VPN Keeps Automatically Turning On on iPhone? How to Stop It

If your iPhone VPN keeps turning itself back on, the cause is almost always Connect On Demand: a per-profile iOS setting that reconnects the VPN automatically, even after you switch it off. Turn it off under Settings > General > VPN & Device Management > VPN, tap the (i) next to your VPN, and toggle Connect On Demand off. If that doesn’t fix it, the culprit is usually the VPN app’s own auto-connect or always-on feature, or a configuration profile installed by your work or school.

Below is how each of these works and how to deal with them in order. Menu names are as of October 2026 and may shift slightly between iOS versions and VPN app updates.

Why the VPN keeps reconnecting

iOS supports VPN “On Demand” rules: a VPN profile can tell the system to bring the tunnel up automatically under certain conditions, such as joining Wi-Fi, using cellular data, or reaching particular domains. Apple’s deployment documentation describes these rules as a list the device works through in order, with the first matching rule deciding what happens.

The catch is that the main VPN switch in Settings doesn’t override those rules. As the Algo VPN client guide puts it, simply disabling the VPN “will not cause it to stay disabled; it will just ‘Connect On Demand’ again.” You have to turn off the on-demand behavior itself.

There are four common sources of the behavior:

Step 1: Turn off Connect On Demand in Settings

This fixes the problem in most cases.

1. Open Settings.
2. Tap General, then VPN & Device Management.
3. Tap VPN to see your VPN configurations.
4. Tap the (i) button next to the VPN that keeps turning on.
5. Switch Connect On Demand off.
6. Go back and switch the VPN Status toggle off.

Do steps 5 and 6 in that order. If you disconnect first while on-demand is still enabled, the VPN may simply reconnect.

If you have several VPN apps installed, each has its own entry. Check every one, because a second app’s profile may be the one reconnecting.

Step 2: Turn off auto-connect inside the VPN app

Many VPN apps have their own auto-connect setting that works alongside the iOS one. If you turn off Connect On Demand in Settings but leave the app’s auto-connect on, the app may turn it back on next time you open it.

The exact menu depends on the app. For example, NordVPN’s help center describes an Auto-connect option in the app’s settings, where you choose when it applies (such as on Wi-Fi or always), plus a Trusted Wi-Fi networks list for networks where it shouldn’t auto-connect. Look for similar wording in your app: “Auto-connect”, “Connect on launch”, “Connect on untrusted Wi-Fi” or “On-demand”.

If you use the WireGuard app or a similar profile-based client, open the tunnel’s settings and turn off the on-demand options for Wi-Fi and cellular.

Apps with always-on reconnect

Some apps deliberately reconnect when the tunnel drops and don’t let you disable it. Proton VPN is one example: its support page says the always-on feature is permanently activated in the iOS app, reconnecting automatically if you get disconnected from a server. With apps like this, disconnect from inside the app rather than from Settings, so the app knows you meant to stop. Check your provider’s current documentation, since these behaviors change between app versions.

Step 3: Check for a configuration profile

If the Connect On Demand switch is missing, greyed out, or flips back on, a configuration profile is the likely reason. Apple’s deployment documentation for third-party VPN app configurations includes a setting that prevents users from toggling VPN On Demand, which removes the Connect On Demand switch from Settings for that profile.

To see what’s installed:

1. Open Settings > General > VPN & Device Management.
2. Look under the configuration profile or device management sections. If none appear, no management profiles are installed.
3. Tap a profile to see what it contains.

Apple’s guide to reviewing and deleting profiles explains that you can select a profile and delete it, then restart the iPhone. It also warns that removing a profile deletes all of its settings, so a work or school VPN in that profile will stop connecting to that network. If the iPhone belongs to an employer or school, talk to the administrator first. A supervised or organization-managed profile may not be removable by you at all, and removing it could cut off access to work email or apps.

Only delete a profile you recognize and installed yourself, such as one left over from a VPN service you no longer use. If you find a profile you don’t recognize on a personal phone, Apple’s personal safety guide is a good starting point for working out where it came from.

Step 4: Remove VPNs you no longer use

Old VPN configurations can linger after you stop using a service. To clean up:

1. Turn off auto-connect in the app, if it’s still installed.
2. Delete the app.
3. Check Settings > General > VPN & Device Management > VPN. If the entry is still listed, tap (i) and use the option to delete the VPN.

Step 5: Restart and test

Restart your iPhone, then test the situations that used to trigger the VPN: switch Wi-Fi off and on, move between Wi-Fi and cellular, and open the apps you normally use. If the VPN icon stays off, you’re done.

If it still comes back:

• Re-check every VPN entry for Connect On Demand. Some apps re-enable it when they update or when you open them.
• Check for security or content-filtering apps that install their own VPN configuration; they show up in the same VPN list.
• Contact your VPN provider’s support, or your IT team for a managed device.

Should you stop auto-connect at all?

Auto-connect exists for a reason: it keeps you protected on networks you don’t control, such as hotel, airport or café Wi-Fi, without relying on you to remember. Turning it off means you need to connect manually whenever you want that protection.

If what bothers you is the VPN running at home, a better option may be to leave auto-connect on and add your home Wi-Fi as a trusted network, if your app supports it. You get the convenience at home and the protection elsewhere.

If the VPN belongs to your employer, it may be required to reach company resources. In that case, don’t try to work around it; ask IT whether the on-demand rules can be adjusted.