WebRTC leak
A WebRTC leak exposes your real public or local IP address through the browser's WebRTC APIs even while a proxy or VPN is active.
What a WebRTC leak is
WebRTC is the browser technology behind video calls, screen sharing, and peer-to-peer file transfer. To connect two browsers directly, each one has to learn its own addresses: the private address on the local network and the public address seen from the outside. The browser collects these "ICE candidates" by asking a STUN server, and any web page can start that process with a few lines of JavaScript, without asking permission and without showing anything on screen.
A WebRTC leak is the result: a page reads an address from the candidate list that differs from the address your proxy or VPN presents. In the worst case that is your real public IP, which identifies your provider and country and makes the proxy pointless.
Why proxies do not stop it
Browser proxies apply to HTTP and WebSocket traffic. WebRTC sends UDP packets directly from the operating system, so a SOCKS or HTTP proxy configured in the browser never sees them. A system-wide VPN catches them, but only if it is active for all interfaces and does not allow split tunneling.
Why it matters
Any site can run this check silently. Fraud and bot systems routinely compare the WebRTC public address with the connecting address; a difference is treated as a proxy with high confidence. Our anonymity score deducts 15 points when WebRTC exposes a public address that is not your connection's address.
How to check
Open the WebRTC leak test. It gathers candidates the same way a hostile page would and lists every public and local address it found, marking any that differ from your connection. Modern browsers replace local addresses with mDNS names like a1b2c3d4.local, so seeing a .local name instead of 192.168.x.x is normal and not a leak. The IP leak test runs this check together with the DNS and IPv6 tests.
How to fix it
Disable WebRTC or restrict it to the proxy interface. Firefox has media.peerconnection.enabled; Chromium-based browsers have no built-in switch but accept extensions and enterprise policies that limit ICE to the default route. Antidetect browsers normally offer a WebRTC mode that either disables the API or substitutes the proxy's address; choose the substitution mode when a site needs WebRTC to function. Re-run the test after every change.