You connect your VPN, the app says "Connected," and you assume you're protected. Unfortunately, a VPN can show a green light while still leaking the very things it's supposed to hide — your real IP address, your DNS requests, or your true location. The good news is that verifying it works takes about five minutes and no special tools.
Here are five checks, from the most important to the most thorough.
Test 1: Does your public IP actually change?
This is the fundamental one. If your VPN is working, the public IP address the internet sees should be the VPN server's, not yours.
- Before connecting, open the Check My Setup homepage and note your public IP and the city/ISP shown.
- Connect your VPN, ideally to a server in a different country.
- Reload the page. Your IP should now be different, and the location and ISP should match the VPN provider, not your home connection.
If the IP didn't change, your VPN isn't routing traffic at all — stop here and fix the connection before worrying about anything else.
Test 2: Check for a DNS leak
This is the leak that catches people out. Even with your IP hidden, your device might still send DNS requests — the lookups that turn example.com into an IP address — to your ISP's servers instead of through the VPN tunnel. If it does, your ISP can still see every site you visit, which defeats much of the point.
A good VPN routes DNS through its own servers. To check, run a DNS leak test (several reputable free ones exist). What you're looking for: the DNS servers reported should belong to your VPN provider or a neutral resolver in the VPN's location — not your home ISP. If you see your ISP's name in the DNS results while connected, you have a DNS leak.
Many VPN apps have a "DNS leak protection" toggle. If yours leaks, enable it, or switch your system DNS to a provider like a public resolver.
Test 3: Check for a WebRTC leak
WebRTC is a browser feature for real-time audio and video. It has a long-standing quirk: it can reveal your real IP address directly to a web page, bypassing the VPN entirely, even when everything else is routed correctly. This mainly affects browsers, not apps.
To test, use a WebRTC leak checker while connected. If it shows your real public IP (the one from Test 1, before you connected), you have a leak. Fixes include:
- Using your VPN provider's browser extension, which often blocks WebRTC leaks.
- Disabling WebRTC in your browser, or installing an extension that does.
- Using a browser that lets you turn the feature off in settings.
Test 4: Confirm the location looks right
Once connected, check that the location shown matches the server you chose. Open the homepage again and look at the city and country. If you connected to a server in Amsterdam but the page shows your home city, something is routing around the tunnel — revisit Tests 1 and 3.
Keep in mind that city-level geolocation is only right about half the time even when everything works, so don't panic if the city is slightly off. The country and the ISP/provider name are the reliable signals. The provider should read as a hosting or VPN company, not your home ISP.
Test 5: The kill-switch test
A kill switch is meant to cut your internet if the VPN connection drops, so you're never accidentally exposed. It's worth confirming yours actually works.
With the VPN connected and a page open showing the VPN's IP, forcibly disconnect the VPN (quit the app or kill the connection) and immediately reload. With a working kill switch, the page should fail to load — no internet at all. Without one, the page will load and show your real IP, meaning you'd have been exposed during any real-world drop. If your VPN has a kill-switch setting, turn it on and test again.
How often should you check?
Run Tests 1 and 2 whenever you start relying on a VPN for something that matters, and after any major VPN app or operating system update — updates occasionally reset leak-protection settings. The others are worth doing once when you first set up a provider.
A realistic note on what a VPN does and doesn't do
Passing all five tests confirms your VPN is hiding your IP, location, and DNS from the sites and networks you touch. It does not make you anonymous. You're still logged into accounts, still carrying cookies, and still identifiable by browser fingerprinting. A VPN is one layer, not a cloak. For the honest picture of what the technology conceals and what it leaves exposed, read how VPNs actually work.
The takeaway
"Connected" is not the same as "protected." Five quick checks — IP change, DNS leak, WebRTC leak, location, and kill switch — tell you whether your VPN is doing its job. The first two take a minute and catch the most common failures.
Start with the simplest check right now: note your IP on the homepage, connect, and reload.