VPNbeginnersafety guide: subscription links, public Wi-Fi, and account security

This VPN security guide for beginners starts with two often-overlooked points: a subscription link is not an ordinary URL, and a client showing “Connected” does not make public Wi-Fi trustworthy. Protect your access credentials first, then check where your client came from and how your traffic is routed. That matters more than switching servers repeatedly.

A network acceleration service changes the route taken by some or all of your network requests. It does not replace website encryption, system updates, or account security, and it cannot stop you from entering your password on a fake site. This guide covers what to check before your first connection, during everyday use, and after credentials are exposed.

Subscription links: protect them as access credentials

Subscription links often contain tokens that identify a user or grant access to a subscription. When a client accesses the link, it retrieves server addresses, authentication details, and related configuration. Anyone who can open the link may be able to view the configuration or use its permissions without knowing the account password. The exact capabilities depend on the service, but the link should never be treated as public tutorial material.

Treat QR codes the same way. A subscription QR code is simply another way to represent the link, not a sanitized image. Before sharing a screenshot, check the address bar, QR code, configuration text, and logs for the full request URL—not just the username. Hiding only a short part at the end of the link may not protect the credentials it contains.

When importing a subscription, use the built-in subscription feature of a trusted client whenever possible. Don’t submit the full link to an unfamiliar online converter just to “change the format.” A conversion service has to read the original configuration, giving another third party access to your credentials. If conversion is necessary, first check which formats your client supports and use a method you can control and understand.

Account security: verify the sign-in page, then save your password

When you first open the account panel, check the full domain in the address bar instead of relying on the VPNMG logo. Search results, forwarded messages, and ads can lead to lookalike sites. Once you’ve confirmed the correct address, bookmark it and use that bookmark next time. HTTPS protects data in transit, but it does not prove that a lookalike site is genuine.

Use a unique password—never reuse one from your email, shopping accounts, or other services. A password manager can generate and store unique passwords, and domain matching can help flag a wrong sign-in page. It is not a complete way to verify a site, but it can reduce mistakes when copying credentials manually. On shared devices, don’t save your account password; sign out when you’re done and delete configuration files downloaded to the device.

VPNMG’s account setup requires no email address. Follow the information requests on the official page, and don’t give agents unrelated identity documents, payment account passwords, or login credentials for other sites. The less information collected, the fewer linked details you need to manage—but that’s no reason to neglect your password or account recovery options.

Recovery processes vary by service, so don’t assume you can always regain access if you forget your details. After creating an account, store your username, password, and available recovery credentials as directed by the account panel. If you notice suspicious activity or configuration changes you don’t recognize, use a trusted device to access the official panel. If needed, contact support through the official contact page.

Public Wi-Fi: check the network and certificate warnings

On hotel, airport, and café Wi-Fi, first verify the network name and how to connect. Asking staff is more reliable than choosing the hotspot with the most familiar-looking name. Turn off automatic joining when you don’t need it, and remove public networks you no longer use when you leave to prevent your device from reconnecting to a lookalike hotspot later.

A public network may require sign-in before your client can connect properly. That does not mean you should provide your account password. Stop and verify the reason if a page asks you to install a root certificate or device management profile, or to disable certificate checks. If your browser shows a certificate warning, don’t dismiss it as a routine network glitch and continue.

On websites using valid HTTPS, a public hotspot generally cannot read the contents of encrypted sessions or your passwords. It may still observe connection metadata, interfere with DNS resolution, or direct you to a fake address. An encrypted tunnel can reduce what the local network sees about traffic inside it, but it cannot protect requests outside the tunnel or fix a device already controlled by malware.

Clients and split tunneling: a successful connection doesn’t mean all traffic is covered

Windows, macOS, Linux, Android, and iOS handle network traffic differently. Some clients use the system proxy, which mainly affects apps that follow proxy settings; others route traffic through a system VPN interface or virtual network adapter. Coverage also depends on client settings, app behavior, and system permissions. A connection icon alone does not prove that every request is going through the tunnel.

Rule-based mode typically decides whether to connect directly or use a proxy based on factors such as domain, address, or app. Global mode generally sends the traffic the client can capture through the selected route, but it does not automatically eliminate system bypasses, an app’s own connection behavior, or DNS configuration issues. When troubleshooting, check the rule mode as well as which rules matched and the connection logs.

DNS translates domain names into addresses. A DNS leak generally means that queries expected to use a particular route were sent to a different resolver. A test page showing resolvers in a different region from your exit location does not, on its own, prove a leak; public resolvers’ deployment and geolocation can also affect the result. Check your client’s DNS settings and resolution logs against the route you expect.

Likewise, seeing a different exit address only confirms the route taken by that particular test request—not that every app uses the same route. Use the network check page to see the current request’s exit address, then follow your client’s instructions to check DNS and split-tunneling settings. Recheck your connection after switching networks, waking your device from sleep, or updating the client.

A pre-connection security checklist

These checks don’t require complex configuration changes. The goal is to use trusted sources at every step and make it easier to identify whether a problem is with the entry point, credentials, or network—rather than changing every setting at once.

• ✅ Verify the account panel’s domain. Get the client from an official source or the panel’s instructions, and check who published it and where it came from.
• ✅ Keep your system and client up to date. On iOS, get the client according to the panel’s access requirements and current instructions; don’t install profiles from unfamiliar sources.
• ✅ Use a unique password and store any recovery information you need. Don’t let someone else configure or manage your account for you.
• ✅ Import subscriptions in a trusted environment. Don’t upload links or QR codes to public image hosts, group chats, or online troubleshooting tools.
• ✅ Understand the current rule mode and which traffic it covers. Check your exit address and confirm that DNS settings match your expectations.
• ✅ Before asking for help, check screenshots and logs. Remove tokens, passwords, and full subscription URLs; share only what’s needed.
• ❌ Don’t install a root certificate just because a webpage claims it will “optimize your network,” and don’t dismiss browser certificate warnings as routine prompts.

For initial setup, see the VPNMG setup guide. Client names and interfaces can change, so follow the current instructions in the account panel. Don’t overwrite your existing client with an old configuration you found online, or import remote rules and scripts from sources you can’t verify; they may change how traffic is routed or how the client behaves.

If credentials are exposed: revoke, update, and verify

If a subscription link has been shared publicly, stop forwarding it first. Then access the account panel through a trusted link and look for an option to reset the subscription or update its credentials. Contact official support if the option is unavailable or unclear. Reset options vary by service, so don’t assume that changing the link also invalidates credentials in configurations already exported.

1. Check what has been invalidated. Confirm that the old subscription URL no longer works and whether old server authentication details need to be revoked separately. Include any downloaded configurations in your response.
2. Update your devices. After confirming the old credentials have been revoked, import the new subscription and remove the old configuration. Check whether any clients still running are using cached settings.
3. Check account control. If your account password was also exposed, change it promptly. Check any available session management, configuration changes, and unusual traffic information.
4. Limit further sharing. Remove public screenshots and files, and ask anyone who received them not to share them. This can limit further spread, but it does not replace revoking credentials.

When contacting support, describe what happened, which types of information were affected, and what steps you’ve taken. Don’t repost full secrets unless the official process explicitly requires them. If you can’t confirm whether old credentials are invalid, follow up with support instead of assuming the issue is resolved because your client reconnects.

VPNMG’s privacy policy is “no logs.” That is a service policy; it does not mean websites, devices, payment processes, or local networks stop generating information. Consider each of these boundaries when assessing privacy risks. Protecting your account and subscription link is still something you can do directly—and it’s worth prioritizing.