Audit your VPN kill switch for packet leaks

Quick answer

A VPN kill switch is supposed to cut your internet the instant the VPN connection drops, so your real IP and traffic never leak during the gap. But kill switches fail silently, and you only find out after you’ve been exposed. Here’s how to audit yours properly.

Why the gap matters

VPN connections drop more than people realise — switching networks, server hiccups, sleep/wake, weak Wi-Fi. In the seconds before the VPN reconnects, your traffic can fall back to your normal connection, exposing your real IP. The kill switch’s whole job is to block all traffic during that window. If it doesn’t, you have a leak exactly when you’re least likely to notice.

Step 1: Confirm a clean baseline

Connect your VPN and load our homepage — confirm the IP and location shown are the VPN server’s, not yours. Also run the WebRTC Leak Test to rule out a browser-level leak first, so you’re testing the kill switch specifically.

Step 2: Force a disconnect

With a page open, deliberately break the VPN: kill the VPN app, switch the VPN server, or toggle your network adapter. The kill switch should immediately block all internet — pages should fail to load entirely until the VPN reconnects. If pages keep loading normally during the gap, the kill switch isn’t working.

Step 3: Check your IP during the gap

The decisive test: during a forced disconnect, try to refresh a page showing your IP. With a working kill switch, the refresh fails (no connection). With a broken one, the page loads and shows your real IP — proof traffic leaked. A kill switch that lets any request through has failed.

Step 4: Test the edge cases

Kill switches most often fail on transitions: waking from sleep, switching Wi-Fi to mobile, or reboot before the VPN auto-starts. Test those specifically. Also confirm the setting survives a restart — some reset to off. A kill switch that only works while you’re watching isn’t protection.

If it fails

Enable the kill switch explicitly in your VPN settings (many ship with it off), update the VPN client, and consider a provider with a more robust implementation. Also enable IPv6 leak protection — see identifying DNS, WebRTC & IPv6 leaks, since an IPv6 path can bypass an IPv4-only kill switch.