Using a VPN without misreading what it is doing

This is not an argument for or against having a VPN. Plenty of people have one, through work or a subscription, and the practical question is how to use it without forming a false impression of what it covers. NCSC’s guidance gives the boundary in one sentence: a VPN secures "data in transit" across an untrusted network, and "only traffic which is routed over the VPN will be protected by it." Everything below follows from that second clause.

Decide what problem you are solving

Before anything technical, write down the specific effect you want. There are three that a VPN actually delivers, and knowing which one you are after determines how you configure it.

Reaching a private network from elsewhere — your employer’s systems, something at home. This is the original purpose and the one NCSC writes guidance for. Keeping the operator of a network you do not trust from seeing your destinations. Or presenting a different exit address to websites.

If your answer is none of those, you are unlikely to get value from careful configuration, because there is no outcome to configure towards.

Five things to get right in use

1. Know what is routed and what is not. Some clients tunnel everything; some tunnel only selected applications or destinations. NCSC’s caveat is that only routed traffic is protected, so find this setting and read it rather than assuming.
2. Check the behaviour when the tunnel drops. A connection that silently falls back to the ordinary network is the failure mode that matters, because nothing visibly changes. If the client offers a setting to block traffic when disconnected, use it.
3. Watch for traffic that bypasses it structurally. Local network traffic, some system services and some applications may route outside the tunnel by design. NCSC specifically warns that a third-party client may integrate poorly with the operating system and that data may consequently be sent outside the VPN.
4. Keep the client updated. It is software with privileged network access on your machine. The same automatic-update expectation that applies to your browser applies here.
5. Turn it off when it is not doing anything for you. A tool you leave on out of habit is a tool you have stopped thinking about, and the false confidence is the actual risk.

Who you are trusting instead

This is worth being explicit about because the marketing tends to phrase it as removal rather than transfer. Without a VPN, your internet provider can see which sites you connect to. With one, it cannot — and the VPN operator can.

That is a reasonable trade in some circumstances and not in others. It depends entirely on which of the two you would rather have that visibility, which is a judgement about the operator, not about the technology. NCSC’s own recommendation stops at the protocol level — IPsec, an open standard, with client certificates for machine authentication — and its guidance contains no endorsement of commercial consumer VPN services at all.

How to check it is actually carrying your traffic

1. Connect, then check what public address websites see for you. It should be the exit point, not your own.
2. Disconnect and check again. If the answer does not change, the tunnel was never carrying that traffic.
3. Test on each network type you use — home, mobile data, a public hotspot. Behaviour differs.
4. If your client has a per-application or split-tunnel list, open it and confirm it matches what you believe it says.
5. Repeat after any client update. Settings get reset, and defaults change.

The four things it will not do, whatever the setting

• It will not make you anonymous. Signing into an account identifies you regardless of the route.
• It will not stop tracking. Cookies, advertising identifiers and account profiling are untouched. The FTC’s controls — browser privacy settings, per-browser and per-device ad opt-outs, the operating-system advertising identifier, app permissions — are the relevant ones there.
• It will not protect you from a fraudulent site. The FTC’s warning that data "may be encrypted on its way to the site, but it won’t be safe from scammers operating the site" describes a VPN connection as accurately as an HTTPS one.
• It will not stop malware. Nothing about routing inspects what you download.

The setting that matters more than the VPN

If you are on a public network and worried, the FTC’s own advice for that exact situation lists none of this. It lists recognising HTTPS, strong passwords, two-factor authentication and spotting fraudulent websites — and its starting position is that connecting through public Wi-Fi is usually safe because most sites are encrypted.

That is a useful corrective to how a VPN gets ranked in most consumer writing. Use it for the narrow things it does. Do not let it stand in for the controls that do the heavy lifting.

Sources: NCSC UK — Virtual private networks · FTC — Are public Wi-Fi networks safe? · FTC — How to protect your privacy online · NCSC UK — Managing web browser security

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from NCSC UK and the FTC. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.