15% off your first purchase with code WELCOME15, up to 25 GB.

See pricing
ARC Proxies

Integration · HTTP clients

How to use a proxy with wget

GNU Wget reads its proxy from http_proxy and https_proxy, from -e https_proxy=... on the command line, or from a .wgetrc, and takes the credentials with --proxy-user and --proxy-password. It authenticates with Basic only and speaks HTTP proxies, not SOCKS. Where it differs from curl is recursion: one command can fetch a whole set of pages, which is where the choice between a rotating and a sticky username matters.

Reviewed 30 Oct 2026

your proxy, as a URL
http://USERNAME_pool-arcfast_country-de:PASSWORD@proxy.arcproxies.io:8000

The short answer

  • https_proxy covers HTTPS URLs and http_proxy plain HTTP; set both to the gateway's http:// address.
  • --proxy-user and --proxy-password, or proxy_user / proxy_password in a .wgetrc with mode 600.
  • A refused HTTPS tunnel exits with code 4 (network failure); a 407 on plain HTTP exits with 8.
  • Wget does not support SOCKS proxies. Use the gateway's HTTP protocol.

Setup

Set up wget with a proxy, step by step

  1. 01

    Fetch one URL and read the exit IP

    -e runs a .wgetrc command, so the proxy applies to this run only and no environment variable is left behind.

    shell
    wget -q -O - \  -e use_proxy=on -e https_proxy=http://proxy.arcproxies.io:8000 \  --proxy-user="USERNAME_pool-arcfast_country-de" --proxy-password="PASSWORD" \  "https://api.ipify.org?format=json"
  2. 02

    Keep credentials in a .wgetrc

    Command-line passwords can show up in process listings and shell history. A startup file read through WGETRC keeps them out, and chmod 600 keeps other users out of the file.

    shell
    cat > ~/.wgetrc-arc <<'EOF'use_proxy = onhttp_proxy = http://proxy.arcproxies.io:8000https_proxy = http://proxy.arcproxies.io:8000proxy_user = USERNAME_pool-arcfast_country-deproxy_password = PASSWORDEOFchmod 600 ~/.wgetrc-arcWGETRC=~/.wgetrc-arc wget -q -O - https://api.ipify.org
  3. 03

    Mirror a section from one exit

    Within one run Wget reuses its connection to a host where it can, but a long recursive fetch reconnects. A sticky username keeps the whole job on one address; --wait and --random-wait pace it.

    shell
    WGETRC=~/.wgetrc-arc wget \  --proxy-user="USERNAME_pool-arcfast_country-de_session-k3f9a1x2_sesstime-10" \  --recursive --level=1 --no-parent \  --wait=2 --random-wait \  --accept html \  https://example.com/catalogue/
  4. 04

    Compare countries and cities

    Override the username per run. Cities come from the published list, lowercased without spaces.

    shell
    for user in \  "USERNAME_pool-arcfast_country-de_city-hamburg" \  "USERNAME_pool-arcfast_country-fr_city-marseille" \  "USERNAME_pool-arcfast_country-au_city-brisbane"do  WGETRC=~/.wgetrc-arc wget -q -O - --proxy-user="$user" https://api.ipify.org; echo " $user"done
  5. 05

    Timeouts, retries and exit codes in scripts

    --tries (20 by default) retries transient failures; --retry-on-http-error adds status codes such as 429 and 503. A refused tunnel is not retried. Check the exit code: 4 is a network failure, which covers a proxy that refused the tunnel and, in our test, a listed status that persisted through every try; 8 means the server answered with an error.

    shell
    WGETRC=~/.wgetrc-arc wget -q \  --timeout=30 --tries=4 --waitretry=8 \  --retry-on-http-error=429,503 \  -O page.html "https://example.com/products?page=1"status=$?case $status in  0) echo "ok" ;;  4) echo "network failure or retries used up: check proxy credentials (407) and the site" ;;  8) echo "server returned an error status" ;;  *) echo "wget exit $status" ;;esac

Where wget reads proxy settings

SourceExampleNote
Environmenthttps_proxy=http://host:port wget …Lowercase names; no_proxy lists domains to reach directly
-e command-e https_proxy=http://host:portThis run only; overrides the environment
Startup filehttps_proxy = … in .wgetrc or the file in WGETRCAlso holds proxy_user and proxy_password
Credentials in the URLhttps_proxy=http://user:pass@host:portWorks, but the password ends up in the environment
Off switch--no-proxy or use_proxy = offIgnores all of the above

HTTPS through the gateway

For an https:// URL, Wget sends CONNECT host:443 to the gateway with the Basic credentials, then runs TLS inside the tunnel, so the gateway never sees the page. If the gateway answers 407, Wget prints "Proxy tunneling failed: Proxy Authentication Required" and exits with 4. The HTTP CONNECT glossary entry explains the mechanism, and proxy authentication the 407 challenge.

Wget fetches whatever it is told to, so a recursive job through a per-GB proxy can use more data than expected. Limit it with --accept, --level and --reject; reducing proxy bandwidth has more ways.

The problem

Common pitfalls

Setting only http_proxy

http_proxy applies to plain-HTTP URLs. HTTPS URLs use https_proxy; without it they go direct.

Expecting --tries to fix a 407

A refused tunnel was not retried in our test. Fix the credentials instead.

A socks5:// proxy URL

Wget's proxy support covers HTTP proxies. Point it at the gateway with http://.

Recursive jobs without limits

Without --level, --no-parent and an accept list, a recursive fetch follows every link it is allowed to. Respect the site's robots rules, which Wget honours by default, and its pace.

FAQ

Questions

Something not covered? Write to contact@arcproxies.io.

How do I use wget with a proxy that needs a username and password?

Set the proxy and pass the credentials: wget -e https_proxy=http://host:port --proxy-user=USER --proxy-password=PASS https://example.com. Wget sends them with Basic authentication.

Which environment variable does wget use for HTTPS?

https_proxy. http_proxy is only used for plain-HTTP URLs. Both should contain the proxy's URL, for example http://host:port.

Does wget support SOCKS5 proxies?

No. GNU Wget supports HTTP proxies (and FTP through them). For SOCKS5 use curl, or use the gateway's HTTP protocol with Wget.

What does "Proxy tunneling failed: Proxy Authentication Required" mean in wget?

The proxy refused the CONNECT request for an HTTPS URL because the credentials were missing or wrong. Wget exits with status 4. Check --proxy-user and --proxy-password, or proxy_user and proxy_password in your .wgetrc.

Sources & review

Last reviewed by the ARC Proxies team. Prices are read from the live catalog at build time.

  1. [1]GNU: GNU Wget Manual: Proxies
  2. [2]GNU: GNU Wget Manual: HTTP Options (--proxy-user)
  3. [3]GNU: GNU Wget Manual: Download Options (--tries)
  4. [4]GNU: GNU Wget Manual: Exit Status

Next

What people build with it

Use caseProxies for web scraping and data collectionA second provider that just works — Scrapy, requests, Crawlee or Playwright, self-serve, no sales call, bandwidth that never expires.Use caseProxies for AI and LLM training-data collectionCollect public web text, images and product data at corpus scale from residential and ISP IPs, paid per gigabyte with no monthly commitment.Use caseProxies for QA, app and localisation testingSee your own site the way a user in Tokyo, São Paulo or Munich sees it — currency, language, consent banner, CDN edge and all — before they report it.IntegrationcurlSend curl through an authenticated proxy with -x and -U, check the exit IP, test sticky sessions and countries, use socks5h, and read 407 failures.GlossaryHTTP CONNECTHTTP CONNECT is the HTTP request method a client sends to a proxy to ask for a tunnel to a host and port; once the proxy answers with a 2xx status it blindly forwards bytes in both directions, which is how HTTPS passes through an HTTP proxy with TLS intact end to end (RFC 9110, section 9.3.6).GlossaryProxy authenticationProxy authentication is how a proxy confirms that a client may use it: under RFC 9110 the proxy answers with status 407 Proxy Authentication Required and a Proxy-Authenticate challenge, and the client sends its credentials in a Proxy-Authorization header.GuideHow to reduce proxy bandwidthCut proxy bandwidth by fetching HTML or JSON instead of rendering, blocking images and fonts, using compression, conditional requests and local caching.

Integrations

Other http clients

Python requestsUse an authenticated proxy with Python requests: the proxies argument, sticky sessions per task, geo-targeting, SOCKS5 and retries that skip 407 errors.HTTPXConfigure an authenticated proxy in HTTPX 0.28: the proxy= argument that replaced proxies=, mounts per domain, async clients, SOCKS5 and error handling.aiohttpUse an authenticated proxy with aiohttp: proxy= per request or per session, why proxy_auth is deprecated, SOCKS5 through aiohttp-socks, and 407 handling.AxiosUse an authenticated proxy with Axios in Node.js: the proxy option on 1.16.1+, https-proxy-agent for older versions, sticky sessions, SOCKS5 and 407s.Node.js fetchNode's built-in fetch has no proxy option. Use undici's ProxyAgent as the dispatcher, or NODE_USE_ENV_PROXY, with sticky sessions, SOCKS5 and 407 handling.curlSend curl through an authenticated proxy with -x and -U, check the exit IP, test sticky sessions and countries, use socks5h, and read 407 failures.GoRoute Go's net/http through an authenticated proxy: Transport.Proxy with url.UserPassword, a sticky session per request context, SOCKS5 and 407 checks.RubyUse an authenticated proxy in Ruby: Net::HTTP proxy arguments, Faraday proxy options, sticky sessions per task, geo-targeting and 407 handling.PHP GuzzleRoute PHP Guzzle and plain cURL through an authenticated proxy: the proxy option, sticky sessions, geo-targeting, retries that stop on a 407.Java HttpClientUse an authenticated proxy with java.net.http.HttpClient: ProxySelector, Authenticator, the Basic-over-CONNECT setting, sticky sessions and 407s.C# HttpClientUse an authenticated proxy in .NET: WebProxy and NetworkCredential on SocketsHttpHandler, a client per sticky session, SOCKS5 and 407 handling.Rust reqwestRoute Rust reqwest through an authenticated proxy: Proxy::all with basic_auth, a Client per sticky session, socks5h, timeouts and 407 errors.PostmanSend Postman requests through an authenticated proxy: the custom proxy settings, Proxy auth, checking the exit IP, sessions, countries and Newman.DockerGive Docker containers and builds an authenticated proxy: HTTP_PROXY, HTTPS_PROXY and NO_PROXY, build args, Compose, and why the daemon proxy differs.

Get started

Get credentials and paste them in.

Sign up, buy a gigabyte, generate a username in the dashboard. Code WELCOME15 takes 15% off your first purchase; bandwidth never expires.

Create your accountQuestions first? contact@arcproxies.io