PAC Files: When a Request Uses a Proxy or Goes Direct

An IP-check page can show your direct address even while a PAC file correctly proxies another site. Check which branch governs the IP-check page itself:

function FindProxyForURL(url, host) {
  if (host === "example.com") {
    return "PROXY 203.0.113.10:8080; DIRECT";
  }
  return "DIRECT";
}

This script offers example.com the HTTP proxy followed by DIRECT. Every other host is explicitly direct, so another domain's IP checker never tests the proxy branch. Replace the documentation endpoint before use with the intended HTTP proxy; the HTTP proxy list is a source of candidates when public proxies fit the policy.

Semicolons separate route candidates. DIRECT permits a connection without a proxy; if selected, the destination can see that direct route's exit. A mandatory-proxy policy cannot rely on a rule that deliberately allows this fallback when the proxy is unavailable.

The browser decides how to handle candidate failures and may remember failed proxies. A website returning an HTTP error is not automatically equivalent to an unreachable proxy. The first candidate in the script alone therefore cannot establish which route was used.

PROXY IP:port names an ordinary HTTP listener. It can carry HTTPS through CONNECT when supported; it does not demand a separate endpoint solely because the website is HTTPS. Also use only the URL information the browser supplies: HTTPS path and query can be stripped before PAC evaluation.

Evaluate the result for the intended destination, then make a fresh request governed by that same rule. Distinguish a wrong match, an unreachable endpoint and an allowed direct fallback before choosing a fix.