Recent changes
Every real change to the content of this site gets an entry here, newest first. The list covers the last 90 days, and the RSS feed carries the same entries.
: The checker now offers two uploads for the full report: "Anonymise & upload" stores an anonymised copy after an automatic check that it behaves like your file, and "Upload (as is)" stores the file unchanged; without an upload, your file is not stored.
About · Check · Methodology
: A pattern such as shExpMatch(host, "10.*") is no longer reported when isInNet confirms the same host in the same && condition, because that is the recommended way to check an address range without a DNS lookup.
Trailing * in a host pattern matches attacker-controlled suffixes
: The checker now also accepts an IP address test kept in a variable, such as var isIp = /^[0-9.]+$/.test(host) followed by isIp && isInNet(...) or by an early return, and host.match(...) != null, so these working forms are no longer flagged.
isInNet called with a hostname · IP range matched as a text prefix · DNS lookup on every request · DNS-dependent rule placed before string rules
: console now has its own rule, because it works in Chrome and current pactester builds but not on Windows or in older pactester builds; the earlier statement that Chrome does not define console was wrong. The new rule for window, navigator, fetch, setTimeout, process, require and similar objects now counts in the rating, because no engine defines them.
console used in the PAC · Browser or Node.js objects used in the PAC · Best practices
: The checker now accepts more ways of making sure isInNet only sees IP addresses, such as /^[0-9.]+$/, a regular expression kept in a variable, RegExp(...) and an early return for hosts that are not addresses, and the rule page lists every accepted form; a test of a different variable no longer counts.
isInNet called with a hostname · IP range matched as a text prefix · DNS lookup on every request · DNS-dependent rule placed before string rules · Best practices
: The rule for plain hostnames and private addresses sent to a cloud proxy now stays silent when the file uses an internal proxy, or sends only chosen hosts to the cloud proxy and ends with DIRECT, and the page explains why an agent's local-traffic exclusion does not catch requests that the PAC file has already sent to the proxy.
Plain hostnames or private addresses are sent to the cloud proxy · Zscaler PAC file checklist · Netskope and Cloudflare PAC checklist
: The SOCKS example now sends its zone to an HTTP proxy first and keeps plain SOCKS as the fallback, because Windows misreads SOCKS5 and .NET programs ignore SOCKS entries.
: The rating now follows the Windows lab results of 2026-10-11: syntax newer than ES2017, such as ?. and ??, caps the grade at D, let and const only lower the score, and dateRange, timeRange, lower-case weekday names, decisions by URL path, SOCKS keywords, regex characters in shExpMatch and UTF-16 files are flagged.
JavaScript syntax newer than ES2017 (?., ??, object spread) · Decision depends on the URL path or query · ES2015 to ES2017 syntax (let, const, arrow functions, template literals) · Time functions that answer differently per engine (weekdayRange, dateRange, timeRange) · Return value is not a valid proxy string · Regular-expression syntax inside a shExpMatch pattern · SOCKS keywords mean different versions on different engines · alert() used in the PAC · File saved as UTF-16 instead of UTF-8 or ASCII · PROXY entry without a port · ES2015+ library methods (startsWith, flat, replaceAll, globalThis) · Large PAC served without compression · PAC file is large · Check · Best practices · Methodology · PAC files on Windows · PAC file troubleshooting · Open, view and edit a PAC file
: New article: Windows runs PAC files differently from Chrome and Firefox, from dateRange and shExpMatch to newer JavaScript, SOCKS in older programs and one answer per host; each point links the function or rule and the Windows profile in the tester.
: New article: dateRange and timeRange are always false on Windows, so time-based rules never apply to Windows programs; what works instead and how to test it.
: New engine profiles for Windows: "Windows (WinHTTP)" for Windows services, BITS and programs that use WinHTTP, and "Windows apps (WinINet, .NET, Java)" for programs that follow the Windows proxy settings, both observed in the lab on Windows 11 25H2; the tester can run a file in either of them.
: The page now says how Windows answers this call or handles this case, observed in the lab on Windows 11 25H2 on 2026-10-11; some earlier statements about Windows were reports that turned out to be wrong.
dateRange · timeRange · weekdayRange · shExpMatch · dnsDomainIs · localHostOrDomainIs · isPlainHostName · isInNet · dnsResolve · dnsResolveEx · isInNetEx · isResolvableEx · sortIpAddressList · myIpAddressEx · alert · ES2015 to ES2017 syntax (let, const, arrow functions, template literals) · alert() used in the PAC · IPv6 extension functions (isInNetEx, dnsResolveEx, myIpAddressEx) · FindProxyForURLEx entry point · SOCKS keywords mean different versions on different engines · HTTPS proxy keyword without a PROXY fallback · Time functions that answer differently per engine (weekdayRange, dateRange, timeRange) · Mutable state outside FindProxyForURL · Case-sensitive host comparisons without lower-casing host · Regular-expression syntax inside a shExpMatch pattern · Hostname pattern applied to url instead of host · Upper-case letters in a hostname pattern · Evaluation did not finish within the time limit · Loop without a reachable exit · Return value is not a valid proxy string · File saved as UTF-16 instead of UTF-8 or ASCII · PAC helper called with the wrong number of arguments · PROXY entry without a port · DIRECT as fallback after a proxy · PAC distributed via WPAD DNS discovery
: The page now has a short note on how Windows runs PAC files and links the new article and the Windows engine page.
: The page now says correctly that Windows runs let, const and arrow functions but fails on newer syntax such as ?. and ??, and links the new article on PAC files on Windows.
How to create a PAC file · Netskope and Cloudflare PAC checklist · Open, view and edit a PAC file
: New rule: an IP address written with leading zeros, in hex, as one number or in short form, or an IPv6 host with brackets, is read differently by the browsers, pactester and Windows; the rule explains why plain addresses are better even where the odd form works.
IP address written with leading zeros, in hex, as one number or in short form
: Leading zeros such as 010.0.0.0 in the network or mask are no longer reported here, because the browsers accept them; the new rule for unusual address forms reports them instead.
isInNet called with an invalid address, mask or argument count
: The page now explains why IP addresses belong in plain dotted form, even where a form with leading zeros or hex works.
: New article: pactester (pacparser) does not always answer like Chrome, Edge, Firefox or Windows; which functions differ, and how to test a file in each engine.
: The page now says where pactester, Chrome and Edge, Firefox and Windows answer this function differently, and how to write the call so that all engines agree.
isInNet · dnsResolve · myIpAddress · myIpAddressEx · weekdayRange · dateRange · timeRange · isPlainHostName
: The engine notes now say what pactester, Chrome, Firefox and Windows actually do with these calls, measured on 2026-10-11; some earlier statements were reports that turned out to be wrong.
isInNet called with an invalid address, mask or argument count · PAC helper called with the wrong number of arguments · Routing decided by myIpAddress()
: The rule is now active and counts in the rating: it flags a weekdayRange, dateRange or timeRange that wraps around, which the browsers match and pactester never does (medium), and timeRange(22, 6), which no engine ever matches (high). Plain time ranges are no longer flagged.
Time functions that answer differently per engine (weekdayRange, dateRange, timeRange)
: The page now points out the helper functions that answer differently in pactester and in the browsers, and links the new comparison article.
PAC files in CI with pactester · PAC file troubleshooting · PAC engine differences
: The page now says correctly that the tester runs a file in the one engine profile you choose (Chromium, Firefox or pacparser), not in all three at once.
Best practices · Generate · What is a PAC file? · How to create a PAC file · FindProxyForURL.com remembered
: The tester has a new "Annotated" tab that shows your PAC file with an explanation comment above each rule, and the annotated copy can be downloaded.
: New article: PAC file troubleshooting, sorted by symptom, from WinHTTP errors 12166, 12167 and 12180 to a URL that goes to the wrong proxy, with a worked example of the live trace.
: The page now names the live step-by-step trace of a URL and links the new troubleshooting article; the tester page also answers why a PAC file does not work.
: The steps for the online tester now describe how it works today: one domain or URL, an optional client IP and one engine profile per check, with a live trace of the path through the file.
How to test a PAC file · Debugging PAC in browsers · IPv6 in PAC files · Best practices
: The row for findproxyforurl.net now says that its trace shows every test and every built-in call, not only the deciding line.
: The page now links the new article on PAC file troubleshooting, and the wpad.dat test steps use the live trace.
WPAD · Auto-detection · Top 20
: The tester now traces one domain or URL with an optional client IP in the engine profile you choose, and shows the path through your PAC file in a tab next to the editor: which tests were true or false, which built-in calls ran with what result, and which line decided.
: The methodology now says that your URL runs in the one engine profile you choose and that the tester shows its path through the file, while the rating adds probe URLs built from the domains in the file.
: Every tester was checked again: pactester.online, any any deny and noob.tools are new, the rows for the pacparser online tester and App::proxyforurl are corrected, and a new column shows the trackers on each tester's page.
: New page: a list of the content changes of the last 90 days, newest first, with an RSS feed.
: The rule now has a table of how Chromium, Firefox, Windows and macOS look for wpad by DHCP and DNS, explains where Windows DNS devolution stops, and lists eight references.
: The page now says that on Windows the browsers' DNS lookups of wpad are also subject to DNS devolution, the Windows habit of trying shorter parent domains.
: The rule now describes the WPAD DNS lookup the way clients really do it: one lookup of the name wpad through the DNS suffix search list, while the label walk of the old draft is kept as history.
: The generator page now starts with three steps for creating a PAC file and ends with how to serve and deploy the file, followed by six questions and answers.
: New page: a wpad.dat generator with an explanation of DHCP option 252, the DNS lookup of wpad, and how to serve the file.
: New page: PAC file examples that you can copy, each rated A+ by the checker, and a complete reference file explained block by block.
: New article: how to write a PAC file from nothing, and the five mistakes that cause the most harm.
: New page: a checklist of best practices for PAC and wpad.dat files, with a reason and a rule for every point.
: The WPAD page now covers the protocol's history, the order in which clients try DHCP and DNS, and a table of which client uses which method.
: New page: what the setting "Automatically detect settings" does, what it costs, and how to switch it off safely on each system.
: The list now has an introduction, a part on mistakes that only happen with wpad.dat, and four questions and answers.
Follow the changes
The RSS feed lists the same entries, so a feed reader can tell you when a page changes. Older changes are kept in the site's source history. A page shows a short grey note about its newest change for 28 days, and after that only the date of its last change.