What VPNs protect and what they do not
A VPN is useful for protecting a network path, but it is not a complete security solution. It helps most when you understand what it protects, what it cannot protect, and which settings deserve attention.
What VPNs can protect
This article covers encrypted remote-access VPNs. They protect the device-to-VPN-server leg of traffic routed through the tunnel. Apps or destinations excluded from that route do not receive this protection.
Common benefits
- On public Wi-Fi, it makes traffic harder for nearby attackers on the same network to inspect.
- For internet traffic routed through a VPN exit, destinations see the exit-side IP address.
- A company VPN gives remote users a protected path into internal systems.
- It may hide some destination details from local network operators or Wi-Fi providers.
Keep using HTTPS
HTTPS encrypts the browser-to-site connection even without a VPN. Public Wi-Fi therefore does not make every password visible merely because a VPN is absent. A VPN does not replace HTTPS, and neither protects information you hand to a phishing site. Check the destination and do not ignore certificate warnings.
What VPNs do not solve by themselves
VPNs mainly protect the path. They do not automatically protect everything you type into a site or the device itself.
Needs separate protection
- Phishing pages where you enter your ID and password yourself.
- Names, email addresses, payment data, and other information you give to the service.
- Tracking through cookies or logged-in accounts.
- Malware or risky browser extensions already on the device.
- Plain HTTP traffic: VPN encryption does not continue from the VPN exit to the website.
You are trusting the VPN provider
For tunneled traffic, the VPN provider can observe destination IPs and traffic volume in place of the access provider. This does not normally let it read HTTPS content when certificate validation works correctly. See what others see when you use a VPN.
Things to check
- What connection or usage logs are stored, and for how long.
- Check the operator, jurisdiction, audit scope, and transparency reports. A no-logs label or an audit does not guarantee every future action.
- With free VPNs, consider advertising, data usage, speed limits, and whether the operator is clear.
DNS leaks, WebRTC leaks, and split tunneling
Even while connected to a VPN, some information can escape outside the tunnel depending on settings and app behavior. The related options are summarized in VPN configuration types.
Common points to watch
- DNS leak: name lookups go to the normal network DNS, leaving clues about destinations.
- WebRTC leak: browser and routing choices may expose IPs beyond the usual web connection. A displayed private IP alone does not prove exposure of your original public IP or message contents.
- Split tunneling: routes or apps determine which traffic uses the VPN. An intentional exclusion is not necessarily a fault.
- Kill switch: blocks traffic outside the VPN on disconnection or other covered events. Check startup, reconnection, IPv6 coverage, and exclusions for the particular product.
Company VPNs and personal VPNs have different goals
The word VPN is used for both, but company VPNs and consumer VPN services are designed for different jobs.
How to think about them
| Type | Main purpose | Note |
|---|---|---|
| Company VPN | Secure access to internal company systems | Follow company policy and logging rules. |
| Personal VPN | Public Wi-Fi protection, path protection, and changing visible IP | Check provider trust and app settings. |
Takeaway
- A VPN is a useful protection layer, not complete anonymity or total defense.
- Use it together with account hygiene, two-factor authentication, OS updates, and phishing awareness.
- Separate what the VPN protects from what needs other controls.
Specifications and official guidance
FTC: Public Wi-Fi safety / RFC 8446: TLS / RFC 8828: WebRTC IP handling / Microsoft: VPN routing