How websites spot a VPN, and what you can honestly do about it

The short version

A VPN hides your real location by routing your traffic through a far-away server. But many websites can tell you're using one and sometimes block you or ask extra questions. They don't do it by magic. They use a few practical clues. Here's what those clues are, what genuinely helps, and what no VPN can truly promise.

What's actually happening

Imagine thousands of people mailing letters, but all using the same handful of rented post office boxes in one building. After a while, the people receiving those letters notice: "Every letter from that address is from a forwarding service, not a real home." That's essentially how VPN detection works. The addresses most VPNs use are well known to belong to data centers, not homes, so sites can recognize them on sight.

On top of that, sites look for little inconsistencies, like your connection claiming to be in Spain while your device's clock is set to New York time. When the story doesn't add up, they flag it.

Why it matters to you

• Streaming services may show an error or the wrong country's catalog.
• Banks and shops may add extra security checks, or block the login, because a sudden foreign location looks like fraud.
• Some sites throw up endless "prove you're human" puzzles.

This isn't about you doing anything wrong. It's sites treating all VPN traffic cautiously. Being blocked is usually an inconvenience, not a security problem.

How to fix it (what actually helps)

Note upfront: no setting makes a VPN undetectable. These steps improve your odds of getting through.

1. Switch to a different server

1. Open your VPN app.
2. Disconnect, then pick a different city or server in the country you want, and reconnect.
3. Try a couple. Some addresses are "burned" (already blocked); a fresh one often works.

2. Turn on your VPN's stealth or obfuscation mode

1. In your VPN app, open Settings.
2. Look for Obfuscation, Stealth, Camouflage mode, or a protocol with a name like Stealth or NordWhisper, and turn it on.
3. This makes your VPN traffic look more like ordinary web traffic. It can be slower, so turn it off when you don't need it.

3. Consider a dedicated IP (an address just for you)

Many VPNs sell a dedicated IP add-on, an address only you use. Because it isn't shared by thousands of people, it's far less likely to be on a block list. It's an extra fee, but it's the single most effective option for banks and logins.

4. Fix the small giveaways

• Set your device's time zone to match the country your VPN is in (see our Timezone guide).
• Make sure you have no DNS leak or WebRTC leak (we have guides for both), these reveal your real location even with the VPN on.

How to check it worked

Reload the site that was blocking you. If it loads normally and shows the right country, you're through. You can also re-run the VPN and leak tests on this site, they should show your VPN's location consistently, with no sign of your real address.

If your result was already good

If a site isn't blocking you and your VPN is working, there's nothing to fix, enjoy it. Keep in mind that a server working today can be blocked next week, so if a site suddenly stops cooperating, just switch servers. That's normal, not a sign anything broke.

Want to go further?

One honest note: getting around a site's block may go against its terms of service, even when it's technically possible. If a service you pay for blocks you, contacting its support is often the cleanest fix. The Advanced version covers the exact detection signals and the trade-offs of each workaround.

Is this your problem?

These all come back to how sites detect a VPN:

• "Is my VPN working right now?" A quick check of whether your exit looks like a normal home connection or like a datacenter.
• "VPN detected" on YouTube, YouTube TV, Netflix or BBC iPlayer. Often it is not your IP at all but a timezone or DNS mismatch giving you away — see the Timezone and DNS leak guides.
• "Why is my VPN not working on Netflix?" Streaming services cross-check several signals at once; this guide shows which ones you can actually control.

What VPN detection actually measures

Detection is a scoring problem, not a single test. A site combines several signals into a risk score and acts on the total. The dominant signals:

• IP reputation / blocklists. Commercial services (MaxMind, IPQualityScore, IPinfo, Spur, and others) maintain databases flagging known VPN/proxy egress IPs. Once an IP is associated with a VPN, it carries a low trust score until it ages out.
• ASN and datacenter classification. The strongest tell. Most VPN servers live in hosting ASNs (OVH, Leaseweb, M247, Datacamp, etc.). An IP whose ASN is a datacenter rather than a residential/mobile ISP is immediately suspect, often blocked at the edge before the page renders.
• Geolocation vs. other evidence. IP geo vs. device GPS (in apps), vs. browser Intl timezone, vs. navigator.language/Accept-Language, vs. keyboard/locale. Mismatches raise the score.
• Header and transport artifacts. Proxy-injected headers (X-Forwarded-For, Via), open proxy ports, anomalous MTU/MSS, and TLS/TCP fingerprinting (JA3/JA4, TCP timestamps, OS stack signatures) that don't match the claimed client.
• Concurrency and behavior. Many simultaneous users behind one IP, impossible travel between logins, request cadence unlike a human, these feed account-level risk engines.
• Active probing. Sophisticated censors (and some anti-fraud systems) probe a suspected VPN endpoint to see whether it speaks a VPN protocol, which is why obfuscation exists.

Why datacenter IPs are the crux

Shared commercial VPN IPs are detected most reliably because they're both datacenter-hosted and shared by many users, two high-weight signals at once. Residential and mobile IPs are rarely flagged because they're indistinguishable from ordinary users; that's precisely why "residential proxy" services exist (and why they're ethically and legally fraught, often built on compromised or dubiously consented devices). Detection accuracy against known datacenter VPNs is high; against residential exit nodes it drops sharply.

Countermeasures and their real trade-offs

Server/IP selection

• Rotate servers/cities. Trivial, often enough for streaming. You're hunting for an un-blocked IP in the right geo.
• Dedicated/static IP add-on. The most effective single move for banks and account logins: an IP used only by you avoids the "shared concurrency" and recent-abuse signals. Downside: it's still a datacenter ASN, so ASN-based blocks still apply, and it reduces your anonymity (one stable identifier tied to you).

Obfuscation / pluggable transports

• Vendor "Stealth/Obfuscation/Camouflage" modes, OpenVPN over TLS/XOR, WireGuard wrappers (AmneziaWG), or transports like Shadowsocks, obfs4, and V2Ray/VLESS make the tunnel look like generic HTTPS, defeating protocol fingerprinting and active probing. They do not change your egress IP's ASN or reputation, so a site doing pure IP-reputation blocking is unaffected. Cost: throughput and latency.

Consistency hygiene

• Align OS timezone and browser locale with the exit country; eliminate DNS and WebRTC leaks; disable IPv6 if the tunnel doesn't carry it (native IPv6 can reveal the true geo). These remove cheap cross-check signals, they won't help against ASN blocks but they stop the easy "gotchas."
• Avoid over-spoofing: a browser extension that fakes only the Intl timezone while leaving Date.getTimezoneOffset() or font/canvas signals intact creates new inconsistencies that look more bot-like than a plain mismatch. Change the real OS setting instead.

Verification

• Check your egress IP against a reputation/proxy-detection lookup, see whether it's classified as hosting/VPN and what trust score it carries.
• Confirm no DNS/WebRTC/IPv6 leak via leak tests, and that timezone/locale match the exit geo.
• For TLS-fingerprint curiosity, a JA3/JA4 echo service shows whether your client stack matches a mainstream browser or screams "automation/proxy."

Honest limits and ethics

• No configuration makes a VPN undetectable. ASN classification alone defeats most consumer setups against a determined site; the realistic goal is "not blocked by this site today," not invisibility.
• Terms of service. Circumventing geo-blocks or anti-fraud controls may breach a provider's ToS even when technically feasible; account bans are a real consequence. For a service you legitimately use (your bank, your own streaming account while traveling), contacting support or whitelisting a dedicated IP is usually the durable fix.
• Residential proxies may evade detection but frequently rely on opaque or non-consensual device networks, treat them as out of scope for ethical privacy use.
• What detection evasion does not do: it doesn't improve your anonymity or encryption; a site that can't tell you're on a VPN can still fingerprint your browser and track you by cookies and logins.