Security boundaries: a connection doesn’t protect your credentials
This VPN security guide for beginners starts with the essentials: keep your password and subscription link private. On public Wi-Fi, verify the network and login page, then check whether the client is actually routing traffic. A successful connection does not protect you from phishing pages, reused passwords, or leaked screenshots.
Network traffic, your service account, and accounts on websites you visit are separate layers of protection. VPNLD describes its security as quantum encryption, but that does not replace checking a website's identity in your browser or prevent you from entering a password on a fake page. Check HTTPS, the domain, and browser warnings when visiting a site. Never ignore a certificate warning just to load a page.
Subscription services may work differently from traditional system VPNs. Some clients route app traffic through a system proxy; others use a virtual network interface. A lit icon only indicates that the client is in a particular state. Whether an app uses that route also depends on the proxy mode, split-tunneling rules, and the app's own networking implementation.
Protect account access first, then check the traffic route. Your account controls access to the dashboard, while your subscription link may provide access to connection settings. Website logins and device security still need separate protection; a client showing “Connected” is not enough to confirm either.
Account password: keep it unique and stored securely
VPNLD does not require an email address; you can create an account with a username and password. That limits the information needed to sign up, but it does not mean you should choose a weak password. Don't reuse passwords from your email, work systems, or other websites. If one site suffers a credential breach, reused passwords can put your other accounts at risk of attempted logins.
Use a trusted password manager to generate and store a unique password. Save the username and website address together so you don't have to search for a login page later. Be cautious about saving passwords in a browser on a shared device. Logging out of the dashboard does not clear saved passwords, downloaded files, or clipboard contents from your browser or device.
Check the address bar before entering any information. A brand name, page colors, or HTTPS alone cannot prove that a site belongs to VPNLD. HTTPS mainly indicates that data sent between your browser and the current domain is protected in transit. The site domain is vpnld.com; verify the domain itself rather than relying on the page title or text in search results.
Never give your dashboard password to someone configuring a client for you, and don't enter your full account details into unfamiliar forms. If you forget your password, use an option actually provided in the dashboard or confirm the process through the support page. Don't assume your account can be recovered through a method that hasn't been offered. Store your credentials securely when you first set them up.
Subscription links: treat them as credentials, not shareable URLs
A subscription link lets a client retrieve connection settings, and its token usually functions as an access credential. It may look like an ordinary URL, but anyone who has it could be able to retrieve settings and use the associated service. What the link grants access to, and whether additional authentication is required, depends on the server implementation. Treat it as sensitive from the start rather than waiting for a confirmed leak.
Don't submit a complete subscription link to an unknown online converter. A converter needs to read the input, and the operator of a remote tool may be able to access the link and its configuration. Clients support different subscription formats. Check the setup guide and choose an import method that works with your client instead of trying one converter site after another.
| Information type | Risk if exposed | Recommended handling |
|---|---|---|
| Dashboard password | Someone could try to access your account and use its features | Store it in a password manager; don't share it with anyone helping configure your client |
| Complete subscription link | Someone could retrieve connection settings or use associated traffic | Import it only into a trusted client; remove the entire link before sharing |
| Subscription QR code | Scanning it may reveal the subscription link or configuration credentials | Protect it like the subscription link; never include it in public screenshots |
| Client configuration and logs | May contain tokens, connection credentials, or access domains | Inspect locally, then share only redacted excerpts |
When taking screenshots, don't just hide your account name. Check QR codes, subscription URL fields, parameters beside configuration file paths, and request URLs in error logs. Don't simply cover a small part of a URL. It's safer to crop out the entire sensitive area and show only the error message and relevant client status.
A subscription QR code is not decoration. Even if the URL text is hidden in a screenshot, the QR code may still contain the same credentials.
Public Wi-Fi: verify the network before signing in
Public Wi-Fi risks go beyond connection quality. Similar network names, spoofed sign-in pages, and unexpected certificate warnings can lead you to connect to the wrong network or disclose information. Before connecting, ask venue staff to confirm the network name and sign-in method. Don't choose based only on signal strength, or assume a familiar network name is trustworthy just because you've used it before.
Assess the venue's Wi-Fi sign-in page separately from service login pages. After completing venue authentication, use a trusted saved link to open the VPNLD dashboard or your destination website. If a sign-in page asks for an unrelated account password, payment details, or identity documents, stop and check why before proceeding. Don't submit them just to get online faster.
Some public networks require you to connect directly before completing authentication. Don't mistake an incomplete sign-in for a connection problem, and don't disable every security check on a whim. After authentication, enable the client and verify the actual traffic route. When you leave, turn off automatic connection to that network and choose whether to forget it in your device settings.
- ✅ Before connecting, verify the network name and sign-in page, and turn off unnecessary sharing features.
- ✅ Check the domain and HTTPS when accessing an account page. Stop entering sensitive information if you see a certificate warning.
- ✅ After signing in to public Wi-Fi, check the client mode and the route used by the app you want to access.
- ❌ Don't install an unknown certificate, configuration profile, or remote-control tool just because an unfamiliar page asks you to.
- ❌ Don't assume that “Connected” means your browser, device, and every app have the same protection.
Be especially cautious if a page says you must install a root certificate to continue. A root certificate trusted by your device can change how your browser evaluates website certificates; installing one is not a routine Wi-Fi connection step. Stop and verify the source before installing unfamiliar software or configuration profiles, too.
Client setup, split tunneling, and DNS checks
Check the client download page and setup guide for official download instructions, then sign in to get your subscription. Windows, macOS, Android, and iOS differ in their permission models and proxy capabilities, so don't blindly follow screenshots from another platform. After installation, grant only the permissions the client needs to work. Look up any unusual permission requests before approving them.
Before importing, make sure your client supports the subscription's protocols and configuration format. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different protocol names, not interchangeable labels. Renaming a configuration or importing it repeatedly won't add support for an unsupported protocol. Use a compatible client or configuration instead, and don't assume VPNLD offers all of these protocols.
Split-tunneling rules determine which requests connect directly and which go through a proxy. A system proxy may affect only apps that follow the proxy settings. Virtual network interface mode often covers more traffic, but routing, exclusions, and platform limitations still apply. Global mode also doesn't mean every request on a device must follow the same route.
DNS translates domain names into addresses. A DNS leak occurs when queries expected to follow a proxy-related DNS route are instead sent to another resolver. Browser encrypted DNS, system resolver settings, and client rules can affect one another. Encrypted DNS protects queries in transit, but doesn't guarantee they use the expected exit route.
- Note the current client mode, selected connection, and rules before changing anything. Avoid changing several settings at once.
- Open IP lookup to check whether the browser's exit address matches your current split-tunneling setup.
- Use a trusted DNS check to review resolver details alongside your client DNS settings. Don't draw conclusions from the region name alone.
- Check both your browser and the apps you actually use. A normal browser exit result doesn't prove other apps use the same route.
- If the results don't match, follow the troubleshooting guide to check proxy, routing, and DNS settings one at a time, testing again after each change.
These checks show the traffic route; they don't prove anonymity. Websites may still identify a session through an account login, cookies, or device characteristics. IEPL, relay, and direct connections describe route and transport methods; they don't replace protecting your account or verifying a website's identity.
What to do if credentials are exposed
If you find your subscription link in a public group or an unfamiliar tool, remove any public content you can control first, but don't assume deleting a message resolves the exposure. Someone may already have copied the link. Sign in through a trusted dashboard entry point and check whether a subscription reset or revocation option is available. If there isn't a clear option, ask support through a ticket. Don't guess at new link parameters.
If your dashboard password is exposed, change it. If you use the same password for other accounts, change it there too. An exposed subscription link requires action on the subscription credentials; don't confuse the two. Changing your login password may not invalidate the old subscription link, and resetting a subscription may not change your account password. Follow the dashboard instructions and verify the result.
After confirming the old credentials no longer work, update the subscription on your personal devices and check for any saved old configurations. Remove sensitive information from public screenshots, shared documents, and clipboard sync history. When requesting support, provide the issue, client name, and redacted logs. Don't send your full password or complete subscription link.
Everyday security essentials: Use a unique password, a trusted login link, a private subscription link, and clear split-tunneling rules. If you see an unusual page or certificate warning on public Wi-Fi, pause before entering sensitive information. If credentials have been exposed, revoke or replace them instead of just deleting a screenshot.