How to stop your ISP from seeing the sites you visit

Your internet service provider knows which sites you visit. Not the exact content of the pages (if the site uses HTTPS), but the domain names: it knows you visited a particular health site, a particular forum, a particular streaming service, at what time and for how long. This information passes through its DNS servers and through the metadata of your connections. In most countries, ISPs are even legally required to retain this data for a set period. In the UK, the Investigatory Powers Act requires ISPs to store browsing records for 12 months. In the US, there is no federal retention law, but ISPs are free to collect and sell browsing data since the repeal of FCC privacy rules in 2017.

This is not paranoia, it is how the network works. When you type an address in your browser, your device sends a DNS query to your ISP's server to translate the domain name into an IP address. This query is sent in plain text, without encryption, and your ISP logs it. Even though the page content is encrypted via HTTPS, the ISP sees the name of the site you are requesting. It is like sending a letter in an opaque envelope: the postman cannot read the contents, but he sees the recipient's address.

What your ISP sees exactly

To protect yourself properly, you first need to understand what your ISP can and cannot see:

What it sees: the domain names you visit (via DNS queries), the IP addresses of the servers you connect to, the timestamps of each connection, the volume of data exchanged, and in some cases the SNI (Server Name Indication), an unencrypted field in the TLS handshake that reveals the site name even without going through its DNS.

What it does not see (if the site uses HTTPS): the content of pages, the credentials you enter, the messages you send, the files you download. HTTPS encrypts the content, but not the connection metadata.

The distinction matters. Knowing that you visited a medical consultation site at 3am is already sensitive information, even if the ISP does not know which exact page you viewed.

Changing DNS servers: the first step

The simplest and quickest way to stop your ISP from seeing your DNS queries is to stop using its DNS servers. By default, your device uses your ISP's DNS. Every time you visit a site, the query passes through their servers, and they log it.

By switching DNS servers, you send your queries to a third party (Cloudflare, Google, Quad9) instead of your ISP. But be careful: if you simply change DNS servers without enabling encryption, your queries still travel in plain text over the network. Your ISP no longer processes them, but it can still intercept them in transit.

For the change to be truly effective, you need to use encrypted DNS. Two protocols exist:

DNS over TLS (DoT) encrypts DNS queries via the TLS protocol on port 853. This is the protocol used by Android 9+'s "Private DNS" feature. You enter a hostname like one.one.one.one (Cloudflare) or dns.google and all your queries are encrypted. Your ISP can see that you are communicating with an external DNS server on port 853, but can no longer read the content of the queries.

DNS over HTTPS (DoH) encrypts DNS queries via HTTPS on port 443, the same port as normal web traffic. The advantage: DNS queries are indistinguishable from regular web traffic. The ISP cannot even see that you are making separate DNS queries. Firefox, Chrome, Edge and Brave all support DoH in their settings.

The main encrypted DNS servers:

The SNI problem: DNS is not always enough

Even with encrypted DNS, your ISP can still see the sites you visit in some cases. When your browser connects to an HTTPS server, it sends the site name in plain text in a field called SNI (Server Name Indication) during the TLS handshake. This field allows the server to know which SSL certificate to present when it hosts multiple sites on the same IP address.

An ISP inspecting your connection metadata can read this SNI field and see the site name, even if you are using encrypted DNS. This is a known gap, and the solution is called ECH (Encrypted Client Hello), formerly known as ESNI. ECH encrypts the SNI field, making it impossible for the ISP to see the site name during the TLS handshake.

ECH deployment is underway. Cloudflare enables it on its servers, Firefox supports it when combined with DoH, and Chrome is working on it. But ECH only works if the server of the site you are visiting has enabled it on its end. As of 2026, coverage is growing but not yet universal.

Using a VPN: the most complete solution

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and a server run by the VPN provider. All your internet traffic passes through this tunnel, including DNS queries, connection metadata and content. Your ISP sees only one thing: that you are connected to a VPN server. It does not know which sites you visit, what content you view, or which services you use.

This is the most effective solution for hiding your activity from your ISP, but it has important implications:

You shift trust, you do not eliminate it. Your ISP no longer sees your traffic, but your VPN provider does. You are replacing one entity that monitors you with another. The choice of VPN is therefore critical. Favour providers that have had their no-logs policies audited by independent firms (Mullvad, IVPN, ProtonVPN have all published audits). Avoid free VPNs: if they are not charging you, you are the product.

Performance impact. A VPN adds an intermediary between you and the servers you visit. Latency increases (typically 10 to 30 ms depending on VPN server distance), and throughput may decrease, especially if the VPN server is congested or geographically distant. For web browsing, this is rarely noticeable. For online gaming or video conferencing, it can be felt.

VPN protocols. WireGuard is the most modern and fastest protocol, with a minimal codebase and excellent performance. OpenVPN is older but proven and widely supported. Avoid PPTP, which is obsolete and insecure. Most modern VPN providers use WireGuard by default.

Kill switch. Check that your VPN client has a kill switch. This feature automatically cuts your internet connection if the VPN disconnects, preventing your traffic from being briefly exposed without protection. Without a kill switch, a momentary VPN dropout (switching Wi-Fi networks, losing mobile signal) can reveal your activity to your ISP.

Tor: maximum anonymity, with trade-offs

Tor (The Onion Router) routes your traffic through three successive relays, each encrypting an additional layer. The first relay sees your IP address but not your destination. The last relay sees the destination but not your IP address. No single relay sees both pieces of information at once. Your ISP sees only that you are connected to the Tor network, without knowing what you are doing on it.

Tor offers a higher level of anonymity than a VPN, but with significant trade-offs:

Slowness. The triple bounce through volunteer relays makes browsing markedly slower than with a VPN. Video streaming is virtually unusable, and even basic web browsing can be laborious.

Suspicion. Simply connecting to Tor can attract attention in certain contexts. Some ISPs or corporate networks block Tor connections, and in some countries, using Tor is closely monitored. Tor "bridges" exist to bypass these blocks, but configuring them is more technical.

Potential leaks. If you use Tor to browse regular sites (not .onion sites), the exit relay can see your unencrypted traffic. Make sure you only visit HTTPS sites when using Tor. The Tor Browser includes default protections, but misconfiguring them or installing extensions can compromise your anonymity.

HTTPS everywhere: necessary but not sufficient

HTTPS encrypts the content of exchanges between your browser and the visited site's server. Without HTTPS, your ISP (and anyone on the network) can see everything you do on the site: pages visited, forms filled in, files downloaded. With HTTPS, the ISP only sees the domain name (via DNS or SNI), not the content.

In 2026, over 95% of pages loaded in Chrome use HTTPS. Modern browsers display a warning when a site does not use HTTPS. If you still encounter HTTP sites, avoid entering personal information on them.

HTTPS is an essential baseline layer, but it does not hide metadata from your ISP. It does not conceal the name of the site you are visiting, the frequency of your visits, or the volume of data exchanged. For that metadata, you need to combine HTTPS with encrypted DNS or a VPN.

Combining protections

No single method covers all angles. Here are the combinations by protection level:

Basic protection: Encrypted DNS (DoH or DoT) + HTTPS. Your ISP no longer sees your DNS queries. It can still see the IP addresses of the servers you connect to and potentially the SNI, but it cannot read the content. This is the minimum recommended setup for everyone, and it costs nothing.

Intermediate protection: Trusted VPN + VPN's DNS. All your traffic is encrypted and passes through the VPN server. Your ISP only sees the VPN connection. The VPN provider becomes the trust link. This is the most practical choice for daily use with a good balance between privacy and performance.

Maximum protection: Tor + encrypted DNS + HTTPS. Tor's triple relay hides both your identity and your destination. The slowness makes this setup unsuitable for daily use, but it is relevant for sensitive research or contexts where anonymity is critical.

What these methods do not protect

Hiding your traffic from your ISP does not make you invisible online. The websites you visit identify you through other means: cookies, browser fingerprinting, logged-in accounts (if you are signed into Google and visit a site using Google Analytics, Google knows it is you). Social networks and ad networks track you across sites using trackers and tracking pixels.

To protect against ad tracking, you need to combine traffic encryption with a tracker blocker (uBlock Origin in the browser, or a filtering DNS like NextDNS or AdGuard DNS) and good practices: browsing in private mode for sensitive searches, using tab containers (Firefox Multi-Account Containers), limiting installed extensions, and logging out of accounts when you do not need them.

Your ISP sees every domain name you look up by default. Encrypted DNS (DoH or DoT) is the first step, free and simple, to cut that visibility. A VPN goes further by hiding all your traffic. But whichever method you choose, keep in mind that you are shifting trust, not eliminating it: from the ISP to the DNS provider, or from the ISP to the VPN provider. Choose your intermediaries carefully.