What a working VPN looks like
- IP and location show the VPN server's country, not yours.
- ISP / organisation is your VPN provider or a hosting company, not your home internet provider.
- WebRTC lists no leaked public IP.
- IPv6 is either "Not detected" or an address you did not see with the VPN off. An IPv6 address that stays the same with the VPN on and off means IPv6 traffic bypasses the VPN.
Test your VPN step by step
- Disconnect the VPN and load this page. Note your IPv4, IPv6 and ISP.
- Connect the VPN and reload the page.
- Compare: every address should now be different. Any address from step 1 that still appears (IPv4, IPv6 or WebRTC) is a leak.
- Check DNS too, using the manual commands on the DNS leak test page.
Common VPN leaks and how to fix them
- WebRTC leak: turn on the VPN app's leak protection or change the browser setting; see the WebRTC leak test page for each browser.
- IPv6 leak: enable IPv6 support or IPv6 leak protection in the VPN, or turn IPv6 off on your network adapter.
- DNS leak: enable the VPN's DNS protection so lookups go through the tunnel.
- Reconnect leak: without a kill switch, traffic falls back to your normal connection whenever the VPN drops. Turn the kill switch on.
- Split tunnelling: if your browser is excluded from the VPN, it uses your real IP. Check the app's split-tunnelling list.
Why a VPN IP may show medium or high risk
VPN servers run in data centers and are shared by many users, so IP reputation databases flag them. A "VPN" or "Data center" result while connected is expected and confirms the VPN is in use; it is not a leak. If a particular site blocks you, try another server. The IP quality check explains each flag.