings that go direct: `export no_proxy="localhost,127.0.0.1,.example.com"`. In our tests `.example.com` matched `www.example.com` but not `example.com` itself, while `example.com` without the dot matched both.
2. **The output tells you the route.** Through the proxy, wget prints `Connecting to` followed by the gateway's name and `Proxy request sent`; direct, it prints the site's own name and `HTTP request sent`.
3. **--no-proxy** skips the proxy for one command, whatever the variables or the startup file say. `-e use_proxy=off` does the same.

## ISP proxies in ~/.wgetrc

An ISP plan gives fixed IPs that stay the same for months, which suits scheduled downloads from a server that a site has allowlisted. In the dashboard, Proxy endpoints, Assigned IPs lists them: choose Protocol HTTP / HTTPS and Output format Proxy URL, and each line reads `http://USER:PASS@IP:50100`.

![The Assigned IPs panel of a QuanticData ISP plan: Protocol HTTP / HTTPS or SOCKS5, Output format Proxy URL, five IPs masked with port 50100 and username USER, and the formatted output http://USER:PASS@IP:50100 ready to copy](https://quanticdata.io/blog/wget-proxy-setup/quanticdata-isp-assigned-ips-proxy-url.webp)

*ISP plan: one fixed IP per line, already in the URL form wget reads. Sample IPs masked.*

To make every wget leave from that IP, write it in the startup file. Wget reads a global file first, `/usr/local/etc/wgetrc` by default and `/etc/wgetrc` in the Debian and Ubuntu packages, then `~/.wgetrc`, or the file named in the `WGETRC` variable; the user's file wins.

```
# ~/.wgetrc
use_proxy = on
http_proxy = http://IP:50100/
https_proxy = http://IP:50100/
proxy_user = USER
proxy_password = PASS
```

![A terminal showing chmod 600 ~/.wgetrc, the file's permissions -rw------- and its content: use_proxy = on, http_proxy and https_proxy set to an ISP IP on port 50100 (masked), proxy_user = USER and proxy_password = PASS, with four numbered steps beside it](https://quanticdata.io/blog/wget-proxy-setup/wgetrc-isp-proxy.webp)

*The startup file with an ISP IP, readable only by its owner. Real output, IP masked.*

Run `chmod 600 ~/.wgetrc` so only you can read the password. The GNU manual warns that a password given on the command line is visible to anyone who runs `ps`; the file avoids that. Check the setup with `wget -qO- https://ipinfo.io/ip`: it prints the IP of the line.

## Which proxy type for which wget job

| Proxy type | In wget | Good for |
| --- | --- | --- |
| Residential Premium | `http://residentialpremium.quantumproxies.io:8080`; country, region, city or ISP, session and lifetime in the username; username and password only | Downloads that must come from a home connection in a chosen country, one sticky IP per job |
| ISP | `http://IP:50100` from Assigned IPs, with that IP's username and password | Scheduled jobs that need the same address every run, downloads from sites that allowlist your IP |
| Mobile | `http://mobile.quantumproxies.io:8080` with `-type-mobile` in the username, Global, USA, EU or Asia gateway; IP whitelist available | Pages and files served differently to mobile networks |

The plans are on the pages for [QuanticData residential proxies](https://quanticdata.io/residential-proxies/), [ISP proxies](https://quanticdata.io/isp-proxies/) and [mobile proxies](https://quanticdata.io/mobile-proxies/); exits in this country are on the page for [proxies in Chile](https://quanticdata.io/proxies/chile/).

## Does wget support SOCKS5?

No. GNU Wget supports HTTP and FTP proxies only, and a `socks5://` proxy stops it before it connects: `Error parsing proxy URL socks5://...: Unsupported scheme 'socks5'.` Pointing `http://` at the SOCKS5 port does not work either. Every QuanticData network also listens on HTTP, so use port 8080 (50100 for ISP) and wget works as shown above. If a job really needs SOCKS5, curl supports it: see [how to use a proxy with curl](https://quanticdata.io/blog/how-to-use-a-proxy-with-curl/), and for scripts, [a proxy in Python Requests](https://quanticdata.io/blog/how-to-use-a-proxy-with-python-requests/). The details of the protocol are on the page for [SOCKS5 proxies](https://quanticdata.io/socks5-proxies/).

## Wget proxy errors and fixes

![A terminal with two real wget proxy errors: Proxy tunneling failed: Proxy Authentication RequiredUnable to establish SSL connection when the login is wrong, here the placeholders USER and PASS, and Error parsing proxy URL socks5://...: Unsupported scheme socks5; beside it what to check in order: the whole username and the right password, an active plan with traffic left, http:// with port 8080](https://quanticdata.io/blog/wget-proxy-setup/wget-proxy-errors-407-socks5.webp)

*The two errors most wget proxy searches are about, as wget prints them.*

| What wget prints | Usual cause | Fix |
| --- | --- | --- |
| `Proxy tunneling failed: Proxy Authentication RequiredUnable to establish SSL connection.` | The gateway answered 407 and refused the login: username cut at the first dash, wrong password, placeholders left in, or a plan that expired or ran out of traffic | Copy username and password again from Connection details; check status, traffic and expiry in My proxies |
| `Error parsing proxy URL socks5://...: Unsupported scheme 'socks5'.` | Wget has no SOCKS support | `http://` and port 8080, or 50100 for ISP |
| `Proxy tunneling failed: ?Unable to establish SSL connection.` | `http://` pointed at the SOCKS5 port 1080 | Port 8080 |
| `Error in proxy URL ftp://...: Must be HTTP.` | A proxy URL with `USER:PASS@` but no `http://` in front | Start the value with `http://` |
| Connecting to the site itself, not to the gateway | Variable written in uppercase, host listed in `no_proxy`, `use_proxy = off` in a startup file, or `--no-proxy` | Lowercase `https_proxy`; check `no_proxy`, `~/.wgetrc` and the global wgetrc |
| The exit IP changes during a long job | The session lifetime ended, or the line was generated with Session set to Rotating | A sticky line with a longer `-ttl-`, up to 1440 minutes |

If the password contains characters such as `@`, `:` or `/`, a proxy URL needs them percent-encoded; `--proxy-password` or `proxy_password` in the startup file take it as it is. The 407 answer itself is explained step by step in [fixing 407 Proxy Authentication Required](https://quanticdata.io/blog/how-to-fix-407-proxy-authentication-required/), and the [proxy not working checklist](https://quanticdata.io/blog/proxy-not-working-checklist/) covers the causes that are not specific to wget.

## Before you run large downloads

A proxy changes where wget's requests come from, not what you are allowed to download. Keep to each site's terms and to the law where you work, and give recursive jobs a pace a site can handle: `--wait` and `--limit-rate` are built into wget for that.

### Sources & further reading

- [GNU Wget manual: Proxies](https://www.gnu.org/software/wget/manual/html_node/Proxies.html)
- [GNU Wget manual: Wgetrc Commands](https://www.gnu.org/software/wget/manual/html_node/Wgetrc-Commands.html)
- [GNU Wget manual: Wgetrc Location](https://www.gnu.org/software/wget/manual/html_node/Wgetrc-Location.html)
- [GNU Wget manual: HTTP Options (--proxy-user, --proxy-password)](https://www.gnu.org/software/wget/manual/html_node/HTTP-Options.html)
- [GNU Wget manual: Basic Startup Options (-e)](https://www.gnu.org/software/wget/manual/html_node/Basic-Startup-Options.html)
- [RFC 9110: HTTP Semantics, 407 Proxy Authentication Required](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.8)

## FAQ

Quick answers on wget proxy.

[Something else? Ask us](mailto:hello@quanticdata.io)

### How do I make wget use a proxy?

Three ways. For one command: `wget -e https_proxy=http://HOST:8080 --proxy-user=USER --proxy-password=PASS URL`. For a whole shell: `export https_proxy=http://USER:PASS@HOST:8080` and the same for `http_proxy`. For every run: `use_proxy = on`, `https_proxy`, `proxy_user` and `proxy_password` in `~/.wgetrc`. The command line overrides the file, and the file overrides the variables.

### How do I pass a proxy username and password to wget?

Either in the proxy URL, `http://USER:PASS@HOST:8080`, or with `--proxy-user` and `--proxy-password` on the command line, or with `proxy_user` and `proxy_password` in `~/.wgetrc`. Wget sends them with Basic authentication. With QuanticData, copy the whole username: everything after the first dash is the targeting and the session.

### Does wget support SOCKS5 proxies?

No. GNU Wget supports HTTP and FTP proxies only; a `socks5://` value ends with "Unsupported scheme 'socks5'". Use the HTTP port of the proxy instead: every QuanticData network has one, 8080 for Residential Premium and mobile, 50100 for ISP. For a job that needs SOCKS5, use curl.

### What does "Proxy tunneling failed: Proxy Authentication Required" mean in wget?

Wget asked the proxy to open a tunnel to an https:// site and the proxy answered 407: it did not accept the username or password. Copy both again from the dashboard, make sure the username was not cut at the first dash, and check that the plan is active and has traffic left.

### How do I make wget skip the proxy for some sites?

List them in `no_proxy`, separated by commas: `export no_proxy="localhost,127.0.0.1,example.com"`. A name without a leading dot also covers its subdomains; in our test `.example.com` covered `www.example.com` but not `example.com`. For a single command, add `--no-proxy`.

### Where is the wgetrc file?

Wget reads a global file first, `/usr/local/etc/wgetrc` by default and `/etc/wgetrc` in Debian and Ubuntu packages, then the user file `~/.wgetrc`, or the file named in the `WGETRC` environment variable. Settings in the user file override the global ones. Create `~/.wgetrc` if it does not exist and run `chmod 600` on it when it holds a password.

## A proxy for every wget job

Residential Premium, ISP and mobile proxies over HTTP, with country targeting and sticky sessions up to 1440 minutes, copied from the endpoint generator straight into wget.

[Start free — $2/month included](https://quanticdata.io/signup/?utm_source=blog&utm_medium=website&utm_campaign=blog-end&utm_content=wget-proxy-setup) · [Explore Residential Proxies from $0.80/GB](https://quanticdata.io/residential-proxies/)

## Related reading

- [Opera Proxy Extension: Set Up a Proxy in Opera](https://quanticdata.io/blog/opera-proxy-setup/): Proxies · Opera only opens the computer's proxy settings, and its Free VPN leaves from Opera's own servers. Quantum Proxies Manager, a free extension from the Chrome Web Store, sets the proxy for Opera alone and answers its sign-in. Below: Add to Opera, the VPN switch, private windows, ISP and mobile plans, the check and the fixes.
- [Guzzle Proxy in PHP: Auth, SOCKS5 and Errors](https://quanticdata.io/blog/guzzle-proxy-setup/): Proxies · Pass the proxy request option when you create the Client, as http://user:pass@host:port. Below: per-scheme proxies and the no list, SOCKS5 with the scheme or with cURL options (and what Guzzle 8 rejects), one sticky session per worker, ISP and mobile lines, plain PHP cURL and a fix for each cURL error.
- [Antik Browser Proxy Setup: Add, Check and Fix](https://quanticdata.io/blog/antik-browser-proxy-setup/): Proxies · In Create Profile choose New Proxy, pick Http/Https or Socks5 to match the port, paste host:port:login:password and read the check under the field. Below: every step with the exact field names, one sticky session per profile, Residential Premium, ISP and mobile lines, the Proxy list for many profiles and a fix for each error.

---

Source: https://quanticdata.io/blog/wget-proxy-setup/ · Site index for AI: https://quanticdata.io/llms.txt