My Nginx access.log is FULL with lines about /wpad.dat (on a completely empty site with only "index.php") :

  • - - [13/Aug/2013:22:37:04 +0000] "GET /wpad.dat HTTP/1.1" 200 731 "-" "Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36"

and on another empty site:

  • - - [14/Aug/2013:00:22:42 +0000] "GET /wpad.dat HTTP/1.1" 404 168 "-" "WinHttp-Autoproxy-Service/5.1"
  • - - [14/Aug/2013:00:22:46 +0000] "GET /wpad.dat HTTP/1.1" 404 168 "-" "Kaspersky Proxy-Server detection agent"

Can I prevent the above / does it point to some misconfiguration? It seems only 2 of my sites hosted on this amazon image show these entries in the log files.

  • 1
    A similar question was asked on Server Fault: serverfault.com/questions/510396/being-flooded-by-wpad-dat Are you interested in removing the cause of the requests? (Possibly a wildcard domain record pointing to your server?) Or just hiding the log entries?
    – Simon East
    Commented Aug 14, 2013 at 5:11
  • thanks for the reference! I solved it by just blocking the specific IP address.
    – edelwater
    Commented Aug 14, 2013 at 11:46

1 Answer 1


Your first log snippet suggests that the file may actually exist, since nginx response is 200, with 731 bytes of payload data, so, don't be too fast to have it blocked.

However, if you want to have such requests omitted from logs, you can use the following in all servers affected:

location = /wpad.dat {
    access_log  off;
    log_not_found   off;

Or, better yet, if you know for sure that you don't have such file, and want to return 404 right away, still omitting all such requests from the logs, use:

location = /wpad.dat {
    access_log  off;
    return  404;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.