Pre-flight checks

Before you trust a VPN for anything that matters, spend two minutes checking that it actually does what you think. A misconfigured VPN gives you a false sense of safety, which is worse than no VPN at all.

Do every check with the VPN connected.

1. Did your IP address change?

Open any “what is my IP” service and note the address and country. It must show the VPN server’s location, not your real one. If you still see your own city or your ISP’s name, the tunnel is not carrying your traffic — stop and fix it.

2. Is your DNS leaking?

Run a DNS leak test. It lists the resolvers that answered your requests. Every entry must belong to your VPN (or your own resolver) — not to your Internet Service Provider. If your ISP shows up here, your browsing history is still leaking. See DNS for how to fix it.

3. Is IPv6 leaking?

Many VPNs only tunnel IPv4 and quietly let IPv6 traffic bypass them. On the IP-check page, look at whether an IPv6 address is shown and whether it is the VPN’s. If in doubt, the safe move is to disable IPv6 on your device while you rely on the VPN.

4. Is WebRTC leaking?

Browsers can reveal your real IP address through WebRTC, even behind a VPN. Use a “WebRTC leak test” page. If your real address appears, disable WebRTC in your browser or use an extension that blocks it.

5. Does the kill switch work?

A kill switch blocks all traffic the moment the VPN drops, so you are never exposed without noticing. Test it: connect, then disconnect the VPN (or pull your network for a second) and confirm that your apps lose internet until the tunnel is back.

Quick checklist

• IP address shows the VPN location
• DNS resolvers belong to the VPN, not the ISP
• No IPv6 leak
• No WebRTC leak
• Kill switch stops traffic when the VPN drops

Only once all five pass should you treat the connection as private.