Quantumult X · WLOC setup tutorial

Configure WLOC on Quantumult X — rewrite rules, MitM, and certificate trust

Quantumult X has one quirk that trips up almost everyone: after importing the WLOC config, you have to manually refresh the script resource. Skip this and nothing runs. Also, its settings bridge speaks HTTP/1.1 status strings, not JSON. That is normal — do not panic when you see it.

Before you start

WLOC installed.
Quantumult X installed (separate purchase).
A test device.
Stable Wi-Fi.

Step 1: Import the WLOC configuration

Copy the module URL: https://wloc.app/modules/wloc.conf. In QX, Settings → Rewrite & Filters → tap download icon (top-right) → paste URL → Download. Make sure BOTH checkboxes (rewrite rules AND MitM hostnames) are selected.

The .conf file contains [rewrite_local] rules and [mitm] hostnames — both sections are needed.
If only one section imported, delete and re-import with both checkboxes checked.

Step 2: Refresh the script resource — do not skip this

After import, QX caches an older script version. Settings → Rewrite & Filters → find the WLOC entry → tap the refresh icon (small circular arrow). This forces QX to fetch the latest wloc.js, wloc-settings.js, and wloc-route.js. Two seconds. Do it now.

Always refresh after first import and after any WLOC update.
I cannot count how many times someone messaged us saying QX is broken, and the fix was just this refresh.

Step 3: Generate and trust the CA certificate

QX Settings → MitM → Generate CA. Install the profile. Then Settings → General → About → Certificate Trust Settings → toggle ON for QX CA. Both steps required — QX shows MitM as enabled even without iOS trust.

CA generation: QX Settings → MitM → Generate CA.
iOS trust: Settings → General → About → Certificate Trust Settings.

Step 4: Verify with WLOC diagnostics

Save a test target. Run diagnostics. QX uses HTTP/1.1 status-string responses for the settings bridge — this is normal. Look for patch count > 0.

HTTP/1.1 status strings are normal for QX.
Patch count > 0 confirms the response script is active.

Step 5: Restore and cleanup

WLOC: clear target, confirm passthrough. QX: disable rewrite rule, disable MitM. iOS: General → VPN & Device Management → remove CA profile. About → Certificate Trust Settings → confirm gone.

Disable rewrite rule first to stop script execution.
Remove CA profile — QX does not auto-remove it.

Common gotchas

Script not running after import

Refresh the script resource. QX caches aggressively. Tap the refresh icon next to the WLOC rewrite entry. Two seconds.

Settings bridge returns unexpected format

QX uses HTTP/1.1 status-string responses. This is expected. Do not try to force JSON mode.

FAQ

Why does QX need a resource refresh?

QX caches script resources on first import. The refresh ensures you have the current WLOC script version matching the module configuration.