How to Block ISP Tracking Without False Promises

To block ISP tracking effectively, use three layers: HTTPS for the contents of web sessions, encrypted DNS for domain lookups, and a full-device VPN when you also want to conceal browsing destinations from your internet provider. No single switch makes you anonymous, and changing DNS alone is not enough.

The practical setup is straightforward: require HTTPS, turn on DNS over HTTPS (DoH) or DNS over TLS (DoT), then use a trustworthy VPN with its kill switch enabled. Your ISP will still know you are its customer, see when you connect, and measure how much data you transfer.

What your ISP can actually see

Your ISP operates the connection between your home or mobile device and the wider internet. It therefore knows the IP address assigned to you and can observe connection metadata such as destination IP addresses, timing, duration, and traffic volume.

Plain DNS adds a much clearer signal. A DNS request translates a domain such as example.com into an IP address. If that request travels unencrypted to your ISP’s resolver, the ISP can read it directly. DoH and DoT encrypt this part of the exchange between your device and the resolver.

HTTPS protects the page content, passwords, messages, URL path, and query string in transit. It does not hide every connection clue. The destination IP remains visible without a VPN, and the Server Name Indication (SNI) in a TLS handshake can reveal a hostname unless the connection uses Encrypted Client Hello (ECH). One IP can host many sites, so an IP address is a clue rather than always a definitive browsing record.

Signal	HTTPS only	Encrypted DNS added	Full-device VPN added
DNS lookup	May be visible in plaintext	Hidden from ISP; visible to the chosen resolver	Normally sent inside the VPN tunnel
Website content and full URL	Encrypted	Encrypted	Encrypted inside the VPN tunnel and by HTTPS
Destination IP or exposed SNI	Can remain visible	Can remain visible	Hidden from ISP behind the VPN server connection
Timing and data volume	Visible	Visible	Still visible, but tied to the VPN connection
Your identity on a signed-in site	Visible to the site	Visible to the site	Still visible to the site

This is why a layered setup works better than a single privacy toggle. For the broader picture beyond ISP visibility, our online privacy guide covers account security, browser tracking, and device hygiene as separate problems.

How to block ISP tracking step by step

1. Require HTTPS in your browser

HTTPS prevents the ISP and other on-path observers from reading the contents of a properly encrypted web session. Do not continue past a certificate warning on a sensitive site.

On desktop Chrome, open Settings > Privacy and security > Security and enable Always use secure connections. Chrome will try HTTPS first and warn before loading a site that does not support it.

In Firefox, open Settings > Privacy & Security, find HTTPS-Only Mode, and enable it for all windows. A rare site that genuinely requires plain HTTP should be treated as an exception, never as the default for logins, payments, or private messages.

HTTPS is essential, but it is not the whole fix. It protects what you exchange with a site, not all the metadata used to establish that connection.

2. Turn on encrypted DNS

Use DoH or DoT so your domain lookups are not sent across the access network as readable DNS traffic. Both protocols encrypt DNS between your device and the resolver; DoH carries queries in HTTPS, while DoT uses a dedicated TLS connection.

Current setup paths are:

1. Chrome on desktop: go to Settings > Privacy and security > Security, enable Use secure DNS, and select a known provider or enter its documented DoH endpoint.
2. Firefox on desktop: go to Settings > Privacy & Security > DNS over HTTPS. Choose Increased Protection or Max Protection if you do not want Firefox’s Default Protection behavior to fall back under certain network, VPN, parental-control, or enterprise conditions.
3. Android: go to Settings > Network & internet > Private DNS, select Private DNS provider hostname, and enter the DoT hostname published by your resolver.

Choose the resolver deliberately. Standard DoH hides queries from your ISP, but the DNS resolver can still see both your IP address and the domains you request. You are moving that slice of trust, not eliminating it.

Browser-level secure DNS protects that browser. A system setting can cover more apps, while a correctly configured full-device VPN usually carries DNS through its tunnel.

3. Use a full-device VPN when destination privacy matters

Encrypted DNS hides the lookup, but your ISP can still observe the IP addresses your device contacts and any SNI left exposed by the TLS connection. A VPN addresses that gap by creating an encrypted tunnel from your device to a VPN server. The ISP sees the VPN server connection rather than the individual destinations inside it.

Use the provider’s full device app, not only a browser extension, if you want other apps protected. Connect before opening the activity you want inside the tunnel. Enable automatic connection on untrusted networks if the app offers it.

A VPN shifts visibility to another party. The VPN operator handles traffic leaving the tunnel, so ownership, logging policy, independent assurance work, app security, and business model matter. Our guide to what a VPN does and does not hide explains that trust boundary in more detail.

4. Close the common bypasses

Turn on the VPN’s system-level kill switch where available. It should stop ordinary traffic if the tunnel drops instead of silently returning you to the ISP-visible connection. Test the setting on the exact operating system you use because kill-switch behavior can differ by platform and app version.

Review split tunneling too. Any app you deliberately exclude from the VPN remains on the normal ISP route. That may be useful for a printer, bank, or local streaming device, but it is not private from the ISP.

5. Verify the result on every important device

After enabling encrypted DNS, use the resolver’s official connection-check page to confirm that requests reach the intended service and use an encrypted protocol. After connecting the VPN, confirm that a public IP check shows the VPN exit location rather than your home or mobile IP.

Then run a DNS leak check linked by the VPN provider. The displayed DNS servers should match the provider or resolver you intentionally selected, not unexpectedly identify your ISP. Repeat these checks after major browser, operating-system, router, or VPN-app updates.

Where a VPN genuinely fits

If your goal is to conceal browsing destinations from your ISP rather than only encrypt DNS, NordVPN is our practical pick. Its current support documentation lists DNS leak protection and an automatic kill switch, while the exact kill-switch behavior varies across operating systems. NordVPN also announced its sixth independent no-logs assurance engagement in February 2026.

The honest drawback is the trust transfer: NordVPN becomes the operator on the far side of the encrypted tunnel. Nord Security and Surfshark merged in 2022 and state that the two VPN brands continue to operate independently. Read the privacy policy as well as our full NordVPN review before deciding.

No VPN can hide your total data usage from the ISP, repair an infected device, or stop a website from recognizing your signed-in account. It may also add latency or fail on a network that blocks VPN traffic.

What this setup does not protect against

Incognito or private-browsing mode is not an ISP privacy tool. It mainly limits what the browser saves locally after the session; it does not encrypt the network connection beyond the protection already provided by HTTPS, encrypted DNS, or a VPN.

A VPN does not remove cookies, ad identifiers, tracking pixels, or browser fingerprints. Websites can still identify you when you sign in, pay, reuse an email address, or share personal information. A secure browser setup can reduce some browser-level tracking, but it cannot make you invisible either.

Encrypted DNS alone does not hide destination connections. A VPN alone does not make unsafe HTTP content magically trustworthy beyond the encrypted first hop, so HTTPS remains important. Neither tool replaces updates, malware protection, strong passwords, multifactor authentication, or caution around phishing.

Workplace, school, and managed devices may include monitoring software or mandatory controls. Do not alter them without authorization. VPN laws and network rules vary, so check the rules that apply where you are.

The shortest effective setup

Enable HTTPS-Only or secure-connection mode, turn on DoH or DoT with a resolver you trust, and use a full-device VPN with a kill switch when you want to hide destinations from your ISP. Verify the public IP and DNS route instead of assuming the toggles worked.

FAQ

Can my ISP see my browsing history when I use a VPN?

Your ISP can see that you connect to a VPN server, when the connection occurs, and how much data moves. With a correctly configured full-device VPN, it should not see the individual websites and app destinations carried inside the encrypted tunnel. The VPN provider and destination services occupy different points of visibility. See our guide on whether a VPN can be tracked for the fuller picture of what your ISP, sites, and governments can see.

Does incognito mode hide activity from my ISP?

No. Incognito mode mainly changes what the browser retains on your device, such as local history and cookies after you close the session. Network traffic still follows the same ISP route unless HTTPS, encrypted DNS, or a VPN protects the relevant part of it.

Is changing my DNS enough to stop ISP tracking?

No. Switching to DoH or DoT prevents the ISP from reading DNS lookups between your device and the resolver, but destination IP addresses, timing, traffic volume, and sometimes SNI can remain visible. Use a VPN if you also want to hide destination connections from the ISP. If your connection also seems throttled, see our guide on testing and stopping ISP throttling.

Can an ISP see which pages I visit on an HTTPS site?

HTTPS encrypts the full URL path, query string, and page contents. Without a VPN, the ISP may still infer or identify the site from DNS, the destination IP, or exposed SNI, but it should not see the specific page path or the data exchanged inside a valid HTTPS session.