Most VPN users flip the kill switch toggle once and never check it again. That’s a problem, because a kill switch that silently fails to fire is worse than having none at all: you keep browsing, assuming you’re protected, while your real IP leaks out in the background. This guide walks through enabling the kill switch in the apps people actually use, then shows you the exact test to confirm it works.

If you’re not sure what a kill switch does or why it matters in the first place, read our explainer on what a VPN kill switch is first. This article assumes you already know the concept and just want it turned on and verified.

How to enable the kill switch in your VPN app

The setting lives in roughly the same place across most VPN apps: your app’s settings, under a tab called Connection, Security, or Network. Look for the words “Kill Switch” or “Network Lock.” A few providers split it into two separate options, one for the whole system and one for specific apps, so check for both before assuming you’re covered.

NordVPN: open Settings, then Kill Switch. NordVPN separates Internet Kill Switch (blocks all traffic system-wide) from App Kill Switch (blocks only the apps you list). Turn on Internet Kill Switch for full coverage.

ExpressVPN: the Network Lock setting sits in the app’s general Preferences or Settings menu. It’s a single system-wide toggle, no split between app-level and system-level modes.

ProtonVPN: go to Settings, then Kill Switch. Proton offers Standard (blocks traffic while the app is running) and Permanent (blocks traffic even when the app is fully closed), available on Windows, macOS, Linux, and Android.

Surfshark: Settings, then Connectivity, then Kill Switch. Surfshark also has a Strict Mode variant for stronger always-on enforcement.

All four of these providers, NordVPN, ExpressVPN, ProtonVPN, and Surfshark, ship a working kill switch as a core feature, not an add-on. If your provider doesn’t have one at all, that’s reason enough to look elsewhere.

NordVPN is a reasonable default pick here: the Internet Kill Switch setting is one toggle, it’s on by default for new installs on some platforms, and it held up cleanly in every disconnect test we ran while writing this guide.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

Why enabling it isn’t enough

A toggle switching from off to on tells you the setting saved. It tells you nothing about whether the underlying firewall rule actually engages the moment your tunnel drops. Kill switches fail in the real world for reasons that never show up in a settings screen: a firmware update changes how your network adapter reports its state, a VPN app update introduces a regression, or the kill switch only catches graceful disconnects and misses a sudden crash. The only way to know your setup is safe is to force a failure and watch what happens.

How to test your VPN kill switch step by step

This test simulates the exact failure a kill switch exists to catch: your VPN dying mid-session without warning. Do this on a connection where a brief interruption doesn’t matter, not in the middle of something time-sensitive.

Step 1: Connect and record your baseline

Connect to your VPN as normal. Open a browser and visit an IP-checking site such as ipleak.net or whatismyipaddress.com. Write down the IP address and location shown. This should match your VPN server, not your real location. If it already shows your real IP at this stage, stop, your VPN isn’t routing traffic correctly and the kill switch test won’t tell you anything useful yet.

Step 2: Start a continuous connectivity check

Open a terminal or command prompt and start a continuous ping to a stable public server, for example ping 1.1.1.1 -t on Windows or ping 1.1.1.1 on macOS/Linux. This gives you a live, second-by-second view of whether your device has internet access at all, which is more precise than repeatedly reloading a webpage.

Step 3: Kill the VPN connection abruptly

Now force the disconnect in a way that mimics a real failure rather than a clean shutdown. Options, roughly in order of how realistic they are:

  • Turn off Wi-Fi entirely, then turn it back on within a few seconds, without touching the VPN app.
  • Open Task Manager (Windows) or Activity Monitor (macOS) and force-quit the VPN application process directly, rather than clicking Disconnect inside the app.
  • Disable the network adapter in your operating system’s network settings for a few seconds.

Force-quitting the process or killing Wi-Fi is the more honest test. Clicking the app’s own Disconnect button lets the app shut down its own kill switch gracefully in some implementations, which can hide a bug that only shows up during a true crash.

Step 4: Watch what happens in the ping window

If the kill switch is working, the ping window should show requests timing out or failing entirely the moment the VPN drops, and stay that way until the VPN reconnects. If pings keep succeeding while the VPN is down, your traffic is falling back to your normal, unprotected connection, and the kill switch did not engage.

Step 5: Reconnect and check for a leak

Once you’ve observed the ping behavior, go back to the browser tab from Step 1 and refresh the IP-checking site. Two outcomes are meaningful here. If the page fails to load at all while the VPN is still down, that’s the expected behavior. If the page loads and shows your real IP address instead of an error or your VPN’s IP, the kill switch failed silently during the drop, exactly the scenario it’s supposed to prevent.

Step 6: Repeat with a second method

Run the test twice using two different disconnect methods (for example, killing the app process, then separately disabling the network adapter). Some kill switch implementations catch one failure mode but not the other. A pass on the first method doesn’t guarantee a pass on the second.

Reading your results correctly

Pass: internet access stops completely the instant the tunnel drops, and the IP checker either fails to load or shows an error, not your real address, for the whole time the VPN is disconnected.

Partial fail: the kill switch engages, but with a lag of a second or two where a request might slip through. This matters most for torrenting, where even a brief window can expose your IP to peers. If you see this, check whether your app has a stricter mode (Surfshark’s Strict Mode, Proton’s Permanent setting) and enable it.

Full fail: traffic keeps flowing after the VPN disconnects and the IP checker shows your real address. This means the kill switch either isn’t actually enabled, despite the toggle showing on, or your provider’s implementation doesn’t cover the disconnect method you tested. Reinstall the app, confirm the setting again, retest, and if it still fails, treat that as a sign to switch providers.

When to rerun this test

Don’t treat a single passing test as permanent. Rerun it after any VPN app update, after any operating system update (Windows and macOS both occasionally change how network adapters report state to third-party apps), and after switching to a new device. If you use your VPN mainly for Windows 11, it’s worth running this test right after initial setup while you’re already in the settings, rather than assuming the default configuration is safe.

Our verdict: Enabling a kill switch takes one settings toggle, but confirming it works takes the five-minute test above, and skipping that step is the difference between assuming you’re protected and knowing it. NordVPN, ExpressVPN, ProtonVPN, and Surfshark all passed our force-disconnect test cleanly. Run the test yourself after setup, after every app update, and again if you switch networks or devices, since a kill switch that isn’t tested is just a checkbox you’re trusting blindly.