This VPN security guide for beginners covers accounts, subscription links, and public Wi-Fi. Your password grants access to your account, while a subscription link may contain connection credentials. On public networks, check the access point and connection status. Understand these differences before deciding what to save, import, or revoke if something goes wrong.
Protect your account and subscription link separately
Your account password and subscription link are different credentials. The password is usually used to manage your account; the link lets a client retrieve connection settings. Anyone with a valid subscription link may be able to access server addresses and authentication details, even without your account password. Treat the link as sensitive information, not as an ordinary download URL to forward.
Subscription links often contain access tokens in the URL path or query parameters. HTTPS protects the link in transit, but it cannot stop the recipient from using it or prevent it from being saved in chat history, browser sync, or screenshots. A QR code is just another way to share the same information. Posting a subscription QR code in a public group carries risks similar to sharing the link itself.
| Item | Purpose and risks | How to protect it |
|---|---|---|
| Account password | Used to sign in; reusing it can amplify the impact of a breach on another site | Use a unique password and store it in a trusted password manager |
| Subscription link and QR code | May provide access to the full connection configuration | Share only with a trusted client; never put it in public documents |
| Server configuration and backups | May contain server authentication details and subscription sources | Restrict file access and use cloud sync with care |
| Diagnostic logs and screenshots | May expose tokens, visited domains, or local file paths | Review and redact sensitive fields before sharing only the necessary excerpts |
A client connecting successfully does not mean your account credentials are safely stored. Before changing devices, reinstalling your system, or losing local settings, make sure you can retrieve your credentials from a secure location. Don’t keep your only backup in a notes app on the same device, and don’t send your entire configuration to strangers for help.
Account security: passwords and minimal personal information
Use a unique, long password that’s hard to guess. Generating and storing it in a password manager is safer than adding a site name to a password you already use. Don’t reuse your account password for email, shopping, or social media. If another site is breached, reused credentials could be tried elsewhere.
Before entering personal details, check what each field is for. Share only what’s necessary to use the service; don’t add your real name, identity documents, or unrelated work details to your profile, notes, or support requests. Check the account recovery options in advance, too. If recovery by email isn’t available, it’s especially important to store your credentials securely and understand the official recovery process before you’re locked out.
- ✅ Open the account panel from the verified official website and check the full domain in the address bar.
- ✅ Set a unique password for the account panel. If additional verification is available, learn how it works and store recovery details securely.
- ✅ Sign out after using a shared device, and don’t save your password or session.
- ❌ Never send your password, subscription token, or recovery details to a stranger claiming to be support.
The HTTPS padlock means the connection is encrypted; it doesn’t prove the website is legitimate. Fake sites can also have valid certificates. If a message asks you to sign in again, open the official site from a saved bookmark to check, rather than entering your credentials through a link in an unfamiliar message.
Importing a client: source and permissions
A client handles subscription credentials and can affect where your traffic goes. Download it from the project’s official release channel linked in the service’s help pages, or from a reputable app store. Check the project name, developer, and platform version. Don’t choose a download just because it ranks highly in search results, and avoid modified versions from unknown sources. Follow the steps in the Guides rather than copying instructions from an unfamiliar screenshot.
Windows and macOS clients may use the system proxy or offer a virtual network adapter mode. The system proxy mainly affects apps that follow the system’s proxy settings; it doesn’t mean all traffic on the device is routed through the proxy. Mobile platforms often establish a traffic tunnel through the system’s VPN configuration permission, but the permission screen itself doesn’t prove the client is trustworthy. On Linux, check command-line configuration file permissions so other local users can’t read keys.
Before importing, make sure the client supports the configuration’s protocol and format. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC aren’t interchangeable names. Support for one doesn’t mean a client can read a subscription using another. A protocol name alone also doesn’t define the security boundaries. For example, VLESS doesn’t encrypt payloads on its own; assess the configuration’s protections, including whether it uses TLS.
After importing, check for remote rules, scripts, or additional subscriptions. They may change routing behavior; don’t assume they’re trustworthy just because they came with the server configuration. If you’re asked to install a root certificate or disable certificate validation, stop and verify why. A typical proxy connection doesn’t need a trusted root certificate to decrypt your browser’s HTTPS traffic.
Public Wi-Fi: what to check before and after connecting
Public Wi-Fi risks aren’t limited to networks without a password. Lookalike hotspots, tampered captive portals, and malicious devices on the local network can all affect your connection. Confirm the network name with the venue before connecting, and turn off auto-join if you don’t need it. If your system offers a public network profile, disable network discovery and file sharing.
A network with a captive portal may require you to open its sign-in page before a proxy connection can be established. Only complete the steps needed to get online, and don’t enter passwords for other sites into an unfamiliar portal. If the page asks you to install a certificate or download an unknown app, or your browser keeps showing certificate warnings, stop and verify the network instead of dismissing the alerts.
A trusted encrypted tunnel can reduce the local network’s ability to inspect or alter traffic inside it, but it doesn’t replace HTTPS, website verification, or device security. Using a proxy shifts some of your trust from the local network to the service’s exit point. Phishing sites, malicious attachments, and browser extensions can still steal your information.
- Verify the access point and complete any required network sign-in. Avoid handling sensitive information before you’re authenticated.
- Start a trusted client and confirm the traffic you need is using the expected route before opening the service.
- Check the website’s domain and certificate warnings. If anything looks unusual, don’t enter passwords or payment details.
- When you leave, disconnect from the network, turn off auto-join, and remove the saved public network if needed.
The connection status may change when your device sleeps, switches access points, or reconnects. If you need to handle sensitive information, check the connection again instead of assuming that an earlier “connected” status still applies. If your client offers a kill switch, understand what it does before enabling it, then test whether it blocks direct connections if the tunnel drops.
Split tunneling and DNS: what to check after connecting
Being able to open a webpage only confirms that one request worked. In rule-based mode, some sites may connect directly. Global mode can also be affected by excluded processes, system components, or how the client is implemented. If an app isn’t using the proxy, first check whether it follows the system proxy, matches a direct-connection rule, or needs virtual adapter mode enabled. Don’t just keep switching servers.
DNS translates domain names into addresses. A DNS leak usually means that DNS requests aren’t taking the expected protected route and are instead sent to the local network or another unintended resolver. Browser encrypted DNS, system DNS, and the client’s DNS settings may all be active, so check the actual configuration. An unfamiliar resolver on a test page doesn’t by itself prove there’s a leak; it may be an upstream resolver used by the service.
Start by checking your exit IP with Network Check, then compare it with the client’s connection logs and routing rules. Test your browser and the apps you actually use separately. If your device uses multiple address families, check that each follows the expected route. A single successful test isn’t a lasting guarantee; test again after updating rules, changing modes, or switching networks.
If credentials are exposed: revoke them, then clean up
If a link is made public, a configuration is shared by mistake, or you notice an unusual account login, first identify which credentials were exposed. Deleting a message may limit further sharing, but it can’t retrieve copies others have already made. Don’t wait for unusual traffic before revoking access.
- Secure your account. From a trusted device, change your password on the official website. If session management is available, sign out of any sessions you don’t recognize. Change the password on any other accounts where you reused it.
- Revoke the subscription. Look for a reset or revoke option in the account panel. If there’s no clear option, contact support through official channels to confirm what to do. Don’t assume that changing your sign-in password also changes your subscription token.
- Check server credentials. Ask whether a reset only changes the subscription URL or also invalidates the old server authentication details. Previously downloaded configurations may remain usable, depending on how revocation works on the server.
- Update your devices. Replace the old subscription with the new configuration, then delete outdated files, QR codes, and synced copies you no longer need. If the service provides a way to verify revocation, confirm that the old link and configuration no longer work.
- Find the source. Check shared documents, screenshots, browser extensions, and online conversion tools to prevent new credentials from leaking through the same channel.
When contacting support, describe your operating system, client name, error message, and what you were doing when it occurred. Share only the relevant log excerpts, redacting full subscription URLs, authentication fields, account identifiers, and unrelated browsing records. Don’t publicly upload your entire configuration for someone to “check.” If more information is needed, confirm the official contact options through the Help page.
A service’s “no logs” statement describes its privacy policy; it doesn’t mean your device, browser, websites, or third-party tools leave no records. The most useful everyday steps are still to use a unique password, limit credential sharing, choose a trusted client, and check your traffic route after network changes. The goal is to keep reducing exposure, not to rely on a protocol name or a single test result.