Getting real security value out of a VPN comes down to a few consistent habits, not complicated settings. This beginner checklist covers three things only: how to set up your account, how to store your subscription link, and what order to do things in on public Wi-Fi. Every item is doable today, with no technical background required.
Accounts and credentials: nothing extra at sign-up
Let's be clear about one thing: using a service like this doesn't require handing over a full identity profile. At VPNAK, sign-up asks only for a username + password — no email address required. That means you don't need a dedicated email just to get started, and there's one less piece of information that could be leaked or reused in a credential-stuffing attack.
Filling in less at sign-up doesn't mean you can pick any password. Your username and password are the only credentials, so treat them like this:
- Don't reuse your username: avoid your real name, your usual social handle, or a login name you use on other sites.
- Generate a unique password: never share a password with your email, payment, or social accounts. Let a password manager generate and store it — length matters more than complexity.
- Payment channels are just payment rails: this site supports Alipay, WeChat Pay, and USDT — pick whichever is easiest for you; the payment itself happens on the provider's side.
- Never pass your credentials to anyone: legitimate troubleshooting never needs your password or your subscription link. If anyone asks for either while offering to 'take a look at why it won't connect', treat it as phishing.
A username + password is all sign-up needs — no email address. Treat those two as your only credentials: don't screenshot them, don't forward them, and never tick 'remember password' on a shared device.
Your subscription link is your account
A subscription link is a URL with credentials baked in. Once a client imports it, that client pulls the server list automatically and keeps it updated — in other words, anyone who can open the link can import your servers into their own client. It's easier to exploit than a password: a password still needs a login screen, while a subscription link only needs one paste.
These are the situations where beginners most often give their subscription link away:
- Posting a screenshot in a group chat to ask 'why won't it connect?' — with the full subscription URL visible in the image;
- Pasting the link into an online 'subscription converter' to get a custom-format URL;
- Committing the link to a public Git repo, a cloud-drive share, or a forum help thread;
- Sending the link to someone claiming to be support so they can 'set it up remotely for you'.
Once a link leaves your device, treat it as leaked: rotate the subscription URL as soon as you can, then re-import it on every device — the old address stops working. When you post a screenshot for help, blur the address bar and any QR code and keep only the error text; that's plenty of information.
Bottom line: a subscription link is as sensitive as a password — or more so. It should only ever move between clients on your own devices, never into a chat window and never onto a third-party website.
Public Wi-Fi: risk order and the right sequence
The risk on public Wi-Fi isn't the Wi-Fi itself — it's who else is on the same network. Three things show up again and again on open networks: passive observation from the same subnet, fake hotspots using a familiar SSID, and phishing pages dressed up as a login portal. Each calls for a different response, and the order matters.
| Scenario | VPN not connected | VPN connected |
|---|---|---|
| Plain HTTP page content | Devices on the same subnet can observe the request content | Content travels inside an encrypted tunnel; the same subnet can't read it directly |
| DNS queries | Can be observed, and can be answered with the wrong result | Resolution happens at the route's exit, but leaks still need checking |
| Captive portal login page | No way to tell whether the page is genuine | You still have to verify the domain and certificate yourself |
| Admin panels, email, and payment tasks | Not recommended | Do it only after confirming you're connected, and check the address bar first |
There's only one correct order: connect the route first, then log in. Many people sign into email or an admin panel first and only then remember to turn on the VPN — that gap is exactly when the risk is highest. Hotel, airport, and café networks especially.
The 'login page' on public Wi-Fi is the most common phishing spot. If your browser throws a certificate warning, don't click 'continue anyway' — check that the domain in the address bar is right first; if you're not sure, switch to your phone's hotspot for that task.
Client import, routing rules, and DNS checks
Importing a subscription works the same way on every platform: copy the subscription link → open the client → choose 'Import from subscription / Add subscription' → paste → update servers. The protocol type (Shadowsocks, VMess, Trojan, VLESS, Hysteria2, TUIC) is determined by the subscription content and detected automatically by the client, so beginners don't have to pick one. As for route types, the difference between IEPL dedicated lines, relay, and direct connections comes down mainly to path and stability — the encryption is the same, and the security model doesn't change with the route type.
Choosing routing rules
Clients usually offer a rule mode and a global mode. Rule mode sends local sites direct while international sites go through the route, which is smoother for everyday use; global mode pushes all traffic through the route and is handy for checking whether a specific app is bypassing the proxy. If you want to verify that a single app really goes through the route, switch to global mode temporarily and test again — that gives the clearest answer.
Confirm DNS isn't leaking
A DNS leak means your traffic goes through the route, but domain resolution is still handled by the local network. To check, query a domain that echoes back the resolver's address and see whether the result matches the exit you expect:
# macOS / Linux
dig +short TXT o-o.myaddr.l.google.com @ns1.google.com
# Windows
nslookup -type=TXT o-o.myaddr.l.google.com ns1.google.comIf the returned address clearly belongs to your local network or your local ISP's range, resolution isn't following the route — turn on 'use route DNS' or the equivalent switch in the client and test again. Also, after connecting, check the exit region with any IP lookup site; if it matches the server you selected, your traffic really is going out through the route.
One difference per platform
- Windows / macOS: the desktop client can enable system-wide takeover (TUN or system proxy) so apps without proxy settings also go through the route.
- iOS: the connection is set up through a system configuration; the first time you enable it, iOS shows a permission prompt — just confirm it comes from the client you installed.
- Android: it goes through the system's connection authorization flow; after granting it, switch rule modes inside the client as needed.
- Linux: mostly a command-line client plus a rules file — good for writing your routing rules out clearly and then running long-term.
An account has no device limit — phone, computer, and tablet can be online at the same time, so there's no need to share your subscription link with someone else to save a device slot. That's one of the most common reasons subscription links leak in the first place.
A security checklist you can actually follow
Work through the list below and tick items off as you go. The first six are habits; the last three are things to avoid outright.
- ✅ Set a unique username and password — never reuse a password from your email, payment, or social accounts.
- ✅ At sign-up, fill in only a username and password — no email address, no extra details.
- ✅ Keep the subscription link between clients on your own devices, and blur the address when you post a screenshot for help.
- ✅ On public Wi-Fi, connect the route first, then log into email, admin panels, or payment accounts.
- ✅ After switching networks, use an IP lookup site to confirm the exit region matches the server you picked.
- ✅ Turn on system-wide takeover on desktop so individual apps can't bypass the proxy and connect directly.
- ❌ Pasting your subscription link into an online converter to get a new format.
- ❌ Entering your email or admin password while the route isn't connected.
- ❌ Ignoring a browser certificate warning and continuing to the login page.
Bottom line: security comes from a consistent order of operations, not from the number of settings. Unique account credentials, a subscription link that never leaves your devices, and connecting the route before logging in on public networks — get those three right and you've avoided the vast majority of beginner-level risk.
When you're ready to go deeper, read on in order: Beginner to Advanced covers the basics of protocols and routes, Guides walks through import steps platform by platform, and Server List lets you check route types by region.
VPNAK
110+ countries / 160+ routes, unlimited devices, 7-day no-questions-asked refund.