How Websites Tell You Are Using a VPN

Websites detect VPN use mainly by looking up the reputation of the address your request arrives from, not by examining your traffic. Address ranges belonging to hosting companies are known, published, and commercially catalogued, and a request from one is trivially distinguishable from a request from a residential broadband connection. Nothing about the encryption is broken to work this out; the address itself is the signal.

Understanding this explains a lot of everyday friction — the extra verification steps, the blocked signups, the sites that behave oddly — and it also explains why “nobody can tell” was never an accurate claim.

The signals sites use

Address ownership. Every address range is registered to an organisation, and that registration is public. Ranges belonging to hosting and cloud companies are recognisable, and consumer VPN exit points are almost always in them. This alone identifies most VPN traffic.

Commercial reputation data. An industry exists supplying classifications of addresses — datacentre, residential, mobile, proxy, known VPN endpoint — assembled from registration data, observed behaviour, and vendor disclosures. Sites subscribe to these feeds rather than working it out themselves.

Concurrency. Many unrelated users behind one address is a distinctive pattern that residential connections do not produce.

Geographic inconsistency. A browser reporting one timezone and locale while its address suggests a different continent is a mismatch that is easy to notice.

Behavioural signals. Sudden location changes between requests in one session, or a login from a country the account has never used, are flagged by fraud systems regardless of any VPN-specific logic.

Protocol characteristics, for a network operator rather than a website: the handshake and traffic shape of a tunnel are identifiable to whoever carries the traffic, which is the point of what survives a tunnel.

What sites do not do is decrypt your traffic. They do not need to.

Why sites bother

It is easy to read this as hostility. Mostly it is not.

Fraud prevention. Payment fraud, account takeover, and abuse arrive disproportionately from shared and datacentre addresses, because those are what automated abuse uses. Treating such addresses as higher risk is a rational response to an actual pattern, not an attack on privacy.

Abuse control. Spam, scraping, credential stuffing, and automated account creation come through shared infrastructure. A site that could not distinguish it would drown.

Licensing obligations. Services distributing content under territorial agreements are contractually required to restrict access by region, and the address is the mechanism.

Regulatory requirements. Some services must establish where a user is for legal reasons — financial, gambling, and age-verification regimes among them.

Security signalling for your benefit. When your bank asks for an extra factor because the login came from an unfamiliar location, it is doing the thing you would want it to do if the login were not yours. That is the honest reading of the friction discussed in do you need a VPN for online banking.

What happens when you are detected

Extra verification. Additional factors, email confirmation, a captcha, an identity check.

Reduced functionality. Some features disabled, some content withheld.

Refused signup or payment. Common for new accounts from datacentre addresses.

Outright blocking, with or without an explanation.

Silent degradation, which is the confusing one: nothing says it blocked you, things just behave strangely.

What this means for your privacy expectations

Two conclusions follow, and they cut in different directions.

Your VPN is not concealing its own existence. Sites can tell, your network operator can tell, and treating VPN use as invisible is a mistake. The protection a VPN offers is that observers cannot see your traffic or your home address — not that they cannot see the tunnel. This is one of the boundaries in what a VPN protects against.

Using one makes you slightly more distinctive, not less. Arriving from a datacentre address is unusual, and it is one more property a fingerprint can include. It does not identify you, and it does not blend you in either — part of why a VPN does almost nothing about ad tracking.

Living with it sensibly

This site does not cover getting around geographic restrictions, and this is not that post. What it does cover is reducing pointless friction while using a VPN for the reasons it is good for.

Choose a server in the country you actually are in. Most of the friction comes from apparent location changes, not from VPN use as such. If your reason for using a VPN is hiding traffic from a local network — the strongest reason there is, per what a VPN changes on public Wi-Fi — then a nearby server serves that purpose completely and looks far less anomalous.

Keep a stable location rather than hopping. Fraud systems react to change more than to any particular value.

Expect additional verification and treat it as reasonable. You removed a signal your bank was using to protect your account; it will ask for something else.

Do not attempt to defeat a control that exists for a legal or contractual reason. Where a service restricts access to meet a licensing, regulatory, or verification obligation, working around it can breach its terms and, depending on the context, more than its terms. That is not a privacy measure and it is outside what this site advises on.

If a service you genuinely need refuses to work over the tunnel, turn the VPN off for that service or use split routing where your client offers it, then turn it back on. That is an ordinary trade-off, and it is a better answer than pretending to be somewhere you are not.

The underlying point is the same one as everywhere else here: a VPN changes who can observe your traffic. It does not change what your traffic looks like from the outside, and the internet has built a substantial industry around reading exactly that.