How this works
A leak means some of your traffic bypasses the proxy or VPN you believe it is using, goes out over your local network, and hands your real IP to the other side. A proxy client showing "connected" does not mean every request is under its control.
Before reaching a site, your device resolves the domain to an IP. If that step skips the proxy, your ISP's resolver sees every domain you visit — even when the connection that follows is encrypted and properly proxied.
The usual causes are system-level DNS settings taking precedence over proxy rules, or a proxy client that never took over DNS in the first place.
WebRTC is the browser's built-in peer-to-peer stack, the thing video calls and screen sharing run on. To set up a direct connection it asks a STUN server "what is my public address", and that request can go around the proxy.
The result: the page sees the proxy's IP, while WebRTC hands over your real one. This is the classic leak, and the easiest to overlook.
Many proxies only handle IPv4. If your network also has IPv6 and the destination supports it, the browser may prefer a direct IPv6 route — leaving the proxy out of the picture entirely.
The tell is simple: if this page shows both an IPv4 and an IPv6 that belong to different networks, your traffic is splitting across the two stacks.
Strictly this is not a leak but a contradiction. System timezone, browser language and IP location should agree. An American IP with a UTC+8 clock is a strong signal on its own — a risk system does not need your real IP, only evidence that you are disguising one.
It means the paths this check covers are clean right now. Extensions, other applications and system updates can all introduce new leak paths, so re-test after changing anything.
First enable "resolve DNS through the proxy" or the equivalent option in your proxy client. Failing that, point your system DNS at the address the proxy provides. Changing the browser's secure-DNS setting only covers that one process.
On Chromium browsers, install an extension that restricts WebRTC. On Firefox, set media.peerconnection.enabled to false in about:config. Note that video-call sites will stop working.
Either have the proxy handle IPv6 as well, or disable IPv6 in your system network settings. The latter is more thorough but breaks IPv6-only services.