Automatic Proxy Setup: PAC Script and Configuration URL

Microsoft calls it a setup script. The steps are the same on Windows 11 and Windows 10 (Microsoft Support: Use a proxy server in Windows):

1. Open Settings > Network & internet > Proxy.
2. Under Automatic proxy setup, next to Use setup script, select Set up.
3. In the Edit setup script dialog box, turn on Use setup script.
4. Enter the PAC file's address in the script address box, for example https://example.com/proxy.pac.
5. Select Save.

Leave Automatically detect settings off unless your network provides a script (see auto-detect and WPAD below). If you don't know the script address, it comes from whoever wrote the file: your company's IT team, or you. More Windows proxy options: Windows.

Chrome has no PAC field of its own on Windows and macOS: it uses the system proxy setting.

1. Open chrome://settings/system.
2. Select Open your computer's proxy settings. On Windows this opens the Proxy page above; on a Mac, the network settings.
3. Enter the PAC address there, in the setup script or automatic proxy configuration field, and save.

A PAC address typed into Chrome's address bar only opens or downloads the file: it configures nothing. For one Chrome session with its own script, start Chrome with --proxy-pac-url=https://example.com/proxy.pac. Edge works the same way. More on Chrome: Chrome.

Manual is simpler; automatic is more flexible. Most home users need neither, as what proxy settings are explains.

A PAC file defines one function. The browser calls it with each URL and host, and uses the string it returns (MDN: Proxy Auto-Configuration (PAC) file). This one, saved as proxy.pac and served at https://example.com/proxy.pac, sends two sites through ProxyField and everything else directly:

function FindProxyForURL(url, host) {
  // local names and private networks: never through the proxy
  if (isPlainHostName(host) || shExpMatch(host, "*.local") ||
      shExpMatch(host, "10.*") || shExpMatch(host, "192.168.*")) {
    return "DIRECT";
  }
  // only these sites go through the proxy
  // <port>: the port you set up in the dashboard for your allowlisted IP
  if (dnsDomainIs(host, ".example.com") || dnsDomainIs(host, ".example.org")) {
    return "PROXY gate.proxyfield.io:<port>; DIRECT";
  }
  return "DIRECT";
}

Ending with DIRECT keeps sites loading if the proxy is unreachable; leave it out if those sites must never be reached without the proxy. Match on the host, not on the path: Chrome passes https:// URLs to the script without their path and query, as scheme://host:port/ (Chromium: proxy support in Chrome). Avoid isInNet() and dnsResolve() for every request where you can: they make a DNS lookup each time and slow browsing down.

ProxyField takes HTTP, HTTPS and SOCKS5, and SOCKS5 works with the allowlist too, so PROXY gate.proxyfield.io:<port> and SOCKS5 gate.proxyfield.io:<port> both work, where <port> is the port you set up in the dashboard.

The configuration URL is just where the file lives. Serve it from any web server you control, ideally with the content type application/x-ns-proxy-autoconfig. For a quick test on your own computer:

python3 -m http.server 8000
# the configuration URL is then http://127.0.0.1:8000/proxy.pac

Support for file:// addresses varies by system and browser, so a web address is the reliable choice. Keep the file where every device that uses it can reach it, and remember that anyone who can reach the URL can read which sites you route and where.

Device-specific steps: Mac, iPhone, Android and Firefox.

"Automatically detect settings" (Windows) and "Auto proxy discovery" (Mac) use WPAD, the Web Proxy Auto-Discovery protocol: the device asks the network for a PAC file, through DHCP or by looking up a wpad host in the local domain, and downloads wpad.dat if it finds one. Company networks use it to configure every machine at once. On a home network nothing answers, and the device connects directly.

Because WPAD trusts whatever the local network announces, a hostile network could hand you its own script. On public Wi-Fi, turn auto-discovery off if you don't need it.

Some sites: a PAC file is the built-in way, as in the example above. Browser proxy extensions with per-site rules do the same inside one browser (proxy switchers compared).

Some apps: PAC files only affect apps that read the system proxy, so per-app routing works differently:

• Give each app its own proxy setting, if it has one (Firefox, Postman, antidetect browsers, game launchers).
• For command-line tools and scripts, set the proxy variables only for that command (command line proxy); curl, for one, does not read PAC files.
• On Windows and macOS, a proxy client such as Proxifier forces chosen apps through a proxy by rule, even apps without proxy settings.
• On phones, the Wi-Fi proxy is used by the browser and some apps; per-app routing needs a proxy app (phone proxy settings).

A PAC file returns only a host and a port; it has no place for a username and password. When the chosen proxy asks for a login, the browser shows a password prompt, and many apps simply fail. With ProxyField, add your device's public IP to the allowlist in your account, and the PAC file's PROXY gate.proxyfield.io:<port>, with the port you set up in the dashboard, works without any login (proxy authentication). Choosing the country, city or a sticky session without a username: with the allowlist, the product, location and session are set per port in the dashboard.

Browsers download the PAC file when the setting is applied, when the network changes and at startup, and keep it cached in between. After you edit it:

• Chrome and Edge: restart the browser. Where your version still has it, chrome://net-internals/#proxy > Re-apply settings does the same without a restart.
• Firefox: select Reload next to the URL in Network Settings.
• Windows, Mac and phones: turn the setting off and on, or reconnect to the network.

If nothing goes through the proxy, check that the URL opens in a browser and shows the script as text, that the function is named exactly FindProxyForURL, and that the script has no syntax errors: a broken script usually means direct connections. To confirm the result, open the proxy checker on a site the script routes through the proxy.