How We Test VPNs: Our Planned Method and What We Refuse to Fake

Most VPN review sites say they “test everything.” Fewer show you the notebook. This page is that notebook’s table of contents: what we will run, what we refuse to invent, how money relates to rankings, and how often we come back.

Honest VPN Guide is operated by LiBrAi. We write for people burned by intro pricing, stock speed graphics, and “#1 VPN” badges that never expire. If a claim on our site cannot point to a method or a dated log, it should not be on the site.

What we refuse to fake (refusal list)

Hard rules, not mood-board aspirations:

No fake or stock speedtests. We do not paste vendor charts, recycle another site’s Mbps table, or invent a number to fill a cell. A cell without a real measurement says “No test data yet” until a real run exists.
No eternal “#1 VPN”. A ranked pick carries a date and a defined job (e.g. “best renewal honesty among tested paid plans on a stated date”). Without comparative data on that date, we do not use the phrase.
No cookie-stuffing or forced clicks. Affiliate links are disclosed; they are not injected into unrelated downloads or hidden iframes.
No illegal torrenting / piracy “safety” promises. A VPN encrypts traffic to an exit. It does not legalize copyright infringement. We will not sell that story.
No rubber-stamp “no logs.” We read what the claim covers, what audits exist, and what jurisdiction implies. Marketing adjectives are not evidence.
No thin copycat pages. We do not mass-produce “Best VPN for [city / ISP / obscure device]” pages without unique tests. Reworded clones of our main ranking don’t get published.
No invented personal drama. We do not fabricate “I used this on a train in Lisbon and…” anecdotes. First-person lines appear only for real, attributable test sessions — and we never write as if a session happened before it did.
No silent demotion of non-affiliate products. Mullvad has no affiliate program. If it belongs in a comparison, it stays in the comparison.

If we break a rule on this list, the fix is a public correction — not a quiet edit.

What we test

Status on 13 November 2026: we have not run any hands-on speed or streaming tests yet. The steps below are the method we will follow, and results will be published with dates as they come in.

Setup & environment notes

Every logged session should record:

Date and time with zone (we default to Europe/Amsterdam unless noted)
Machine OS and version; VPN client version
Network path in plain language (home fiber / cable / LTE; ISP if known)
Approximate unVPN’d capacity (so a “slow VPN” isn’t just a slow line)
Protocol selected (WireGuard, OpenVPN UDP/TCP, Lightway, etc.)
Server region chosen and why (nearest fair compare vs intentional distant hop)

We are not a university lab. We are a consistent kitchen table: same habits, written down, repeatable enough that a skeptical reader can spot when a comparison was unfair.

Connection & protocol checks

Install from the vendor’s official site or store listing (note which).
First connect success / failure; time-to-connect is optional but useful when it is awful.
Reconnect after sleep, after network switch (Wi‑Fi → LTE if available), after intentional disconnect.
Kill-switch: drop the VPN process or interface and see whether traffic leaks. Describe the failure mode in words, not vibes.

Leak tests (DNS / IPv6 / WebRTC)

For each OS + browser combo we claim to cover:

DNS leak test via a reputable checker; record resolver IPs and whether they match the VPN.
IPv6: address present or not; if present, is it tunneled or leaking outside the tunnel?
WebRTC: browser test; note browser name/version because results differ.

Failures are published. “Mostly fine” is not a pass.

Speed methodology (raw, dated, contextual)

Speed without context is fan fiction.

Working protocol:

Baseline without VPN — several runs, keep median.
Nearby VPN server — several runs, same protocol family across vendors when possible.
Distant server — same idea, to catch routes that fall apart over long paths.
Report median and a simple spread (min–max or similar). Do not publish only the best burst.
Never compare Vendor A on gigabit fiber at midnight to Vendor B on congested LTE at noon and call it science.

Until we have run a test, the tables on our comparison pages show no speed numbers. That is deliberate: an empty cell is better than a made-up one.

Streaming checks (dated pass/fail logs)

Streaming is adversarial. CDNs and VPN exits change.

Rules:

Name the service and library region we actually opened.
Result is pass, fail, or flaky (define flaky: e.g. worked once, failed on retry the same hour).
Retest on a published cadence (see below). Old “works on Netflix” screenshots are not evergreen content.
We describe product behavior. We do not coach readers on breaking local law.

Features, apps, and support sanity checks

Not every toggle needs a novel. We do check:

Split tunneling availability and whether it is usable
Multi-hop / Secure Core style options when advertised
Mobile apps: connect reliability, obvious battery or background-data pain in short use, account recovery clarity
Support: docs quality; one real support contact attempt when relevant (ticket ID in the log, not a manufactured five-star review)

Jurisdiction, audits, and “no logs” reading

Desktop research counts when it is dated and linked:

Where the operating company says it is based; what that implies for data requests (plain language, not fearmongering)
Latest independent audit, if available: who, when, scope, checked against the original report before we cite it
What “no logs” includes and excludes (connection timestamps, account email, payment processor records, capacity metrics)

We cite Privacy Guides and similar non-affiliate resources when they are the clearer explanation — without copying their shortlist as our monetized ranking.

How affiliates relate to rankings

LiBrAi / Honest VPN Guide may earn commissions from VPN and privacy brands (NordVPN/NordPass, Surfshark/Incogni, Proton, Malwarebytes, ExpressVPN and others) if a program is approved later. Today we are in no affiliate program. Full details are on the About / Advertising Disclosure page.

Ranking rules that do not bend:

Commission size does not set rank order.
Lack of a program does not exclude a product. Mullvad is the standing example.
We disclose commercial relationships where they apply; a vendor mentioned in an article is not necessarily an approved partner.
We do not cookie-stuff, run brand-bid tricks that partner terms ban, or hide the commercial relationship.

If a vendor’s product is weak in tests, the review stays weak even if the affiliate payout looks attractive in a publisher dashboard.

What “no logs” actually means (and what it does not)

“No logs” is often three different claims sold as one:

No traffic content logs — the vendor says it does not record the websites you visit. Still ask how that is enforced and audited.
No connection logs — timestamps, source IPs, session lengths. Some providers keep minimal operational data; some claim zero. Read the wording.
No identifying account trail — email, phone, payment. Many “no logs” VPNs still know you paid somehow. Mullvad-style account numbers and cash payment options are designed to shrink that trail; check the vendor’s current payment options before relying on them.

A VPN also does not:

Erase cookies and login sessions in your browser
Stop the site you log into from seeing your account activity
Guarantee safety for illegal file sharing

When vendors overclaim, we say so. When audits are old, we date them instead of pretending they are fresh.

Retest cadence

Planned cadence (we will adjust it once we have a quarter of real data):

Check	Cadence
Kill-switch + leak quick pass on top picks	Monthly, or after major client updates
Speed sample (nearby + one distant)	Monthly for the VPNs in our main comparison
Streaming log for listed services	Monthly (or sooner if readers report breakage)
Pricing intro vs renewal capture	At least quarterly, and before any “deal” post
Audit / jurisdiction desk check	When vendors announce changes; otherwise quarterly
Full test set on a new major version	Within two weeks of a stable release we can install

Missed cadences get admitted on the page (“streaming table last refreshed …”) rather than silently aging into false confidence.

Sample test-log template

Copy this into a new file per session. Fill every field or mark n/a with a reason.

TEST LOG — Honest VPN Guide / LiBrAi
====================================
Date/time (Europe/Amsterdam):
Tester: LiBrAi
Vendor / plan:
Client version / OS:
Network (ISP, access type, approx baseline capacity):
Protocol:
Server region (label + why chosen):
CONNECT
- First connect OK? (Y/N + notes)
- Kill-switch test method + result:
LEAKS
- DNS checker used + result:
- IPv6 result:
- WebRTC browser(s) + result:
SPEED (note tool; multiple runs)
- Baseline median down/up:
- VPN nearby median down/up (number of runs):
- VPN distant median down/up (number of runs):
- Anomalies:
STREAMING (optional this session)
- Service / library:
- Result: pass | fail | flaky
- Notes:
DESK RESEARCH TOUCHED THIS SESSION
- Audit PDF date/link:
- Pricing intro (vendor page, same hour):
- Pricing renewal (vendor page, same hour):
- “No logs” wording notes:
RAW NOTES:

Empty logs are better than decorative ones.

How to challenge a result

If you believe a published result is wrong:

Email info@honestvpnguide.com.
Include vendor, date of our claim, your OS/client versions, and what you observed.
We retest when the challenge is specific. Vague “your review sucks” mail does not move a table.

Corrections get a note on the affected page with a new date.