DiscountZAR Blog

ExpressVPN Kill Switch: How It Works, Setup and Troubleshooting

Adekiya Joscor · 24 October 2026

The ExpressVPN kill switch blocks relevant network traffic when the VPN connection fails, helping prevent an unexpected change from a protected route to a direct connection. Current ExpressVPN documentation calls the feature Internet Kill Switch; older instructions and settings may use the name Network Lock.

The key distinction is between an accidental disconnection and choosing to disconnect yourself. Standard and advanced modes can treat those situations differently. Before relying on the feature, check your platform, app version and selected mode rather than assuming that a Connected indicator describes every possible failure state.

What the ExpressVPN kill switch actually does

A working VPN tunnel changes how traffic reaches the internet. If that tunnel drops, the device may otherwise try its ordinary connection. A kill switch is intended to stop that fallback within the scope described by the provider.

It does not make every internet activity anonymous, protect you from phishing or replace HTTPS. Its job is narrower: maintaining a traffic-blocking policy when the tunnel is unavailable.

ExpressVPN’s Internet Kill Switch overview is a useful introduction. For setup, use the instructions for your exact device because operating-system permissions and available controls differ.

Standard protection and advanced protection are different

ExpressVPN’s desktop kill-switch guide distinguishes the normal connected-session protection from a stricter advanced option.

Under the standard behaviour described there, an unexpected drop can block traffic, while a deliberate disconnect does not have the same effect. The advanced option is intended to enforce a more persistent VPN-only connection policy.

That difference explains a common misunderstanding: pressing Disconnect and then seeing a website load does not necessarily prove that standard failure protection is broken. You may have tested an intentional action that the selected mode permits.

Read the confirmation before enabling a stricter mode. On a personal computer, a persistent block can be useful; on a device needed for a captive portal or urgent non-VPN access, it also creates a practical dependency you need to understand.

How to check the setting on desktop

For the current Windows, Mac and Linux graphical apps, ExpressVPN documents a route through Profile, Settings and Internet Kill Switch. The guide names Enable when connected for the standard setting.

Use this as a starting point rather than a promise that an older build will have identical labels:

1. Open the official ExpressVPN application.
2. Check the version and use the relevant platform guide.
3. Locate Internet Kill Switch or Network Lock.
4. Read the current mode description.
5. Confirm the intended setting and reconnect if instructed.
6. Record what should happen after an accidental drop and a manual disconnect.

Do not change settings on a workplace-managed machine without following your organisation’s policy. The correct configuration may be controlled centrally.

Android and iPhone need their own instructions

ExpressVPN publishes separate guidance for Android network protection and iOS split-tunneling and kill-switch interaction.

Phone operating systems control networking differently from desktop systems. A feature with the same general purpose can therefore use different switches, permission prompts or limitations.

On a phone, read what the app and operating system say about always-on or blocking connections without a VPN. Do not copy a desktop screenshot and assume it establishes the phone’s behaviour. After an operating-system or VPN update, recheck the relevant settings.

Split tunneling changes the question you need to ask

If you deliberately exclude an application from the VPN, do not assume that the kill switch gives that application the same behaviour as one kept inside the tunnel.

ExpressVPN documents product-specific interactions. Read both features together and ask which traffic should remain available during a disconnection. A configuration with intentional direct access requires a different expectation from an all-traffic VPN-only policy.

Our split-tunneling and full-tunnel comparison explains how routing exceptions work. Keep a short list of exceptions and their purpose so that an old compatibility workaround does not become an unexplained privacy gap.

Verify the behaviour with non-sensitive activity

A meaningful check compares the state you intend with the state you observe. It should not involve sending confidential information while you deliberately interrupt connectivity.

Use the provider’s current verification advice on a personal test device. Establish that ordinary connectivity works, connect the VPN, and confirm the expected public IP using a reputable test page. Then distinguish tests of a manual disconnect from the provider-supported way of assessing unexpected failure.

Keep the scope of the result clear. One browser failing to load after a connection problem is not a comprehensive leak audit. Equally, a normal browser request after a deliberate disconnect may be expected under standard mode.

If the result is unclear, restore a known configuration and contact support with the app version and exact sequence. Do not disable security software broadly just to produce a desired test outcome.

Internet stops after a VPN problem: diagnose before disabling protection

A blocked connection may mean the kill switch is doing its job. First inspect whether the app is connecting, reconnecting or showing an error.

Try the relevant low-impact steps in a clear order: reopen the app, check your underlying network, and follow ExpressVPN’s platform-specific recovery guidance. Change one thing at a time so you can tell which action restored service.

If a public Wi-Fi network requires a sign-in portal, use the provider’s guidance for that situation. Do not enter credentials into an unfamiliar page just because it appears during troubleshooting.

Repeatedly switching off the kill switch without understanding the failure can hide the symptom while changing the protection you intended to keep.

Why a printer may stop working

A local printer or file server uses a different path from an ordinary public website. Some VPN configurations restrict local-network access separately.

Check the local-device permission in your VPN settings and confirm you trust the network before enabling it. Allowing access on your home Wi-Fi and allowing discovery on an unfamiliar public network are different decisions.

The goal is a narrow correction: restore access to the device you actually need while preserving the rest of your routing policy. A printer problem is not, by itself, a reason to remove all VPN failure protection.

Common ExpressVPN killswitch questions

Is Network Lock a different subscription?

The name appears in older and some platform-specific explanations of the kill-switch function. Check the current app documentation rather than assuming you need to purchase another product to obtain a renamed control.

Does a kill switch guarantee no leaks?

A feature description is not a personal test result. Correct operation depends on the client, platform, configuration and situation. Verify the supported behaviour and avoid treating a single test as a complete security assessment.

Should I enable every advanced setting?

Choose settings that match your intended policy and that you can recover from. Stronger blocking can be useful, but a control you do not understand can create confusing outages.

Keep failure protection understandable

Confirm the current name, mode and platform instructions, then document the outcome you expect. Recheck after major client or operating-system changes.

For the broader purchase decision, our VPN selection guide covers factors beyond the kill switch. A useful VPN setup combines suitable software with a routing policy you can explain and verify.