What a VPN Actually Protects You From, and What It Doesn't
What a VPN Actually Protects You From, and What It Doesn't
A VPN gets talked about like it's some sort of complete invisibility cloak for the internet, switch it on and nothing bad can touch you again. I use one myself, every day, on every device I own, and I still don't believe that. A VPN does something specific and does it well, but it was never designed to catch everything else that can go wrong online, and treating it like it does is how people end up with a false sense of security in exactly the areas where they still need to pay attention. If you're comparing VPN services, I've written up how I'd choose a VPN if I were starting from scratch today.
What a VPN Genuinely Does Well
At its core, a VPN encrypts the connection between your device and the internet, then routes it through a server somewhere else before it reaches its destination. Anyone watching the network you're connected to, whether that's your internet provider at home or whoever runs the free wifi in a coffee shop, sees encrypted traffic instead of what you're actually doing. Your real IP address gets replaced by the VPN server's, so websites and the ads that follow you around see a different location rather than the one you're actually sitting in. For anyone who's ever logged into online banking on a hotel's guest network without thinking twice about who else might be sitting on that same connection, this is the exact gap a VPN closes.
What a VPN Won't Stop
Where people get into trouble is assuming that encryption on the way out means safety on the way in. A VPN has no opinion on the email sitting in your inbox asking you to confirm your card details, it doesn't check whether the file you're about to download is malware, and it won't stop you typing your password into a fake login page that looks identical to the real one. It protects the tunnel your data travels through, not the judgement calls you make once you're connected. I've heard people say they don't need to be as careful about suspicious links because they're "on the VPN," and that's exactly the kind of thinking that gets accounts compromised. A VPN also won't undo a weak, reused password, and it won't add a second step to your login if you haven't turned that on separately, both of which matter far more to whether an account actually gets broken into than which server your traffic happens to route through.
Why I Still Think It's Worth Having
None of that makes a VPN pointless, it just means it's one layer rather than the whole wall. The privacy angle alone is worth it to me, I don't love the idea of my internet provider building a profile of every site I visit and potentially selling that browsing history on, and I've broken the habit of connecting to public wifi without a second thought enough times over the years to know how exposed that moment actually is. Add in being able to check something on a work trip abroad without every site treating me like I'm accessing it from a different country and blocking half of what I'd normally use, and it earns its place running quietly in the background of everything I do online, doing one job well rather than promising to do everything.
The Free VPN Trap I'd Avoid
If you're going to use one, I'd steer well away from free VPN apps, because a lot of them make their money the exact way you're trying to avoid, by logging and selling the browsing data you installed the app to hide in the first place, or by quietly bundling in software that has nothing to do with privacy at all. Slow speeds and constant server drop outs are the more obvious annoyance, the kind that makes people give up within a week, but the privacy trade off is the real cost, and it's a harder one to notice because there's no obvious symptom, just a company somewhere with a detailed record of everywhere you've been online. NordVPN is the one I've used for years and the one I actually recommend when people ask, because it's built around not keeping logs rather than needing to justify why it does, and it's been independently audited on that claim rather than just stating it.
Public Wifi Is Where the Real Risk Lives
I get asked about VPNs most often in the context of public wifi, and for good reason. Open networks in cafes, airports, and hotels rarely have proper encryption, which means anyone with basic tools sitting nearby can potentially intercept what you're sending, including passwords and card details if you're not careful. It's the same environment where a well timed phishing link does the most damage, because people's guard tends to drop when they're just trying to check email between meetings. A VPN closes that gap by encrypting your traffic before it ever touches the shared network. I switch mine on automatically the moment my phone joins any network I don't fully trust, rather than remembering to do it after I'm already connected.
It Stops Companies Building a Profile on You
Your IP address says more about you than you'd think. Sites and advertisers use it to track your location, link your activity across different services, and build a profile they can sell on or use to target you. A VPN masks your real IP address behind the VPN provider's own, which makes that kind of tracking far harder to pull off. It won't make you invisible online, but it takes away one of the easiest tools companies use to follow you around the internet. It's one of the simplest ways to make yourself a slightly harder, less profitable target without changing anything else about how you actually use the internet.
Booking Hotels and Flights Without My Search History Working Against Me
The first time someone explained that travel sites can adjust prices based on what they know about you, I assumed it was exaggerated. Then I compared a flight search on my own laptop against the same search run through a VPN with a different location, and watched the price for the identical seat change. Booking sites build a picture from your browsing history, your device, and sometimes your apparent location, and there's a real financial incentive for that picture to nudge the price upward if it looks like you're already committed to buying. Running a VPN before I start comparing anything travel-related means I'm searching with a cleaner slate each time, closer to what a first-time visitor would see rather than someone who's already shown they're keen. It's not guaranteed to save money on every search, but I've seen it make enough of a difference that I now treat it as a normal part of booking anything, the same way I'd compare a few sites before committing.
Reaching UK Services That Think I've Left the Country
This is the one that first made me take VPNs seriously as something practical rather than just a privacy tool. I was abroad and needed to check something on my banking app, and it flatly refused to let me in because my location no longer matched what it expected, treating a normal login from a new country as suspicious enough to lock me out entirely. Switching my VPN's location back to the UK solved it immediately, and I've since learned plenty of UK services behave the same way, some banking apps, some streaming platforms, some council or government portals, all built with the assumption that you'll only ever access them from home. It's a strange reason to need a VPN, but it's turned out to be one of the most common ones for me in practice, and it's the one that surprises other people most when I mention it, because they assume a VPN is purely about hiding rather than about simply being let back in.
Keeping the Kids' Tablets Covered When We're Away From Home
Our home network has settings I've configured carefully over time, but a hotel room or a rented cottage obviously doesn't come with any of that, and the kids still want their tablets working the same way they do at home. I run a VPN on their devices whenever we're travelling, not because I think every hotel network is actively hostile, but because I have no way of actually verifying that it isn't, and I'd rather not find out the hard way while we're away and I'm not paying close attention to what's loading on a five-year-old's screen. It's one less thing to actively monitor on a holiday, which matters more than it sounds like when you're also trying to actually be on holiday.
How I Actually Use Mine Day to Day
I don't treat it as something I switch on for sensitive moments and off the rest of the time, it just runs on every device I own, phone included, the same way I don't think twice about wearing a seatbelt for a five minute drive. I've written before about why I run a VPN on every device I own, and the short version is that the moment you have to remember to turn something on is the moment you'll eventually forget. It sits alongside a password manager and two factor authentication as one of the handful of things I'd genuinely call essential rather than optional, and it's covered along with the rest of what I actually use in my free Safety Toolkit if you want the fuller list in one place. The NCSC also has its own plain guidance on VPNs if you want a second opinion before deciding whether one's worth it for you.
Use a VPN, and use a properly paid, no logs one rather than a free option built on selling your data, but don't let it replace the other habits that actually catch the scams and mistakes it was never designed to stop.
I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.