The fix, in one snippet
1. Type about:config in the address bar and press Enter
2. Accept "Accept the Risk and Continue"
3. Search for: Media.peerconnection.enabled
4. Click the toggle so the value reads false
Chrome, Edge, Brave: There is no equivalent setting. Use a VPN
client that blocks WebRTC, or an extension such as uBlock Origin
(Settings > Prevent WebRTC from leaking local IP addresses).Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan creates an RTCPeerConnection configured with a public STUN server and gathers ICE candidates without opening a media stream. Server-reflexive (srflx) candidates carry the public address the STUN server saw; host candidates carry local addresses. We compare every candidate address with the IP address our server saw your page request arrive from. The check fails when a public WebRTC address differs from the connection address, which is what happens when STUN traffic bypasses a VPN tunnel, or when an IPv6 candidate appears while the tunnel carries only IPv4. Modern browsers replace local addresses with mDNS .local names; if a real private address (RFC 1918) still appears we report it separately at low severity.
Limits: if you are not using a VPN or proxy, a matching public address is expected and not a leak. If WebRTC is disabled, no candidates appear and the check passes. The standalone WebRTC leak test runs the same probe with more detail.
Why it matters
A VPN carries your traffic through an encrypted tunnel so that sites see the VPN's address. WebRTC's address discovery uses UDP to a STUN server, and if the operating system routes that UDP outside the tunnel (split tunnelling, an IPv6 path the VPN does not cover, a gap during reconnection), the STUN reply contains your real address and any page can read it in JavaScript with no permission prompt. Anyone relying on a VPN for privacy is affected: a single embedded advert can run the probe silently.
How to fix it
Firefox: in about:config set media.peerconnection.ice.default_address_only to true and media.peerconnection.ice.no_host to true, or disable WebRTC entirely with media.peerconnection.enabled false. Chrome and Edge: there is no settings page for this; install Google's WebRTC Network Limiter extension, which sets the IP handling policy to "disable non-proxied UDP". Brave: Settings > Privacy and security > WebRTC IP handling policy > Disable non-proxied UDP. Safari: offers no toggle but hides local candidates by default.
Fix the cause as well: enable your VPN's IPv6 leak protection and kill switch, or disable IPv6 on the network adapter if the VPN does not tunnel it. Then rerun the leak test. Guides: WebRTC leaks explained, VPN vs proxy vs Tor and what your IP address reveals.
Where this fits
WebRTC IP address leak is check 3 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Browser version is out of date (high), where your browser is behind the current stable release, so it is missing security fixes for bugs that attackers already know how to exploit. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
WebRTC IP address leak closes one route in. Immediately below it: Browser enforces X-Content-Type-Options, where your browser executed a script that was served with a non-script content type and X-Content-Type-Options: Nosniff, so it is guessing file types where it should refuse; Browser enforces X-Frame-Options, where your browser displayed a page inside a frame even though that page was served with X-Frame-Options: DENY, so the clickjacking protection sites rely on is not being enforced; Browser fingerprint uniqueness, where the combination of signals your browser exposes matched no other visitor in our sample, so it could be used to recognise you across sites without cookies.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: WebRTC IP address leak (high severity)
Scanner check id: webrtc-ip-leak
What this check tests: WebRTC revealed an IP address that differs from the one your connection uses, typically your real address behind a VPN or proxy.The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 11, 2026
WebRTC Leaks: How Your Browser Can Expose Your Real IP Behind a VPN
WebRTC lets browsers talk to each other directly, and to do that it discovers your network addresses, sometimes bypassing a VPN. The...
Read the guide
8 min read · Updated Sep 08, 2026
VPN vs Proxy vs Tor: What Each Hides, What Each Leaks
All three route your traffic through another machine, and they protect very different things. This guide compares them on encryption,...
Read the guide
7 min read · Updated Sep 10, 2026
What Your IP Address Reveals and How Sites Use It
Your IP address is sent to every server you contact. What it reveals about location and provider, what it does not, how it is combined...
Read the guide