Can websites tell you’re using a VPN? How they know, and why yours gets flagged

Usually, yes. A website cannot see inside your VPN tunnel, but it does not need to: it sees the address your traffic comes out of, and VPN exit addresses are exactly what IP-data companies keep track of. What the site does with that is a separate decision, and many sites that check do not block. Below: how the detection works, what a VPN does and does not hide, why sites react the way they do, why you can be flagged without a VPN, and how to see what a site sees on your own connection. The outside facts were checked on 18 October 2026.

How websites detect a VPN

Most of it happens on the website’s server, from the one thing every visit carries: the IP address your connection comes from. With a VPN on, that is the address of the VPN server, and four things give it away.

1. The address is on a list. Companies that sell IP data keep track of which addresses are VPN exits. IPinfo says it connects to VPN services directly, analyses their handshakes, scans protocols and verifies how exit nodes behave (IPinfo). MaxMind sells an Anonymous IP database with a flag for addresses “registered to an anonymous VPN provider”, and notes that a VPN which does not register its address blocks under a name associated with it may only get the database’s hosting-provider flag (MaxMind). A site that buys one of these feeds can look up every visitor’s address as the page loads.

2. The address belongs to a hosting company. VPN servers are servers, and most of them sit in data centres. Mullvad publishes its whole server list with the company hosting each server: on 18 October 2026 its relay list marked 422 of its 535 active WireGuard servers as rented, most of them from Tzulo, DataPacket and M247. Home broadband and mobile connections rarely come from those networks, so an address on a hosting network is a clue in itself, even when no list names the VPN. The guide to datacenter IP detection covers how that check works and where it misfires.

3. Many people share it. A VPN exit carries many customers at once, so a site sees dozens or hundreds of accounts arriving from one address, a pattern no household produces. Apple says the same of its own relay service: “many Private Relay users may be assigned to a single relay IP address” (Apple Developer).

4. The rest of the visit does not match the address. The browser tells a site things the VPN does not change. A page’s JavaScript can read the time zone your device is set to, as an IANA name such as Europe/Berlin (MDN), and a time zone in one country next to an address in another is a classic VPN tell. Leaks give the game away more directly. WebRTC, the browser feature behind video calls, “can discover not only the public address for the VPN, but also the ISP public address over which the VPN is running”, as RFC 8828 puts it, and a VPN that tunnels only IPv4 can let your IPv6 traffic go out over your normal connection (RFC 7359).

Some addresses are published by the people who run them. The Tor Project publishes the list of Tor exit addresses (1,211 of them on 18 October 2026), and Apple publishes the egress ranges of iCloud Private Relay so that websites and IP-data providers can recognise its traffic (Apple Developer). Those visits are the easiest of all to recognise.

What a VPN hides from websites, and what it does not

A VPN replaces your IP address with the VPN server’s, so the site does not learn the address of your home or which internet provider you use, and it hides your traffic from that provider and from the local network, such as a café’s Wi-Fi (EFF). It does not hide:

• That you are using a VPN. See above.
• Who you are once you sign in. An account, a cookie or a saved card identifies you whatever the address. The EFF says plainly that a VPN “is not a tool for anonymity”, because companies can still track you through GPS, cookies, tracking pixels or fingerprinting (EFF).
• Your device. Browser version, screen size, language and time zone travel with every visit.
• Your activity, from the VPN provider. Your browsing is “all visible to the VPN provider” instead of to your internet provider (EFF), so the choice of VPN matters more than the choice of setting.

Why websites block VPNs, or ask for more

A site that recognises a VPN still has to decide what to do with the visit. The reasons for being strict fall into three groups.

• Licences and location rules. Streaming catalogues are licensed country by country, so Netflix shows “You seem to be using a VPN or proxy. Please turn off any of these services and try again.” (Netflix Help Center). Services that may only operate in some countries, such as online gambling, check where a visitor is for the same reason.
• Fraud and abuse. The address is the cheapest thing about a visit to change, so people who have been banned, who open dozens of free trials or who test stolen cards change it, often with a VPN. Wikipedia lets anyone read through a VPN but says open or anonymising proxies, “including Tor as well as many public VPNs, may be blocked from editing” (Wikipedia).
• Limits per address. A site that limits how much one address can do sees one address carrying hundreds of people. Apple warns that websites relying on “IP filtering, monitoring, or rate-limiting” might try to prevent you from browsing them while you use Private Relay (Apple Support).

Blocking is the bluntest answer, and plenty of sites do not use it. A VPN on its own is not fraud: people use one on public Wi-Fi, for work and for privacy. Maskbreak, the fraud detection API this blog belongs to, sends a visit from a VPN to review rather than block under its default policy; the site’s own rules decide what review means, such as confirming an email address before a free trial starts or holding a first payout. A proxy or a Tor exit is a block by default, and Apple’s Private Relay is a review, like a VPN. This is the public sample answer for a VPN visit, from /v1/evaluate/sample?scenario=vpn:

The exit in that sample sits on a hosting network, so the answer carries two reasons, and the service is named because it is known. The decision stays review: neither reason is a block on its own.

Why a site says “VPN detected” when you are not using one

These checks judge the address and the browser, not your intentions, so ordinary set-ups trip them.

• iCloud Private Relay. On an iPhone, iPad or Mac with iCloud+, Safari can send your browsing through two relays, the second run by a third-party content provider that gives you a temporary IP address (Apple Support). To a site, that is a relay address, and some treat it like a VPN. To show one site your own address, tap the Page Menu button in Safari and then Show IP Address on an iPhone or iPad, or choose View, then Reload and Show IP Address, in Safari on a Mac; your network provider can then see which site you are visiting (Apple Support).
• A VPN you did not know was on. Netflix lists antivirus software that includes a VPN feature, which may be on without your knowledge, among the causes of its VPN error (Netflix Help Center). Some browsers and many work laptops carry one too.
• A work or school network. Organisations often route staff browsing through a security service in the cloud, so the visit arrives from that service’s data-centre addresses, shared with its other customers. The datacenter IP guide has examples.
• A shared or recycled address. Mobile carriers and some home providers put many customers behind one public address, and lists are built from past sightings, so an address a VPN used recently can still be listed after it has moved on.
• A device set to the wrong time zone. A site that compares your time zone with your address sees the same mismatch a VPN would cause.

If a site refuses you and you are not on a VPN, the fix is usually dull: switch off any VPN, relay or “secure browsing” feature for that site, try another connection such as mobile data, and if that does not help, write to the site with the address and the error it showed. Netflix’s own help page suggests comparing the country fast.com shows with where you really are (Netflix Help Center).

How to check whether your VPN is detected

The quickest way is to visit a site that checks and read what it says. The live check on Maskbreak’s homepage and the VPN checker run Maskbreak’s checks on your own visit: a network reading of the connection your visit came through, plus a check of the browser itself. They show the decision those checks lead to (allow, review or block), whether the connection was flagged as a VPN, a proxy or Tor, and the VPN service by name when it is known. There is nothing to install and no account to make.

Two cautions when you read the answer. A clean result from one checker means that checker did not flag your connection at that moment, not that no site can; data differs between providers and changes every day. And an address typed into a lookup box is not a visit: on its own it says much less. Maskbreak’s lookup of an address checks only the Tor exit list and published cloud ranges, and its VPN verdicts come from the live visit.

Can you stop websites from knowing you use a VPN?

Not reliably, and the ways that come closest are the ones sites distrust most. A VPN address that looks like a home connection is rare, which is why services that rent out home addresses charge for them, and why fraud teams watch for them (what a residential proxy is). A home address next to a browser in another country’s time zone is its own kind of clue.

If a site you need will not work with your VPN on, the practical options are to leave that site outside the tunnel (many VPN apps can exclude chosen apps or sites, a feature usually called split tunnelling), to use the site’s own app, or to ask the site what it needs from you. A site that sends VPN visits to review rather than block may only want you to confirm your email address.