Three leak paths, three checks

Fixing the address in the IP box does not close WebRTC, IPv6, or DNS.

Sites learn your address in more than one way. The HTTP request that loads a page is the check most people look at. Three other paths are common, and each one can stay open after that IP changes.

WebRTC lets a page ask the browser for ICE candidates. Those candidates can include a local LAN address and a public address gathered outside the tunnel. A matching HTTP IP with 192.168.x.x still printed in the candidate list means the browser punched out beside the VPN. Restrict WebRTC or force it into the tunnel, then reload. A call app that needs WebRTC is a reason to turn the restriction back off later, not a reason to skip the test.

IPv6 is a second route. If the VPN only carries IPv4, the operating system can still send IPv6 to the ISP. The leak test lists that address separately. Disabling IPv6 on the adapter is a practical fix when the profile has no IPv6 exit. You give up dual-stack reachability. Write that down if someone else uses the machine.

DNS is the resolver that answers names. The hostname of that resolver should match what the VPN says it uses. Seeing 1.1.1.1 or an ISP name is a measurement. Compare it to the profile. A resolver you set on the router will keep answering for devices that are not in the tunnel.

Do the three checks after the HTTP IP has already changed. Order matters because a failed IP check makes the other three hard to interpret. Guides for each failure mode: WebRTC, IPv6, and DNS.