Last updated: October 2026
A VPN app that says "Connected" is not proof that your traffic is protected. Apps can fail quietly: your real IP address can still show up, DNS requests can still reach your internet provider, or the tunnel can drop and your phone carries on without it. The good news is that you can check in about five minutes with free tools. This guide gives five warning signs, the test for each, and what to do next, with notes on how iPhones behave differently.
- Your public IP address does not change when you connect.
- A DNS leak test lists your internet provider's servers.
- A WebRTC or IPv6 test shows your real address.
- The VPN drops and your real IP appears before it reconnects.
- Your apparent location or speed behaves as if the VPN were off.
Run the tests below with the VPN off, then on, and compare.
Before you start: the 2-minute test routine
- With the VPN off, open an IP checker such as whatismyipaddress.com or ipleak.net and write down your IP and location.
- Connect the VPN to a server in another country.
- Run the tests below and compare the results with your notes.
Prefer independent tools over a VPN company's own checker where you can. NordVPN, ExpressVPN and others publish their own leak tests, and those pages are marketing as well as tools. The same applies to the guides themselves: NordVPN, Norton and Internxt sell VPNs, so this article uses their test methods, which are standard, but not their product claims.
Sign 1: Your IP address does not change
Test: check your IP before and after connecting. According to Norton's guide (updated May 25, 2026), a working VPN shows a different IP address and a location that matches the server you chose. NordVPN's guide (October 16, 2026) says the same, and TechRepublic says that if the checker shows an address other than the VPN server's, your real address may be exposed.
If it fails: disconnect, reconnect to another server, restart the app, and test again. If the IP still does not change, the app is not routing your traffic. Try another protocol in the app settings, or contact the provider.
Sign 2: A DNS leak test shows your internet provider
DNS is the lookup that turns a website name into an address. If those lookups bypass the VPN, your internet provider can still see which sites you visit, even if the content is encrypted.
Test: run the Standard Test at dnsleaktest.com with the VPN on. Security.org's guide (updated September 17, 2026) says a pass shows an IP that differs from your real one, and a fail shows an IP that matches it. Norton adds that any DNS server not provided by your VPN service indicates a leak. NordVPN's version says the servers listed should match your VPN connection, not your ISP.
If it fails: switch protocol, update the app, and test again. Windscribe's iPhone troubleshooting guide, which is vendor-published, also suggests switching from IKEv2 to WireGuard and turning off iCloud Private Relay and Limit IP Address Tracking to avoid DNS leaks.
Sign 3: Your browser or IPv6 address gives you away
WebRTC test: WebRTC is a browser feature for calls that can reveal an IP address. Open browserleaks.com/webrtc with the VPN on. Security.org and Internxt both say the IP shown should be the VPN's, not yours. Internxt notes Chrome, Firefox and Edge are affected.
IPv6 test: NordVPN's guide recommends running an IPv6 leak test before and after connecting. A pass means your original IPv6 address no longer appears (or a VPN-assigned one appears). Security.org's article does not cover IPv6, so use at least one more source for this check.
Browser extensions: Norton suggests turning the VPN on, disabling all extensions, checking your IP, then re-enabling extensions one at a time. If your real IP appears after enabling one, that extension is the cause.
If it fails: use the VPN app rather than a browser extension, update your browser, and retest. On iPhone, Windscribe's guide says Safari can expose a local IP via WebRTC and suggests trying a privacy-focused browser, but that is a vendor suggestion.
Sign 4: The VPN drops and your real IP shows
A kill switch blocks internet traffic when the VPN connection drops. Internxt's test: briefly turn off Wi-Fi, reconnect, and immediately reload an IP check page to see whether your real IP appears. Windscribe suggests starting a stream, force-quitting the VPN app and seeing whether the stream keeps playing.
The iPhone catch. Proton's disclosure says that when a VPN connects on iOS, existing connections are not closed, so some stay outside the tunnel for minutes or hours. Apple did not call the VPN-exempt traffic a bug; the Proton article reports Apple describing it as "expected" and pointing to Always On VPN, which Apple's own guide (published January 28, 2026) says requires a device managed by a device management service and supervised through Apple Configurator, Apple School Manager or Apple Business Manager. In other words, a normal personal iPhone cannot use Always On VPN. Proton's own support page says some DNS requests from Apple services can bypass the VPN even with its kill switch on, and that its advanced iOS kill switch is in beta.
A more recent report: PrivacySavvy (April 27, 2026) describes research by Mysk showing an iPhone's real IP address briefly exposed while the App Store updated a VPN app, tested on iOS 26.4.2. It says Apple has not fixed the issue and that Mullvad added a "Force all apps" option as a mitigation that carries its own risks. I have not independently reproduced it, so treat it as a report, not a lab result.
What to do: after connecting on iPhone, turn on Airplane Mode for about ten seconds, then turn it off. Proton and Windscribe both describe this as a way to force apps to reconnect through the tunnel, though neither guarantees it. Also avoid updating your VPN app while connected to anything sensitive, and check that Low Power Mode and Low Data Mode are not cutting the connection; Windscribe says sleep and Low Power Mode can suspend a VPN. For other battery and privacy switches, see 10 iPhone settings you should change.
Sign 5: Location or speed behaves as if the VPN were off
Two softer signs, which are weaker evidence than a leak test:
- Speed. Run speedtest.net with the VPN off, then on. Norton says a slight drop in speed and a slight rise in ping is normal; no change at all may mean the VPN isn't working, while extreme slowness may point to a server problem or an antivirus or firewall conflict. TechRepublic adds that a much faster result without the VPN may mean the server is too far away.
- Region-locked content. If a streaming site still shows your home catalog, the location change may not be working, or the service may be blocking that VPN. TechRadar's free-versus-paid guide notes that even paid VPNs are not guaranteed to unblock services, so test during a refund window and try other servers before concluding the VPN is broken.
Pass/fail cheat sheet
| Test | Where | Pass | Fail |
|---|---|---|---|
| IP address | whatismyipaddress.com, ipleak.net | Different IP and location from your real one | Your real IP still shows |
| DNS leak | dnsleaktest.com (Standard Test) | Only your VPN provider's servers | Your ISP's servers appear |
| WebRTC | browserleaks.com/webrtc | VPN IP only | Your real IP appears |
| IPv6 | Any IPv6 leak test, before and after | Original IPv6 gone | Original IPv6 visible |
| Kill switch | Toggle Wi-Fi, reload IP page | No real IP shown | Real IP shows briefly |
Catches and limits
- "Connected" is not a test. NordVPN's own guide says the connected status alone does not confirm the VPN is working.
- A passing test is a snapshot. It tells you the VPN worked at that moment, not that it will always hold.
- Leak tests do not check the provider. A VPN can pass every test and still log your activity. Check the provider's privacy policy and any independent audit as well.
- Hotspots bypass the VPN. Windscribe says devices connected to your iPhone's hotspot bypass the VPN by default; I could not confirm this on an independent page.
FAQ
How often should I test my VPN?
After installing it, after major iOS or app updates, and any time you notice odd behavior. The tests take a few minutes.
My IP changed but the DNS test shows my ISP. Is the VPN broken?
It is partly leaking. Change protocol, update the app and retest; if it persists, ask the provider or switch.
Can a free VPN pass these tests?
Some can. These tests do not measure logging or ownership, which is where free apps carry the most risk.
Does Airplane Mode fix leaks permanently?
No. It forces apps to reconnect once; it does not change how iOS handles the VPN in future.
My verdict
Run the IP, DNS and WebRTC tests once after you set up any VPN, and again after big updates. If anything fails, fix it or change provider before relying on it. On iPhone, add the Airplane Mode reconnect step and remember that personal devices cannot use Apple's Always On VPN, so the kill switch is best treated as a best-effort feature. For another safety setup worth doing on the same phone, see how to set up iPhone Emergency SOS.
What I could not verify: the live version of this post, Apple's own statement on iOS VPN traffic handling beyond the Always On VPN guide, the NVD record for the 2024 VPN CVE (the page did not load), or whether the April 2026 Mysk report is fixed in iOS 27. I did not run any of these tests on a VPN myself.
Sources: Security.org: How to check if a VPN is working | TechRepublic: How to tell if your VPN is working | NordVPN: 5 tests (vendor source) | Norton: 7 tests (vendor source) | Internxt: 4 tests (vendor source) | Proton VPN: Apple iOS vulnerability disclosure | Proton VPN: Kill switch | Apple Platform Security: VPN security | PrivacySavvy: iOS VPN flaw during app updates | Windscribe: Common VPN problems on iPhone (vendor source) | TechRadar: Free vs paid VPNs