My Nginx access.log is FULL with lines about /wpad.dat (on a completely empty site with only "index.php") :

  • - - [13/Aug/2013:22:37:04 +0000] "GET /wpad.dat HTTP/1.1" 200 731 "-" "Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.95 Safari/537.36"

and on another empty site:

  • - - [14/Aug/2013:00:22:42 +0000] "GET /wpad.dat HTTP/1.1" 404 168 "-" "WinHttp-Autoproxy-Service/5.1"
  • - - [14/Aug/2013:00:22:46 +0000] "GET /wpad.dat HTTP/1.1" 404 168 "-" "Kaspersky Proxy-Server detection agent"

Can I prevent the above / does it point to some misconfiguration? It seems only 2 of my sites hosted on this amazon image show these entries in the log files.

  • 1
    A similar question was asked on Server Fault: serverfault.com/questions/510396/being-flooded-by-wpad-dat Are you interested in removing the cause of the requests? (Possibly a wildcard domain record pointing to your server?) Or just hiding the log entries? – Simon East Aug 14 '13 at 5:11
  • thanks for the reference! I solved it by just blocking the specific IP address. – edelwater Aug 14 '13 at 11:46

Your first log snippet suggests that the file may actually exist, since nginx response is 200, with 731 bytes of payload data, so, don't be too fast to have it blocked.

However, if you want to have such requests omitted from logs, you can use the following in all servers affected:

location = /wpad.dat {
    access_log  off;
    log_not_found   off;

Or, better yet, if you know for sure that you don't have such file, and want to return 404 right away, still omitting all such requests from the logs, use:

location = /wpad.dat {
    access_log  off;
    return  404;
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.