VPN Kill Switch UK 2026: How It Works & How to Test It

A VPN kill switch blocks internet traffic when the protected VPN connection fails, helping prevent the device from falling back to its normal broadband, Wi-Fi or mobile-data route. It is an important backup control, but not every kill switch behaves in the same way. A standard kill switch normally reacts to an unexpected connection loss. An advanced or always-on mode blocks traffic whenever the VPN is inactive, including after a deliberate disconnect. That distinction matters when choosing a VPN and when testing whether the feature works. Fact-checked: 9 August 2026

Table of Contents

VPN kill switch: quick verdict

Best all-round documented controls: ExpressVPN. Its standard Internet Kill Switch is enabled by default, covers the main desktop and mobile platforms, and current Windows, macOS and Linux apps include an advanced Enable at all times mode.

Best app-level control: NordVPN. Its Windows app can block the whole internet connection or close selected applications when the VPN disconnects.

Best free option: Proton VPN Free. Proton documents kill-switch support across all free and paid plans; advanced always-on behaviour is available on Windows and Linux.

Important: These conclusions compare current provider documentation and available controls. No new TheBestVPN.uk packet-capture or leak-test record was supplied for this refresh, so this article does not invent pass rates or promise that any implementation can never fail.

Check Current UK Price

ExpressVPN: Strong All-Round Kill-Switch Controls

Standard protection is enabled by default, with an advanced always-on mode on current Windows, macOS and Linux apps. Check the current plan and renewal terms before subscribing.

What is a VPN kill switch?

A VPN creates an encrypted tunnel between a device and the VPN provider's server. Websites normally see the server's public IP address while that tunnel is active. If the VPN connection fails, the operating system may return traffic to the ordinary internet connection unless another control blocks it.

Diagram explaining what a vpn kill switch does — Vpn kill switch uk 2026: how it works & how to test it 1

The kill switch is designed to stop that fallback traffic. Depending on the provider and operating system, it may use firewall rules, network filters or application controls to block communications until the VPN reconnects or the user changes the setting. Providers use different names. ExpressVPN calls its feature the Internet Kill Switch; older versions used the name Network Lock. Other apps may use terms such as Kill Switch, Advanced Kill Switch, Permanent Kill Switch or Always-on VPN. The name matters less than the connection states it actually covers.

Standard, always-on and app-level kill switches

Kill-switch type	What it normally blocks	Best fit	Main limitation
Standard	Traffic after an active VPN connection drops unexpectedly	Everyday users who sometimes disconnect the VPN deliberately	A manual disconnect may restore the normal internet connection
Advanced or always-on	Traffic whenever the VPN is inactive, including manual disconnects	Users who do not want the device online without the VPN	Can block captive portals, updates, sign-in and troubleshooting until disabled
App-level	Selected applications, which may be closed or blocked after a VPN failure	Specific programs that should never continue outside the tunnel	Other applications may retain ordinary internet access
Operating-system control	System-wide traffic using tools such as Android's Always-on VPN and Block connections without VPN	Mobile users who want an OS-enforced rule	Menu availability and behaviour depend on the device and Android version

Editorial recommendation: Use the standard mode if you regularly choose to browse without a VPN. Use the always-on mode if an accidental unprotected connection would create a material problem. Do not enable a stricter mode without knowing how to regain internet access if the VPN app fails to start.

How does a VPN kill switch work?

The VPN app establishes a protected network interface and sends eligible traffic through it. The kill switch monitors whether that route remains available. When the tunnel fails, the control applies a network rule before ordinary traffic can use the physical Wi-Fi, Ethernet or mobile-data interface.

Diagram showing internet traffic blocked after a vpn connection fails — Vpn kill switch uk 2026: how it works & how to test it 2

A standard mode usually becomes active only after a successful VPN connection has been established. An always-on implementation applies a more persistent rule: internet access is unavailable unless the approved VPN interface is active. Some advanced desktop implementations retain this rule after the app closes or the computer restarts. Local network access is a separate decision. A strict rule may also block printers, network storage, casting devices and router-management pages. Several VPN apps provide an Allow LAN traffic or similar setting, but allowing local traffic creates an intentional exception to the system-wide block.

What a VPN kill switch protects, and what it does not

A working kill switch can reduce the risk of the ordinary public IP address and DNS requests leaving through the normal internet connection during a VPN interruption. This is useful when moving between Wi-Fi and mobile data, waking a laptop, changing networks, switching VPN servers or recovering from an unstable connection. It is not a complete privacy or security system. A kill switch does not:

make a user anonymous after signing into an identifiable account;
remove cookies, browser fingerprints, advertising identifiers or GPS permissions;
protect a compromised device from malware;
make an unsafe file harmless;
verify a provider's no-logs claim;
recover information already sent before the block applied; or
make unlawful activity legal or override a website's terms.

Best VPN kill-switch controls compared

The table compares documented behaviour, not overall VPN quality. Platform details change, and two apps from the same provider can behave differently on Windows, macOS, Android, iOS and Linux.

Provider	Documented kill-switch behaviour	Best for	Important limitation
ExpressVPN	Standard mode is enabled by default across the main apps; advanced always-on mode on Windows, macOS and Linux	Strong all-round desktop and mobile coverage	Standard mode does not block traffic after a deliberate disconnect
NordVPN	Windows offers an Internet Kill Switch and an App Kill Switch; controls differ on macOS, iOS, Android and Linux	Closing or blocking selected applications	Exact features depend on the operating system and macOS app version
Proton VPN	Standard mode on free and paid plans; advanced persistent mode on Windows and Linux; Android can use OS-level blocking	Free protection and clearly separated standard or advanced modes	Proton documents macOS and iOS limitations, including some Apple-service DNS behaviour
Private Internet Access	Standard Windows kill switch is enabled by default; Advanced Kill Switch can require the VPN even when the PIA app is closed	Advanced Windows users and detailed configuration	Mobile behaviour differs; PIA says its iOS switch does not apply after a manual disconnect
Surfshark	Kill Switch is documented for Windows, macOS, Android, iOS and Linux	Simple protection across many household devices	Current public support guidance does not document the same persistent or app-level choices as the providers above

Which is best? ExpressVPN provides the most balanced documented implementation for ordinary UK users. NordVPN is more flexible when only selected applications should stop. Proton VPN is the clearest free choice and a strong advanced option on Windows or Linux. PIA is attractive when persistent desktop rules and granular settings matter more than simplicity. For overall service quality, pricing, privacy evidence, UK locations and everyday use, compare the site's best VPNs for UK users. A kill switch is one selection criterion, not enough by itself to determine the best VPN.

How to test a VPN kill switch properly

Do not judge a standard kill switch only by pressing the VPN app's Disconnect button. Several providers intentionally allow ordinary internet access after a deliberate disconnect. That result can be correct in standard mode and would be a failure only if an always-on mode was enabled.

Identify the mode. Check whether the app is set to standard, advanced, permanent, always-on or app-level protection.
Record the environment. Note the operating system, VPN app version, protocol, server location and test date. Results can change after an app or OS update.
Check the normal connection privately. Before connecting, use a reputable IP and DNS checker to identify the ordinary route. Do not publish or share screenshots containing the full address.
Connect to the VPN. Confirm the visible public IP changes to the VPN location and review the DNS result. A browser check confirms the browser route only.
Test manual disconnect behaviour. In always-on mode, deliberately disconnecting should leave fresh web pages unable to load. In standard mode, ordinary access may return by design.
Test an unexpected interruption. Keep the VPN app open, briefly turn Wi-Fi off or unplug Ethernet, then restore the underlying network. Immediately try to load a new page. Traffic should remain blocked until the VPN reconnects.
Test a server change. Switch between two VPN locations while loading a fresh page. Check that the ordinary public IP does not appear during the transition.
Test persistence if promised. For an advanced desktop mode that claims to survive app closure or restart, close and reopen the app or restart the device. Confirm that internet access remains blocked until the VPN is active.
Repeat after material changes. Retest after changing protocol, reinstalling the VPN, updating the operating system or altering split-tunnelling rules.

Testing limitation: A page that fails to load is useful evidence, but not a complete packet-level test. A rigorous site-owned result should monitor IPv4, IPv6 and DNS traffic across connection loss, server changes, sleep and wake, network switching and app crashes. This article does not claim that those laboratory checks were completed.

How to enable a VPN kill switch

Install the provider's full VPN application, open its connection, privacy or network settings, and enable the kill-switch option. A browser extension usually protects browser traffic only and cannot enforce a system-wide rule for other desktop applications.

ExpressVPN: Open Profile > Settings > Internet Kill Switch. Choose Enable when connected for standard protection or Enable at all times on supported desktop apps.
NordVPN: Open Settings and select Kill Switch. On Windows, choose the Internet Kill Switch or add programs to the App Kill Switch.
Proton VPN: Open Kill Switch from the sidebar or connection settings. Choose Standard or Advanced where the app offers both.
PIA: Open Settings and select Privacy. The normal switch is enabled by default on Windows; Advanced Kill Switch is a separate option.
Surfshark: Open Settings, select VPN settings and enable Kill Switch.
Android: Where supported, open the system VPN settings and enable Always-on VPN plus Block connections without VPN.

Menu names can change. Check the provider's current instructions for the installed app rather than relying on a screenshot from another operating system or an older release.

When should you disable the kill switch?

Leaving the feature enabled is sensible when unprotected fallback traffic is a concern. Temporary disabling can be necessary to complete a hotel, airport or café Wi-Fi sign-in page, troubleshoot a failed VPN connection, access a local printer, or complete an operating-system sign-in that requires internet access. Disable it from the VPN app's settings, complete the necessary task, then reconnect the VPN and turn the control back on. Do not assume it re-enabled itself. A captive portal may also require the VPN to be disconnected before its local login page becomes available.

Work device warning: Do not alter firewall services, terminate managed VPN processes or bypass an employer's approved connection controls. Follow the organisation's IT policy and use its support route.

Why is there no internet after disconnecting the VPN?

An enabled always-on or advanced kill switch is the most likely explanation. Reconnect to the VPN or change the kill-switch setting. If ordinary access does not return, try these checks in order:

Confirm whether an advanced or permanent mode remains enabled.
Reconnect to the last VPN server, then disconnect normally.
Restart the VPN app and check for an update.
Review split-tunnelling, LAN-access and trusted-network rules.
Disable or remove another VPN application that may have left conflicting network filters.
Restart the device to reload its network services.
If the problem remains, use the provider's official repair or uninstall procedure and contact support.

Do not randomly disable operating-system security services or delete network drivers. A provider-specific repair is safer than broad changes that can affect the whole device.

Do free VPNs have kill switches?

Some credible free plans do. Proton VPN states that its kill switch is available on all free and paid plans across Windows, macOS, iOS, iPadOS, Android and Linux. Its advanced persistent mode is currently limited to Windows and Linux, while the Android setup uses the operating system's always-on controls. Proton VPN Free is the clearest free recommendation for this particular feature. It does not impose a fixed data allowance, but it permits one connection, restricts location choice and excludes paid capabilities such as full server selection, P2P support and streaming support. Read the current Proton VPN Free and paid-plan review before deciding whether those limits fit. Do not assume that every free VPN lacks privacy safeguards or that every paid VPN implements them well. Check the operator, funding model, privacy policy, app permissions, platform support and independent evidence. Avoid an unknown free app merely because its store listing contains the words “kill switch”.

VPN kill switches and lawful P2P

A kill switch can prevent a P2P client from falling back to the ordinary connection after a VPN failure, but client-level interface binding provides a useful second control. qBittorrent can be restricted to a named VPN interface so transfers stop when that interface disappears. Use the site's qBittorrent VPN setup guide to configure binding and the UK torrent VPN comparison to compare P2P support and port forwarding. These guides cover lawful transfers such as open-source software, public-domain works, authorised datasets and files you have permission to share. A VPN and kill switch do not provide rights to protected material.

Frequently asked questions

Should I leave my VPN kill switch on?

Yes, if you do not want traffic to fall back to the ordinary internet connection after an unexpected VPN failure. Choose standard mode if you sometimes disconnect deliberately; choose always-on mode if internet access should require the VPN.

Why does the internet still work when I disconnect the VPN?

The app may be using a standard kill switch that reacts only to unexpected failures. Deliberately pressing Disconnect can restore the ordinary connection by design. Select an advanced or always-on mode if the provider offers one.

Does a VPN kill switch work on iPhone?

Several providers offer kill-switch protection in their iOS apps, including ExpressVPN, NordVPN, Proton VPN and Surfshark. Behaviour and visibility differ from desktop apps, and providers document Apple-platform limitations. Test the current app and iOS version rather than assuming the Windows behaviour applies.

Does a kill switch make a VPN anonymous?

No. It can block fallback traffic after a VPN failure, but it does not remove account logins, cookies, GPS, browser fingerprinting or information already held by websites and applications.

Which free VPN has the best kill switch?

Proton VPN Free is the strongest documented free option in this guide. Its standard kill switch is included on free and paid plans, and Windows or Linux users can choose a persistent advanced mode. Free-plan server, connection and feature restrictions still apply.

Is using a VPN kill switch legal in the UK?

Using a consumer VPN and its kill switch is generally legal in the UK. The feature does not make unlawful activity legal or remove contractual obligations. Read the separate guide to VPN legality in the UK for the wider context.

Final verdict

A VPN kill switch is worth enabling, but the correct mode matters more than the label. Standard protection is suitable for most people who occasionally disconnect the VPN themselves. Always-on protection is stronger when the device should never use the ordinary route, provided the user understands the connectivity trade-offs. ExpressVPN has the best-balanced documented controls for most UK readers. NordVPN provides the most useful app-level option, Proton VPN Free is the strongest no-cost choice, and Proton or PIA suit users who want persistent desktop rules. Test the installed app after meaningful updates and never treat a settings toggle as proof of complete anonymity.