VPN connection guide · checked 2026-11-03
VPN kill switches: what they do and how to check cautiously
Review VPN kill-switch failure scenarios, including tunnel drops, manual disconnects, split tunneling and network changes, with a cautious check and clear limits.
What does a VPN kill switch do?
A kill switch is a traffic-blocking control intended to stop some or all covered traffic from using the ordinary internet connection when a VPN tunnel fails. The exact scope and trigger depend on the VPN app, operating system, settings, and traffic-routing exceptions. Android's system setting called Block connections without VPN can block network traffic that does not use the VPN.
Why can an intentional disconnect behave differently?
Some app controls activate only after an unexpected tunnel failure. For example, Proton documents that its standard kill switch activates on accidental drops, while its advanced option stays active unless the device is connected to Proton VPN. Other providers and platforms may use different behavior, so check the current instructions for the app and operating system you use.
Which failure scenarios should I check separately?
Read your current provider and operating-system instructions for each case: an accidental tunnel drop; a manual disconnect or quitting/restarting the VPN app; an app excluded through split tunneling; and a reboot or network change while reconnecting. A control can cover these cases differently. For example, Proton documents platform-specific kill-switch behavior and says split tunneling is incompatible with its kill switch on most platforms, with a Windows exception. Android separately documents Always-on VPN and blocking connections without VPN. These examples do not establish how another provider or device behaves.
How can I make a cautious check?
First read your VPN provider's current kill-switch instructions and identify whether its control covers accidental drops, manual disconnects, selected apps, or all traffic. On a non-sensitive task, connect the VPN and note the public IP using a separate reputable test page. If you want to observe a real network change, use an ordinary Wi-Fi-to-cellular handoff and watch the VPN app's connection status and whether a fresh page can load; do not force-quit the VPN, disable system protections, or use sensitive accounts or data for the check. Stop if connectivity behaves unexpectedly and reconnect the VPN before continuing.
Why might a browser check be hard to interpret?
A browser can make automatic connections for reasons other than a page load you initiated. Mozilla documents examples including update checks, prefetching, and diagnostics in Firefox. A browser check is therefore only an observation of that browser at that moment; it is not an inventory of all device traffic or a full kill-switch audit. Do not disable browser security or update features to make a test simpler.
What does the check prove?
Nothing conclusive about all traffic. A browser result only observes that browser and moment; it may miss other apps, DNS behavior, excluded traffic, brief gaps, or different failure conditions. A Wi-Fi-to-cellular handoff is not the same as every possible tunnel failure. A changed IP or a page that stops loading is an observation, not a guarantee that the kill switch always blocks uncovered traffic.
What should I do if traffic still works after the VPN drops?
Do not use the result as assurance that traffic is blocked. Reconnect the VPN, review system and app settings plus split-tunneling exceptions, and consult the provider's documentation or support. On Android, check whether Always-on VPN and Block connections without VPN are available for that profile; menu options depend on the device and VPN app. For a managed work or school device, ask its administrator before changing policy.
Does a kill switch make me anonymous?
No. It is a connection-failure control. It does not remove account identifiers, cookies, browser signals, device compromise, or information you submit to a site. See the VPN visibility guide for what a VPN changes and what remains visible.