wget With a Proxy: Every Way to Set It, What Overrides What, and the SOCKS5 Problem

wget takes a proxy from four places, and when they disagree it picks one without telling you. This guide sets out all four, the order they override each other in, and the things wget cannot do. Everything below was run on wget 1.25.0 on 30 September 2026 against a test proxy, so the error messages are the real ones.

The quick version

# one command
https_proxy=http://login:password@proxy.example.com:10000 wget https://example.com/file.zip

# the whole shell session
export http_proxy=http://login:password@proxy.example.com:10000
export https_proxy=http://login:password@proxy.example.com:10000
wget https://example.com/file.zip

Set both variables. http_proxy is used for http:// targets and https_proxy for https:// targets, and almost everything is HTTPS now. The proxy address itself starts with http:// in both cases: that is the protocol wget speaks to the proxy, not the protocol of the site.

The four places wget looks

1. Environment variables

The example above. Lower-case names are the ones wget documents, and they work in cron jobs, containers and scripts because the whole process inherits them.

2. The .wgetrc file

For a machine or user that always uses the same proxy, put it in ~/.wgetrc:

use_proxy = on
http_proxy = http://login:password@proxy.example.com:10000
https_proxy = http://login:password@proxy.example.com:10000

Any file works if you point the WGETRC variable at it, which is how you keep separate proxy files for separate jobs.

3. The -e option on the command line

-e sets a .wgetrc command for one run:

wget -e use_proxy=yes -e https_proxy=http://login:password@proxy.example.com:10000 https://example.com/file.zip

4. --proxy-user and --proxy-password

These supply the credentials separately from the address:

https_proxy=http://proxy.example.com:10000 wget --proxy-user=login --proxy-password='p@ss#word' https://example.com/file.zip

They are the right choice when the password contains symbols, for a reason covered below.

What overrides what

We set the four sources to disagree and watched which one wget obeyed:

So a .wgetrc on the machine silently beats the https_proxy you exported for one job, and a --proxy-user flag silently replaces the login in the address. When wget uses a proxy you did not expect, those two rules are usually why.

The special-character trap

Our test password was p@ss#word. Put into the address as is, wget never reached the proxy:

Resolving ss... failed: nodename nor servname provided, or not known.
wget: unable to resolve host address 'ss'

It read the first @ as the end of the login and tried to connect to a host called ss. Two fixes, both tested:

# percent-encode the password inside the address
https_proxy=http://login:p%40ss%23word@proxy.example.com:10000 wget https://example.com/

# or pass it separately, no encoding needed
https_proxy=http://proxy.example.com:10000 wget --proxy-user=login --proxy-password='p@ss#word' https://example.com/

@ becomes %40, # becomes %23, : becomes %3A, / becomes %2F and % itself becomes %25.

Bypassing the proxy

Three ways, all tested with a proxy in the environment that would have refused the request:

# this one command goes direct
wget --no-proxy https://example.com/

# these hosts always go direct
export no_proxy=example.com,internal.company.net
wget https://example.com/

# turn the proxy off in .wgetrc or with -e
wget -e use_proxy=no https://example.com/

no_proxy is a comma-separated list of hostnames or domain suffixes. It is the one to use for internal services that must not leave through the proxy.

SOCKS5: the thing wget cannot do

wget speaks to HTTP proxies only. Give it a SOCKS address and it stops immediately:

Error parsing proxy URL socks5://127.0.0.1:1080: Unsupported scheme.

socks5h:// gets the same answer. Guides that show a socks line in .wgetrc are describing a feature that does not exist. You have three ways out.

Use the proxy's HTTP port. Most paid proxies speak both protocols. Ours answer HTTP and SOCKS5 on the same residential port, and on separate ports for static addresses, so the fix is to write http:// instead of socks5://.

Use curl instead. curl supports SOCKS5 natively:

curl -x socks5h://login:password@proxy.example.com:1080 -O https://example.com/file.zip

Wrap wget in proxychains4 when it has to be wget, for example inside a script you cannot change. We ran it through a SOCKS5 server with a username and password, and it worked:

sudo apt install -y proxychains4

cat > socks.conf <<'EOF'
strict_chain
proxy_dns
[ProxyList]
socks5 proxy.example.com 1080 login password
EOF

proxychains4 -q -f socks.conf wget https://example.com/file.zip

proxy_dns makes hostnames resolve through the proxy, which is what you want for the reasons in what is a DNS proxy.

The connection to the proxy is not encrypted

One more limit. If you write the proxy address as https://, wget does not open a TLS connection to the proxy. In our test it connected in plain text and sent its request exactly as it would have to an http:// proxy. So the proxy login travels unencrypted between you and the proxy, whatever scheme you write. On networks you do not control, that is a reason to prefer address whitelisting where the provider offers it, or a client that does support encrypted proxy connections, which curl does.

Reading wget's errors

A polite bulk download through a proxy

The setting that matters most when wget fetches many pages is not the proxy, it is pace:

export https_proxy=http://login_c_US_s_7_ttl_1h:password@proxy.sotaproxy.com:10000

wget --mirror --no-parent --wait=2 --random-wait --limit-rate=500k \
     --user-agent="my-mirror/1.0 (+mailto:you@example.com)" \
     https://example.com/docs/

--wait and --random-wait space the requests out, --limit-rate caps the bandwidth, and wget obeys robots.txt on recursive downloads by default. The session suffix in the login keeps every request of the mirror on one exit address for an hour, so the site sees one visitor rather than a crowd. The suffix syntax is in the connection string reference.

FAQ

How do I make wget use a proxy?

Set http_proxy and https_proxy in the environment to http://login:password@host:port, or put the same lines in ~/.wgetrc with use_proxy = on.

How do I make wget ignore the proxy?

wget --no-proxy for one command, no_proxy=host1,host2 in the environment for specific hosts, or -e use_proxy=no.

Does wget support SOCKS5?

No. It rejects the address with "Unsupported scheme". Use the proxy's HTTP port, use curl, or wrap wget in proxychains4.

Why does wget say "unable to resolve host address" when I set a proxy?

A symbol in the password, usually @, cut the address in the wrong place. Percent-encode the password or pass it with --proxy-user and --proxy-password.

Which wins, the environment variable or .wgetrc?

.wgetrc. And -e on the command line beats both.