VPN Guides

ExpressVPN kill switch: how it works, where to find it, and why you need it

By Barnaby Granville · October 29, 2026 · 6 min

A practical guide to ExpressVPN’s kill switch, including setup steps, platform differences, and best practices for maximum protection.

the article body in Markdown: an opening paragraph, then 4 to 6 sections that each start with a "## " heading, "### " subheadings where useful, bullet lists, one Markdown table where a comparison helps, and a short final section with the recommendation

ExpressVPN’s kill switch is a core safety feature designed to prevent IP leaks if your VPN connection drops unexpectedly. In practice, it means your device won’t fall back to your regular internet connection, which could reveal your real location and activity. If you’re using ExpressVPN to protect sensitive browsing, streaming, or professional work, understanding how the kill switch works and how to configure it correctly is essential.

What the kill switch does and why it matters

How it functions

The kill switch monitors your VPN tunnel. If the tunnel drops, the kill switch blocks all network traffic until the VPN reconnects.
This behavior prevents IP address exposure and DNS leaks that can occur when apps try to access the internet directly.

Why you might need it

In countries or networks with strict monitoring, a sudden VPN drop can expose you to tracking.
When you’re torrenting, handling sensitive documents, or working remotely, continuous protection is critical.
Even new VPN connections can briefly drop if you travel between networks or switch Wi‑Fi.

Where to find the kill switch in ExpressVPN

ExpressVPN offers kill switch options on Windows, macOS, Android, iOS, and Linux, but the exact experience and controls differ slightly by platform.

Platform-specific notes

Windows: The kill switch is often labeled as “Network Lock.” It runs at the system level and covers all apps.
macOS: Network Lock is also available, with similar behavior to Windows.
Android: Network Lock can be enabled to ensure apps don’t leak when the VPN drops.
iOS: iOS handles VPN disconnects differently. Some versions rely on the OS-level VPN connection and may offer limited control. Check App settings.
Linux: ExpressVPN provides a Network Lock option in the Linux client, typically used as a system-wide measure.

How to enable the kill switch on each platform

Windows:
Open ExpressVPN, go to Options or Settings, locate Network Lock, and toggle it on.
You can choose to enable it permanently or have it activate only when you’re connected to the VPN.
macOS:
Open ExpressVPN, head to Preferences, find Network Lock, and switch it on.
Android:
Open the app, go to Settings, find Network Lock (or Kill Switch), and enable it.
iOS:
Check the VPN settings inside the ExpressVPN app. Enable the feature if available. If not, rely on the system VPN protections and ensure the app is updated.
Linux:
In the terminal client, enable Network Lock via the appropriate command or UI toggle in the GUI, then confirm it’s active.

How to test the kill switch to verify it’s working

Step-by-step quick test:
Connect to ExpressVPN and confirm your IP shows as the VPN server.
Disconnect the VPN abruptly (simulate a drop).
Try loading a site or service that would reveal your real IP. If the kill switch is active, traffic should halt or fail to load rather than expose your real IP.
Common test methods:
Visit an IP-checking site before and after disconnecting.
Use a leak test tool to verify no DNS or IPv6 leaks occur when the VPN isn’t connected.
Run a streaming service test to see if it’s interrupted during a simulated drop (note: do not breach any terms of service).

Common questions about ExpressVPN kill switch

Here are some quick answers to questions users often ask.

Do I need the kill switch on all the time?
If your threat model includes privacy exposure during VPN drops, yes. Otherwise, it’s optional but highly recommended for maximum protection.
Can the kill switch cause extra connection issues?
It can cause brief connectivity hiccups if the VPN drops and reconnects quickly, but this is a trade-off for better privacy.
Is the kill switch compatible with split tunneling?
Some setups may limit how split tunneling interacts with the kill switch. Check the platform-specific guidance to configure both safely.
Does the kill switch affect mobile data or battery life?
It runs in the background and etches network behavior. It’s generally optimized to minimize impact, but there may be a small effect during frequent reconnections.

A practical comparison: per-app vs. system-wide protection

The kill switch can operate in different modes depending on how you want to protect traffic. Here’s a concise comparison to help you decide.

Mode	What it protects	Pros	Cons
System-wide (Network Lock)	All network traffic on the device	Maximum protection for all apps; no leaks if VPN drops	Could cause apps to stall or fail when VPN reconnects; not always suitable for streaming that requires seamless reconnects
Per-app kill switch	Only selected apps are blocked if VPN drops	More granular control; useful if you want VPN protection for critical apps only	Some apps may still leak if not included; requires careful configuration
Auto-reconnect emphasis	VPN tries to reconnect quickly; some traffic may leak during rejoin	Faster restoration of VPN when disruption occurs	Slight window of exposure possible during reconnect

Best practices to maximize protection with ExpressVPN kill switch

Always enable Network Lock when privacy matters most. It’s your first line of defense against leaks.
Test after updates. New versions can change how the feature integrates with the OS or VPN protocol.
Pair with DNS protection. If your DNS requests leak, you’ll still have visibility. Use ExpressVPN’s DNS leak protection and, if available, DNS over HTTPS.
Keep your app and OS up to date. OS-level changes can affect VPN behavior, so regular updates help maintain compatibility.
Consider protocol choice. Some VPN protocols reconnect more quickly. Check if the protocol you’re using affects the kill switch performance and adjust if needed.
For sensitive use, avoid split tunneling unless you’re confident in the configuration. Split tunneling can create a higher risk of leaks if misconfigured.

Troubleshooting tips for a stubborn kill switch

If the kill switch doesn’t seem to engage, verify the setting is turned on in the correct place (system-wide vs. per-app).
Ensure you’re on a supported ExpressVPN plan and that the app is up to date.
Test on a different network. Sometimes the problem is the local network configuration. A public Wi‑Fi with strict gateways may impact behavior.
Reinstall ExpressVPN. If settings seem stuck or corrupted, a clean reinstall often resets the feature properly.
Check for conflicting VPNs or firewall rules. Other VPN software or corporate firewalls can interfere with Network Lock.

Recommendation: should you use ExpressVPN’s kill switch?

If your priority is privacy and you want to minimize risk of exposing your real IP or DNS during VPN drops, the answer is yes. The kill switch is a straightforward, effective protection that works at the system level and across multiple platforms. Enable it by default, test it periodically, and stay current with updates. For most users, keeping Network Lock on provides a clear, measurable improvement in ongoing privacy and security.

In practice, the kill switch is one of the most important features for anyone who relies on ExpressVPN for secure browsing, streaming, or remote work. Paired with other protections, like DNS leak protection, strong authentication, and careful app-level controls, it creates a robust shield against accidental exposure. If you’re new to VPNs or reassessing your security setup, start with Network Lock turned on, perform a quick leak test, and adjust your per-app settings only if you have a specific use case that demands it. Surfshark kill switch: how it works, why you need it, and how to use it effectively