VPN kill switch not protecting browser traffic?
Learn how to check whether a VPN kill switch blocks browser traffic, spot IPv6 or WebRTC leaks, and fix settings before using sensitive sites.
Your VPN says it is connected, but you are not sure what happens if the tunnel drops. A kill switch is meant to block internet traffic during that gap. If it fails, your browser may reconnect outside the VPN before the tunnel comes back.
You can check for browser-visible IP leaks with the VPN Leak Test. It checks for your real IP address appearing through IPv6 or WebRTC while the VPN is on. It cannot prove that every kind of browser traffic is protected, so use it as one part of a careful check.
Check what the browser can see
- Connect to your VPN and open the VPN Leak Test in the browser you want to check.
- Let the test finish. Note the IP address and whether the result shows an IPv6 or WebRTC leak. Compare the result with the VPN connection active, not with an old result left open in another tab.
- Check your VPN app for a setting called Kill switch, Network Lock, or similar. Turn it on if available, and check whether it covers all apps or only selected apps.
- If your VPN app provides a safe connection-recovery or kill-switch test, use it while viewing a non-sensitive page. Keep the VPN app open, wait for the tunnel to reconnect, then reload the leak test to request a fresh result.
Do not test this while signed in to banking, work, or other sensitive accounts. If the VPN app has no test mode, avoid repeatedly switching off the VPN as a substitute: some apps treat a deliberate disconnect differently from an unexpected tunnel failure. Check the app's documentation for what its kill switch is designed to block.
What the result means
The test reports the VPN address and no IPv6 or WebRTC leak
The browser did not reveal your real IP through those checks during this test. That is useful, but it does not prove the kill switch will block traffic during every kind of interruption. A brief drop can happen between checks, and the test does not inspect every request the browser makes.
The test shows your real IP while the VPN is connected
The browser may be bypassing the VPN, or a connection path such as IPv6 or WebRTC may be exposing your real address. Check the VPN's split-tunneling rules and leak-protection settings. For more ways to interpret IP results, see how to check whether your VPN leaks your IP address.
The browser stops loading pages when the tunnel drops
That is consistent with a kill switch blocking traffic during the interruption. It is not proof by itself: your whole internet connection could have dropped, or the page could be unavailable. Check that ordinary connectivity returns after the VPN reconnects, then repeat the test.
Pages keep loading while the VPN reconnects
This deserves a closer look. The browser may have a route around the VPN, the kill switch may be off, or the VPN app may allow traffic during a user-initiated disconnect. Reload the test and check whether it shows your real IP. Do not assume that a page loading means your IP was exposed, but treat an unexpected real-IP result as a warning.
How to fix it
- Turn on the VPN app's kill switch. Look in the app's connection, privacy, or network settings. Names and behavior differ between VPN apps. If there is a choice between blocking traffic only during an unexpected drop and blocking traffic whenever the VPN is off, choose the behavior you actually need.
- Check split tunneling. Split tunneling lets selected apps bypass the VPN. Remove the browser from any bypass list, or choose the setting that routes all apps through the VPN. Check every browser profile you use, since the VPN app may list browsers separately.
- Check for IPv6 or WebRTC exposure. Look for IPv6 and WebRTC leak protection in the VPN app. If the provider offers an IPv6 option, use its recommended setting rather than changing network settings at random. Retest with the VPN connected after changing one setting at a time.
- Update and reconnect the VPN app. Install the current version, reconnect to a server, and repeat the test. If the problem began after an update, try another server or contact the VPN provider before relying on the kill switch.
- Review firewall changes. A firewall rule that allows the browser around the VPN can defeat the intended block. On Windows 11, review Windows Security › Firewall & network protection. On macOS, review System Settings › Network › Firewall. Avoid broad allow rules, and do not delete VPN-created rules unless the VPN provider's instructions tell you to.
- Test again in the affected browser. Close old test tabs, reconnect the VPN, and run a fresh check. If the leak appears only in one browser, review that browser's VPN extensions, proxy settings, and privacy features.
What this test cannot prove
A browser leak check observes what the page can see through the checks it runs. It is not a full packet capture, and it cannot certify that all traffic from every app is routed through the VPN. It also does not test every possible DNS leak or prove that the VPN will block connections during a future failure.
For stronger confidence, combine a fresh browser leak check with the VPN app's own kill-switch test, if it offers one. Keep the VPN app and browser updated, and avoid sending sensitive traffic while troubleshooting an uncertain connection.
