Check the address changed
Load any address-reporting site with the VPN off and note what it says. Connect and reload. The address and the reported country should both change. If the address changed but the country did not, you may be on a virtual location where the hardware sits elsewhere.
This is the check everyone runs and it proves the least. An address change confirms traffic is being routed somewhere else. It says nothing about DNS, IPv6, or what happens when the tunnel drops.
Check DNS is not leaking
A DNS leak means your device asks your ISP’s resolver which address a domain lives at, then connects through the tunnel. Your ISP cannot read the encrypted traffic, but it has the full list of every site you asked about — which is usually enough.
Use a DNS leak test page while connected. Every resolver listed should belong to your VPN provider. If your ISP’s name appears, the tunnel is carrying traffic but not lookups. On Windows this is common enough to be worth checking after every major update, because the resolver behaviour can query multiple interfaces simultaneously.
Check IPv6 is handled
If your connection has IPv6 and the tunnel carries only IPv4, IPv6-capable sites see your real address directly. The tunnel is working and irrelevant for those sites.
A leak test that reports an IPv6 address while connected means the client is not handling it. Two fixes are acceptable: the provider carries IPv6 inside the tunnel, or the client blocks IPv6 at the interface. Check the client settings for an IPv6 option before assuming it is broken.
Kill the tunnel and watch what happens
This is the test that separates a working kill switch from an advertised one. Do not click disconnect — a graceful disconnect is not the failure you need covered.
Start a continuous download or a ping to a remote host. Then terminate the VPN process from the task manager or with kill. If traffic continues, the kill switch is application-level and depends on the app still running to notice a failure. If traffic stops immediately, the switch installs firewall rules that survive the process dying, which is what you want.
Avoid
- Testing by clicking disconnect, which every implementation handles correctly
- Assuming the switch is on by default — on several clients it is not
- Testing once and never again; client updates have reintroduced leaks before