Option 1: the provider’s app (recommended)
- Install the app from the App Store. Every provider on our iPhone list has one.
- Sign in. On first connection iOS will show a system dialog asking to add VPN configurations — tap Allow and confirm with Face ID. This installs the VPN profile the app will control.
- Connect. A small VPN badge appears in the status bar (in the Dynamic Island area on newer phones).
- Open the app’s settings and turn on Auto-connect / Always-On / On-demand. This is the single most important step. Without it, iOS may drop the tunnel when the app is suspended, and you will be online unprotected without noticing.
- Choose the protocol: WireGuard-family if available.
That is the whole setup for most people.
Option 2: manual configuration (no app)
Useful on a managed work phone, or if you want fewer apps with background privileges.
IKEv2 (built in): Settings → General → VPN & Device Management → VPN → Add VPN Configuration. Choose IKEv2, enter the server address, remote ID and your credentials from the provider’s manual-setup page. Most providers publish these; Proton, Mullvad, IVPN and PIA make them easy to find.
WireGuard (official app): Install the WireGuard app from the App Store, generate or download a config from your provider, and import it by file or QR code. This gives you WireGuard without the provider’s own app, which some people prefer for the smaller attack surface.
Manual profiles support on-demand rules too, but you have to define them in a configuration profile, which is more work than tapping a toggle.
Option 3: on-demand rules that keep it connected
iOS’s on-demand VPN feature lets the system, rather than the app, decide when the tunnel should be up: for example, “always, except on my home Wi-Fi”. Every provider app exposes some version of it — look for Trusted networks, Auto-connect on untrusted Wi-Fi, or Always-On.
With Always-On enabled, iOS also blocks traffic outside the tunnel while it is reconnecting, which is the nearest thing an iPhone has to a kill switch. Test it with the kill switch test: connect, start the test, toggle Airplane Mode for two seconds, and watch whether your real IP appears.
Checking that it worked
Open the leak test with the VPN connected. Your IP country should match the server you chose, WebRTC should show no public address, and DNS should resolve through the provider. If the timezone check shows a mismatch, that is normal — your clock has not moved — but it is something a site can see.
Battery
WireGuard-family protocols add roughly 3–8% to daily drain in our reading of user reports; OpenVPN more. If the phone is noticeably hotter, check the protocol setting first, then whether the app’s ad-blocking feature is on (it can reduce drain by cutting background tracker traffic, or increase it if implemented badly). Battery drain is a minor theme in App Store reviews of all major VPN apps and a major one for a few — the per-app breakdowns on the rankings page show which.
Cancelling
Because it generates more complaints than every other topic combined: App Store subscriptions are cancelled in iOS Settings, not in the VPN app, not on the VPN website. Settings → your name → Subscriptions. Cancel at least 24 hours before the renewal date. If you are charged anyway, request a refund from Apple at reportaproblem.apple.com; the provider cannot refund a purchase Apple processed.