With a VPN you might think your internet activities are fully protected. Every site you access, every service you use, all your data is sent through the VPN's secure encrypted tunnel, which will keep it safe from prying But what happens if the VPN connection fails?
Were this to happen, your device might switch to your regular unprotected connection, meaning websites could see your real IP address, Wi-Fi hotspots might see the websites you're accessing, and you’ll lose the protection of the VPN's encryption.
Most VPN providers handle this by offering what’s called a kill switch - although some providers give it a different name, like ExpressVPN's Network Lock or Windscribe's Firewall. In this article we'll explain exactly what a kill switch does, the different types of kill switches available, and how you can make sure your VPN kill switch is set up correctly.
What does a VPN kill switch do?
The idea behind a kill switch is simple. If your VPN connection drops, the kill switch activates and blocks your device's internet access, preventing you from sending out unprotected internet traffic.
Every platform has its own method for this. An Android VPN app might use Android's built-in 'Always-on VPN' setting. You can find this by going to your Settings app, then choosing Network & Internet, and then VPN before choosing your VPN provider. Windows VPNs often use the Windows Filtering Platform (the technology behind Windows Firewall), and Mac and iPhone VPN apps have techniques of their own.
This cross-platform complexity makes it challenging for VPN providers to offer a kill switch on every device type. Keep that in mind if you visit a provider's website and it boasts about having a great kill switch, but doesn't list which platforms it’s available on. Check the rest of the site. The Support pages and knowledgebase should tell you which versions of its app have a kill switch. Mobile devices, especially, often don’t have a kill switch.
After the kill switch activates, no matter its form, your VPN app usually tries to reconnect. Once it can do this successfully, the kill switch deactivates, and your internet access is restored.
Kill switch modes
Although the concept of a kill switch is simple, the reality is more complicated, and many providers and app tackle the issue differently. There are two common approaches.
The most popular type, such as ExpressVPN's Network Lock on Windows, only blocks your internet access if the VPN drops unexpectedly. If you manually disconnect or close the VPN app yourself, the kill switch is disabled, and you're free to browse as usual.
Others (like NordVPN's Windows app) don't allow any internet access at all unless you're connected to the VPN. If you manually disconnect or close the app, you won't be able to get online until the VPN connection is re-established.
Which of these works best for you will depend on your needs.
NordVPN's approach guarantees security but can be a hassle if you need to use your browser and find the VPN is down. You’ll need to reconnect before you can continue your web browsing.
ExpressVPN's approach is more convenient, but also increases the potential security risk, as it's possible you might forget to connect to the VPN before you use the web for something sensitive.
If you can't decide, some providers do support both options. Windscribe's Firewall, for example, defaults to an Automatic mode which works like ExpressVPN's Network Lock, but the Always On option works more like NordVPN and blocks all internet access unless the VPN is connected.
What is an application-level kill switch?
NordVPN and some other providers also offer an application-level kill switch.
This technology monitors everything that’s running on your device and, if it detects a dropped connection, closes the apps you’ve specified. You might tell the VPN app to shut down your browser and torrent client, for instance, to make sure they don't send data over an unprotected connection.
Application-level kill switches don't offer much security. But they're also less likely to get in your way than the other types as they only affect the apps you specify and won't completely block your connection.
If you only need basic protection for one or two apps, an application-level kill switch might be useful. But if you're looking for something more comprehensive, we'd recommend a system-wide kill switch.
Should I use a kill switch?
A kill switch is a last line of defense if your VPN fails, guaranteeing that your online actions remain hidden from others.
But as we've discussed, some kill switches can be a hassle, especially if they don't allow you to access the internet unless you have the VPN connected.
However, if you live in a country where your security and privacy is paramount, if you are, for example, a political activist in a repressive regime where you must protect your identity, access business resources or sensitive sites via public Wi-Fi, download torrents, or carry out any other sensitive operations, then we'd recommend you turn your kill switch on.
If your VPN use isn't so privacy-critical, and you're mostly just using the service to access streaming websites, then a kill switch is likely to be less important to you so you could leave it disabled. There's no harm in at least trying it, though, so we'd turning the kill switch on when you first install the VPN client, and only disabling it if you run into problems or find it interfering too aggressively with your internet activities.
How do I turn on a kill switch?
A kill switch is so important that you might every VPN app would turn it on by default, but that isn't always true. If you think you need a kill switch, or you're just curious to see what your app offers, head off to your VPN Settings and look for relevant options.
Sometimes it's easy to find the right page (NordVPN has a 'Kill Switch' section), but often you'll have to look more closely. ExpressVPN's Windows app has Network Lock settings on its General page; CyberGhost has an Automatic Kill-Switch option in its Privacy Settings, and Surfshark's setting is in its Connectivity menu.
If your app has separate settings per Protocol then check those, too. For example, IPVanish's Mac app has a Kill Switch option on its OpenVPN settings page.
How do I configure a kill switch?
A kill switch is such an important tool for protecting your identity and location that you might expect every VPN app to have it turned on by default, but that often isn’t true. If you think you need a kill switch, or you're just curious to see what your specific VPN app offers, head into your VPN Settings and check out the options.
Sometimes it's easy to find the right section. Surfshark, for example, has you go into Settings, then VPN settings, and there’s a clearly labeled ‘Kill Switch’ section with a toggle to turn it on and off. ExpressVPN's Windows app has the Network Lock settings on its General page, and CyberGhost has an Automatic Kill-Switch option in its Privacy Settings. Proton VPN goes a step further by having the kill switch settings displayed right on the main page of its app GUI, just to the right of the map showing the location you’re connected to.
Some apps may offer separate settings for each protocol so make sure you check those, too. IPVanish's Mac app, for example, has a Kill Switch option on its OpenVPN settings page.
