What a Kill Switch Actually Stops (and What It Doesn't)

Hotel Wi-Fi does not fail politely

The lock icon is a UI. The tunnel is a process. When the radio hiccups, some apps keep sending packets around the dead tunnel for a few seconds. That window is the entire product a kill switch is for.

People buy VPNs for 'hacking.' They should buy the switch for flaky access points. Captive portals complicate it: you may need to disable the switch for thirty seconds to accept hotel terms, then turn it back on. That dance is annoying. It is still better than a silent leak.

From the record

A lock icon that lies for ten seconds is worse than no icon. The switch is how you refuse the lie.

GUIDEORA rule for VPN fail-closed

What it will not stop

It will not stop you from typing a password into a fake portal. It will not encrypt a site that is already HTTPS. It will not hide the fact that a VPN process is running from a network operator who cares. Those are different jobs.

• Enable the kill switch before you leave home, not after the first flap.
• Learn how your app handles captive portals so you are not stuck offline in a lobby.
• A system-wide switch beats a browser-only extension on travel days.
• If an app ignores the switch, that app does not belong on cafe Wi-Fi.

Proton VPN as the example

Proton VPN currently includes a kill switch in its mainstream apps and talks about it as a core privacy control, not a premium joke. That matches how we think the feature should be sold. Other brands have it too. We mention Proton here because it is the privacy-first offer this site already covers.

Setting names differ ('kill switch,' 'always-on,' 'block non-VPN'). Read the live help page for your OS.

Leave it on for the trip

Turn the kill switch on before you join a network you do not own. Leave it off only if you have a named reason, such as a portal you must clear. Proton VPN is the example this guide uses. GUIDEORA does not own the setting.