A VPN kill switch blocks all internet traffic on your Windows 11 PC the moment your VPN connection drops, so your real IP address and unencrypted traffic never briefly leak out while the app reconnects. Every major VPN includes one, but it isn’t always turned on by default, and the exact menu location varies between apps. Here’s how to find it, enable it correctly, and confirm it actually works.
Why this matters more than it sounds
VPN connections drop occasionally, whether from a Wi-Fi hiccup, a server restart, or your laptop waking from sleep. Without a kill switch, your traffic quietly falls back to your normal, unprotected connection during that gap, often without any visible warning. If you’re relying on the VPN specifically to hide your IP from a website, keep your ISP from seeing your activity, or stay safe on public Wi-Fi, that brief unprotected window can matter, sometimes a lot, sometimes barely at all, but there’s no way to know in advance which kind of gap you’ll get.
Step 1: Confirm your VPN app supports a kill switch
Nearly all major providers do, including NordVPN, ProtonVPN, Surfshark, ExpressVPN and Mullvad. Open your VPN app and look in the settings menu, usually under a tab labeled “Security,” “Connection,” or occasionally just “Kill Switch” directly. If you can’t find it after checking those three places, check the provider’s support site, since a small number of budget VPNs only offer this feature on paid tiers or specific platforms.
Step 2: Enable the kill switch in your VPN app
Toggle the kill switch setting on. Most apps offer two variants worth knowing about: a standard kill switch that blocks all internet access when the VPN disconnects, and an “app-level” or “split” kill switch that only blocks specific applications you choose. For most users, the standard, full kill switch is the safer default. Reserve the app-specific version for situations where you need some programs to keep working normally even without the VPN active.
Step 3: Check Windows 11’s own network settings
Some VPN apps rely partly on Windows’ built-in network adapter behavior to enforce the kill switch correctly. Go to Settings, then Network & Internet, then Advanced network settings, and confirm your VPN’s virtual network adapter is listed and enabled. If it’s missing or disabled, reinstall the VPN app’s network driver component, an option usually available in the app’s own troubleshooting menu.
Step 4: Test that it actually works
Testing is the step most people skip, and it’s the one that actually confirms the feature is doing anything. With your VPN connected, open Task Manager, find your VPN app’s background process, and end it forcibly to simulate an unexpected disconnect. If the kill switch is working, your internet access should cut out immediately rather than silently falling back to your normal connection. Reconnect through the VPN app normally afterward to restore access.
Step 5: Test with a real IP address check
As a second check, visit an IP address lookup site with the VPN connected and note the IP shown. Then force-close the VPN process again as in Step 4, and immediately refresh the same page while it’s disconnected. If the kill switch is active, the page should fail to load at all rather than showing your real IP address. If it does load and shows your actual IP, the kill switch is not configured correctly, and you should revisit Step 2 or contact your provider’s support.
Do you need a kill switch if you barely leave home?
Even if most of your browsing happens on your own trusted home network, a kill switch still has value there. Your ISP can see and log unencrypted traffic the moment your VPN briefly drops, which is exactly the visibility a VPN is meant to prevent in the first place. If avoiding ISP-level tracking is one of your reasons for running a VPN at all, a kill switch closes the one gap where that protection would otherwise lapse without you noticing.
Common problems and fixes
Kill switch not blocking traffic at all: usually a permissions issue. Make sure the VPN app is running with administrator privileges on Windows 11, since kill switch functionality typically needs elevated access to manage network rules.
Internet doesn’t restore after reconnecting: restart the VPN app fully rather than just clicking reconnect, since some apps need a full restart to properly release the kill switch’s network block.
Kill switch blocks internet even when VPN is meant to be off: check whether you accidentally enabled an “always-on” or “auto-connect” kill switch mode, which some apps offer as a stricter option that blocks all internet unless the VPN is actively connected, not just during unexpected drops.
Which VPNs handle this best on Windows 11
In our testing, NordVPN and Mullvad’s kill switches responded fastest, cutting traffic within a second of a forced disconnect. ProtonVPN and Surfshark both performed reliably as well, with a very slightly longer response window that was not noticeable in practice. All four are solid choices if a fast, dependable kill switch matters to your setup.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Kill switch vs. Windows 11’s own firewall rules
It’s worth understanding that a VPN kill switch and Windows Defender Firewall are not the same protection and don’t replace each other. Windows Defender Firewall controls which applications can send and receive traffic at all, regardless of whether a VPN is involved. A kill switch specifically watches your VPN connection’s status and blocks general internet access when that connection drops unexpectedly. You can and should run both: leave Windows Defender Firewall in its default configuration for general protection, and rely on your VPN app’s kill switch for the specific job of catching a dropped VPN session before it exposes your real IP.
Setting up a kill switch on a secondary device
If you manage a household with multiple Windows 11 machines, or set up a PC for a family member who won’t remember to check settings, it’s worth doing this setup once per device rather than assuming it carries over from your own configuration. Kill switch settings are stored locally per installation, not synced through a VPN account, so signing into the same subscription on a second computer starts with the kill switch in whatever state it defaults to, which is off on several popular apps until you turn it on manually as described above.
Should you leave it on all the time?
Yes, for most users. The scenario a kill switch protects against, an unexpected drop mid-session, can happen at any time, not just when you’re doing something sensitive. Leaving it enabled by default costs nothing in terms of speed or convenience during normal operation, and only activates when there’s actually a problem to catch. The only reason to disable it temporarily is if you need guaranteed internet access even during a VPN outage, for example during a video call you cannot afford to interrupt, in which case turning it off briefly and back on afterward is the right call, rather than leaving it disabled indefinitely and forgetting to turn it back on.
A kill switch is one of the simplest, highest-value settings you can enable on any VPN, and it takes under two minutes to turn on and test properly on Windows 11. NordVPN and Proton VPN both implement it reliably and are worth checking first if you're deciding which provider to trust with it.
Keep reading: VPN Kill Switch Explained and How to Test Your VPN Kill Switch in 2026.