- ✓Checking your VPN takes about two minutes with free, independent test sites.
- ✓Confirm your IP changed, then test for DNS and WebRTC leaks — the two that quietly expose you.
- ✓A kill switch is your safety net: it cuts the internet if the VPN drops, so nothing leaks.
- ✓If you find a leak, it’s usually fixable in settings — enable the kill switch and leak protection.
- ✓Good VPNs with a kill switch and DNS-leak protection rarely leak; cheap or free ones often do.
The quick version
Connect your VPN, then visit an IP-checker site — it should show the server’s country, not yours. For a proper check, also run a DNS-leak test and a WebRTC-leak test. If your real IP, country or DNS shows up anywhere, your VPN is leaking. The whole thing takes about two minutes with free tools.
A working VPN shows the same foreign country on every test. See your own country anywhere and something’s leaking.
What a “leak” actually means
A “leak” is when some of your real identifying information escapes the encrypted tunnel. There are three to know:
Test 1: check your IP address
The basic test. With the VPN connected, search “what is my IP” on Google or open a checker like ipleak.net. It should show the country of the server you chose. If it shows your real country, the VPN isn’t routing your traffic — reconnect, or try a different server.
- 1Note your real IP first
Before connecting, visit an IP checker and note your real IP and location — so you know what “leaking” would look like.
- 2Connect your VPN
Open the app and connect to a server in another country.
- 3Run the leak tests
Recheck your IP, then run a DNS-leak test and a WebRTC-leak test using the free tools below.
- 4Read the results
Every result should show the VPN server’s country and DNS — never your own. If your real IP or country appears anywhere, you have a leak.
Test 2: check for DNS leaks
This is the sneaky one. Visit a free tool like dnsleaktest.com and run the extended test. The DNS servers it lists should belong to your VPN (or its region) — not your Irish ISP (Eir, Virgin Media, Sky, Vodafone). If you see your ISP’s name or your home city, that’s a DNS leak: your browsing is still visible to your provider even though the connection is encrypted.
Test 3: check for WebRTC leaks
Because WebRTC is a browser feature, it can expose your real IP even when everything else is fine. Visit browserleaks.com/webrtc with the VPN on. The “public IP” it detects should be the VPN’s, not your real one. If your real IP appears, disable WebRTC in your browser (or use your VPN’s browser extension, which usually blocks it).
Test 4: check the kill switch
Your kill switch is the safety net for the moment a VPN connection drops. To test it: start a download or a live stream, then — with the kill switch enabled in your VPN app — briefly disconnect the VPN (or switch servers). Your internet should cut out entirely until the VPN reconnects. If traffic keeps flowing with the VPN off, the kill switch isn’t doing its job — check it’s turned on in settings.
What to do if you find a leak
- Turn on the kill switch and DNS-leak protection in your VPN app — many providers have these off by default.
- Switch protocol. Try WireGuard (or OpenVPN) if you’re on something older.
- Disable WebRTC in your browser, or install the VPN’s browser extension.
- Handle IPv6. Enable IPv6 leak protection, or disable IPv6 on your device if leaks persist.
- Still leaking? Contact the provider’s support — and if it can’t be resolved, switch to a VPN with proven leak protection.
VPNs that protect against leaks
The best defence is choosing a VPN that ships proper protection: a reliable kill switch, its own private DNS, and leak protection built in. Every provider we recommend includes a kill switch — here are our top-rated picks:
See our best no-logs VPN and best VPN for privacy guides for the full shortlist. Or our set-up guide if you’re just getting started.