How to tell if your VPN is leaking

A short checklist, and what each result actually proves.

A VPN is "working" when every part of your connection that a website can observe points at the VPN server instead of at you. A leak is when one of those parts slips through and exposes your real address, location, or DNS provider. Here is how to check, using the values on the ShittyRobots.com front page plus a couple of extra steps.

1. Do the before-and-after

Load the front page with the VPN off and note the IP address and the city / region / ISP under Location & ISP. Connect the VPN, reload, and look again. The IP must change, and the location and ISP should now match the VPN server's country and provider (often a hosting company, not a consumer ISP). If any of those still show your real values, the tunnel is not carrying your web traffic at all — check that the VPN says connected and that it is not in a "split tunnel" mode that excludes your browser.

2. Check the VPN / proxy flags

With the VPN on, the Hosting / Datacenter IP row will usually read yes, because VPN servers live in datacenters, and VPN / Proxy / Tor often reads detected. Neither is required for the VPN to be protecting you — smaller providers are not on every list — but seeing your real residential ISP here instead is a red flag that nothing is being tunneled.

3. Look for an IPv6 leak

Many VPNs only route IPv4 and either block or ignore IPv6. If your connection has IPv6 and the VPN does not handle it, sites can still reach your real IPv6 address. On the front page, if the IP shown is an IPv6 address (colons, like 2606:4700:...) that traces back to your real ISP while the VPN is on, that is an IPv6 leak. Fixes: enable "IPv6 leak protection" in the VPN app if it has one, or disable IPv6 on the operating system while using the VPN.

4. Check for a DNS leak

DNS is the lookup that turns a hostname into an IP. If those lookups go to your ISP's resolver instead of through the VPN, your ISP still sees every domain you visit even though your traffic is encrypted. The ShittyRobots front page does not test DNS directly; use a dedicated DNS-leak test and confirm the resolver shown belongs to the VPN (or a public resolver the VPN uses), not to your ISP. Most modern VPN apps handle this automatically, but browser "secure DNS" / DNS-over-HTTPS settings can override it.

5. Check for a WebRTC leak

WebRTC is a browser feature for real-time audio and video. It can ask the operating system for your local and public IP addresses directly, bypassing the page's normal connection — which means a site can sometimes learn your real IP even through a VPN. Use a WebRTC-leak test; if it shows a public IP that is not the VPN's, install a WebRTC-blocking extension or disable WebRTC in the browser.

6. Sanity-check timezone and language

These come from your device, not your connection, so a VPN does not change them — and that is the point. If you are trying to appear to be in another country, a browser timezone of America/Chicago next to a VPN IP in Germany is an obvious mismatch to any site that looks. This is not a "leak" of your IP, but it is a deanonymizing signal.

What a clean result looks like

VPN on: the IP is the VPN server's, on both IPv4 and IPv6; Location & ISP show the VPN's country and a hosting provider; Hosting / Datacenter IP reads yes; a separate DNS-leak test shows the VPN's resolver; a WebRTC test shows either nothing or only the VPN IP. If all of those hold, your VPN is doing its job.

If something leaks

Enable the kill switch (blocks traffic when the tunnel drops) and any leak-protection toggles in the VPN app, turn off browser secure-DNS so it does not override the VPN, add a WebRTC block, and disable OS-level IPv6 if your VPN does not support it. Re-run the checks after each change.

← Previous: How to check if a port is open
← Back to the diagnostics tool