Test 1: Compare your IP address
Disconnect the VPN and open an IP lookup page. Note the IP address, the provider (your internet company) and the region. Then connect the VPN, refresh the page and compare.
If the VPN works, the address and provider change to the VPN server’s network, and the region usually matches the server location you chose. If you still see your own provider, the VPN is not routing browser traffic. Check that the app shows “connected” and that split tunnelling is not excluding the browser.
Do not worry if the city is slightly off. IP geolocation databases often place VPN servers in a nearby city or the provider’s registered location.
- VPN off: note IP, provider and region.
- VPN on: refresh and compare.
- Provider should change to the VPN or hosting network.
Test 2: Check for an IPv6 leak
Many networks now give devices both IPv4 and IPv6 addresses. Some VPNs tunnel only IPv4, so websites that prefer IPv6 can still see your real address. Run an IPv6 test with the VPN connected.
If the test shows an IPv6 address from your own provider, you have an IPv6 leak. Turn on the VPN app’s IPv6 leak protection, choose a VPN that fully supports IPv6, or disable IPv6 on the network adapter as a temporary workaround.
If the test shows no IPv6 connectivity or an address belonging to the VPN, you are fine.
Test 3: Check for a WebRTC leak
WebRTC lets browsers make real-time connections for calls and video. While setting those up, the browser can reveal network addresses to the website, sometimes bypassing the VPN path. Run a WebRTC leak test with the VPN on.
A safe result shows only the VPN’s public IP or masked local addresses ending in “.local”. A leak shows your real public IP from your own provider. Fix it with the VPN’s browser extension, the browser’s WebRTC privacy setting or a trusted extension that limits WebRTC.
Masked local addresses are normal in modern browsers and are not a leak by themselves.
Safe: candidate 198.51.100.7 (VPN), candidate 3f2a...e1.local
Leak: candidate 203.0.113.45 (your home ISP)Tests 4 and 5: DNS and the kill switch
DNS turns website names into addresses. If DNS requests go to your internet provider instead of the VPN’s resolver, the provider can still see which sites you look up. Enable the VPN app’s “use VPN DNS” or DNS leak protection option, and avoid manually set DNS servers on the adapter that bypass the tunnel.
To test the kill switch, start a large download or a video, then disconnect the VPN server abruptly by switching servers or turning Wi-Fi off and on. With the kill switch working, traffic should stop until the VPN reconnects instead of falling back to your normal connection.
Some operating systems, especially mobile ones, offer an “always-on VPN” and “block connections without VPN” setting. Turning both on is the most reliable kill switch.
If a test fails
Update the VPN app first; many leaks are fixed in newer versions. Then try another protocol, preferably WireGuard, and another server. Restart the device after major changes and repeat all five tests.
If the VPN still leaks after those steps, contact its support team with your test results, or switch to a provider that offers built-in IPv6, DNS and WebRTC protection.
Remember that even a perfect VPN does not stop websites from recognising you through accounts, cookies or browser fingerprinting. Run a browser privacy check to see what else your browser reveals.