What a VPN Can't Protect You From: 6 Gaps and How to Close Them

A VPN does one job well: it encrypts the connection between your device and the VPN server, so the Wi-Fi owner, your internet provider and anyone else on the network cannot read what you send or see which sites you visit. That is worth a lot. But it is one lock on one door. Here are six things a VPN does not do, and the simple step that covers each one.

1. It does not stop you from typing your password into a fake page

A phishing page looks like your bank or your email login. If you type your password into it, the VPN carries that password safely, straight to the wrong people. Encryption protects the road, not the destination.

What to do: open important sites from a bookmark or the official app, not from a link in a message. Our guide How to Spot a Phishing Message in 30 Seconds shows the signs.

2. It does not protect an account with a weak or reused password

If the same password works on five sites and one of them leaks, the other four are open, VPN or not.

What to do: use a password manager so every account gets its own long password, and turn on two-step sign-in for email, banking and your Apple Account first. See Two-Factor Authentication: Which Accounts to Protect First.

3. It does not hide you from the sites you sign in to

When you sign in to a website, it knows it is you. It can still remember what you do on it, show you ads based on it and keep your history. A VPN changes the address the site sees, not the account you are signed in with.

What to do: check each app's privacy settings, sign out of accounts you do not need, and on iPhone look at Settings > Privacy & Security to see which apps can use your location, photos and contacts.

4. It does not fix an out-of-date phone

Many attacks use security holes that the maker has already fixed. If the update is not installed, the hole is still open.

What to do: turn on automatic updates for iOS and for your apps. It costs nothing and closes more doors than any single app.

5. It does not protect you while it is off

A VPN only helps while it is connected. Phones switch networks all the time, and an app can be closed or paused by the system.

What to do: check that the VPN is really on before you use a network you do not trust. Is Your VPN Really On? A 3-Minute Check shows how. In CasperVPN you can also turn on the kill switch in Settings and choose Strict mode, so nothing leaves your phone while the tunnel is down. It is off until you switch it on.

6. It does not make a VPN provider you cannot trust safe

With a VPN, your traffic passes through the provider's servers instead of your internet provider's. You are moving trust from one company to another, so the VPN company has to earn it.

What to do: read the provider's privacy policy before you pay. Our guide How to Read a VPN Privacy Policy in 5 Minutes gives you five questions to ask.

The short version

A VPN protects the connection. Your passwords, your accounts, your updates and your own clicks need their own care. Put the six steps above together and a VPN becomes one strong layer among several, which is how good security works.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Download CasperVPN →