diff --git a/CMakeLists.txt b/CMakeLists.txt
index ac9bd8c46..dc1040d8a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -33,7 +33,7 @@ option(LWS_WITH_CGI "Include CGI (spawn process with network-connected stdin/out
 option(LWS_IPV6 "Compile with support for ipv6" OFF)
 option(LWS_UNIX_SOCK "Compile with support for UNIX domain socket" OFF)
 option(LWS_WITH_PLUGINS "Support plugins for protocols and extensions" OFF)
-option(LWS_WITH_HTTP_PROXY "Support for HTTP proxying" OFF)
+option(LWS_WITH_HTTP_PROXY "Support for active HTTP proxying" OFF)
 option(LWS_WITH_ZIP_FOPS "Support serving pre-zipped files" OFF)
 option(LWS_WITH_SOCKS5 "Allow use of SOCKS5 proxy on client connections" OFF)
 option(LWS_WITH_GENERIC_SESSIONS "With the Generic Sessions plugin" OFF)
@@ -133,6 +133,7 @@ option(LWS_WITH_DEPRECATED_LWS_DLL "Migrate to lws_dll2 instead ASAP" OFF)
 option(LWS_WITH_SEQUENCER "lws_seq_t support" ON)
 option(LWS_WITH_EXTERNAL_POLL "Support external POLL integration using callback messages (not recommended)" OFF)
 option(LWS_WITH_LWS_DSH "Support lws_dsh_t Disordered Shared Heap" OFF)
+option(LWS_CLIENT_HTTP_PROXYING "Support external http proxies for client connections" ON)
 #
 # to use miniz, enable both LWS_WITH_ZLIB and LWS_WITH_MINIZ
 #
diff --git a/cmake/lws_config.h.in b/cmake/lws_config.h.in
index a87d2323e..d30b81f7f 100644
--- a/cmake/lws_config.h.in
+++ b/cmake/lws_config.h.in
@@ -19,6 +19,7 @@
 #cmakedefine LWS_AVOID_SIGPIPE_IGN
 #cmakedefine LWS_BUILD_HASH "${LWS_BUILD_HASH}"
 #cmakedefine LWS_BUILTIN_GETIFADDRS
+#cmakedefine LWS_CLIENT_HTTP_PROXYING
 #cmakedefine LWS_FALLBACK_GETHOSTBYNAME
 #cmakedefine LWS_HAS_INTPTR_T
 #cmakedefine LWS_HAS_GETOPT_LONG
diff --git a/lib/core-net/client.c b/lib/core-net/client.c
index 78fd63e8e..95b6a77bb 100644
--- a/lib/core-net/client.c
+++ b/lib/core-net/client.c
@@ -24,6 +24,8 @@
 
 #include "private-lib-core.h"
 
+#if defined(LWS_CLIENT_HTTP_PROXYING)
+
 LWS_VISIBLE int
 lws_set_proxy(struct lws_vhost *vhost, const char *proxy)
 {
@@ -116,4 +118,4 @@ auth_too_long:
 
 	return -1;
 }
-
+#endif
diff --git a/lib/core-net/vhost.c b/lib/core-net/vhost.c
index d4946e3cd..dfc499b2c 100644
--- a/lib/core-net/vhost.c
+++ b/lib/core-net/vhost.c
@@ -440,7 +440,8 @@ lws_create_vhost(struct lws_context *context,
 	struct lws_protocols *lwsp;
 	int m, f = !info->pvo, fx = 0, abs_pcol_count = 0;
 	char buf[96];
-#if !defined(LWS_WITHOUT_CLIENT) && defined(LWS_HAVE_GETENV)
+#if defined(LWS_CLIENT_HTTP_PROXYING) && \
+    !defined(LWS_WITHOUT_CLIENT) && defined(LWS_HAVE_GETENV)
 	char *p;
 #endif
 	int n;
@@ -674,18 +675,17 @@ lws_create_vhost(struct lws_context *context,
 	}
 
 	vh->listen_port = info->port;
-#if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
-	vh->http.http_proxy_port = 0;
-	vh->http.http_proxy_address[0] = '\0';
-#endif
+
 #if defined(LWS_WITH_SOCKS5)
 	vh->socks_proxy_port = 0;
 	vh->socks_proxy_address[0] = '\0';
 #endif
 
-#if !defined(LWS_WITHOUT_CLIENT)
+#if !defined(LWS_WITHOUT_CLIENT) && defined(LWS_CLIENT_HTTP_PROXYING)
 	/* either use proxy from info, or try get it from env var */
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
+	vh->http.http_proxy_port = 0;
+	vh->http.http_proxy_address[0] = '\0';
 	/* http proxy */
 	if (info->http_proxy_address) {
 		/* override for backwards compatibility */
diff --git a/lib/roles/http/client/client-handshake.c b/lib/roles/http/client/client-handshake.c
index abf08bfb9..a279a4a19 100644
--- a/lib/roles/http/client/client-handshake.c
+++ b/lib/roles/http/client/client-handshake.c
@@ -53,7 +53,9 @@ lws_getaddrinfo46(struct lws *wsi, const char *ads, struct addrinfo **result)
 struct lws *
 lws_client_connect_3(struct lws *wsi, struct lws *wsi_piggyback, ssize_t plen)
 {
+#if defined(LWS_CLIENT_HTTP_PROXYING)
 	struct lws_context_per_thread *pt = &wsi->context->pt[(int)wsi->tsi];
+#endif
 	const char *meth = NULL;
 	struct lws_pollfd pfd;
 	const char *cce = "";
@@ -70,6 +72,7 @@ lws_client_connect_3(struct lws *wsi, struct lws *wsi_piggyback, ssize_t plen)
 	if (wsi_piggyback)
 		goto send_hs;
 
+#if defined(LWS_CLIENT_HTTP_PROXYING)
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
 	/* we are connected to server, or proxy */
 
@@ -105,6 +108,7 @@ lws_client_connect_3(struct lws *wsi, struct lws *wsi_piggyback, ssize_t plen)
 		return wsi;
 	}
 #endif
+#endif
 #if defined(LWS_WITH_SOCKS5)
 	/* socks proxy */
 	else if (wsi->vhost->socks_proxy_port) {
@@ -227,8 +231,10 @@ struct lws *
 lws_client_connect_2(struct lws *wsi)
 {
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
+#if defined(LWS_CLIENT_HTTP_PROXYING)
 	struct lws_context *context = wsi->context;
 	struct lws_context_per_thread *pt = &context->pt[(int)wsi->tsi];
+#endif
 	const char *adsin;
 	ssize_t plen = 0;
 #endif
@@ -434,7 +440,8 @@ create_new_conn:
 	}
 #endif
 
-#if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
+#if defined(LWS_CLIENT_HTTP_PROXYING) && \
+	(defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2))
 
 	/* Decide what it is we need to connect to:
 	 *
diff --git a/lib/roles/http/private-lib-roles-http.h b/lib/roles/http/private-lib-roles-http.h
index 1e568dd85..01557df49 100644
--- a/lib/roles/http/private-lib-roles-http.h
+++ b/lib/roles/http/private-lib-roles-http.h
@@ -191,10 +191,14 @@ struct lws_peer_role_http {
 };
 
 struct lws_vhost_role_http {
+#if defined(LWS_CLIENT_HTTP_PROXYING)
 	char http_proxy_address[128];
+#endif
 	const struct lws_http_mount *mount_list;
 	const char *error_document_404;
+#if defined(LWS_CLIENT_HTTP_PROXYING)
 	unsigned int http_proxy_port;
+#endif
 };
 
 #ifdef LWS_WITH_ACCESS_LOG