VPN ad and malware blockers
Most VPNs now block ads, trackers and known malicious sites as well. They work differently from a browser ad blocker, and they're worth understanding before you count on one.
Last updated 8 Oct 2026
The short version
- VPN blockers work by refusing to look up known ad, tracker and malware addresses, so they cover every app, not just your browser.
- They can't block ads served from the same address as the content, such as most video ads.
- Some only come with dearer plans, and most stop working if you set your own DNS server.
How they work
Before your device can load anything, it looks up the address of each site through a DNS server. While you're connected, your VPN runs that lookup, and its blocker refuses to answer for addresses on its lists of ad networks, trackers and malicious sites. The ad or the scam page simply doesn't load.
Because it works at that level, it covers every app on your device, including ones a browser extension can't reach, like games and news apps. But it's only as good as its lists, and it can't tell an ad from content when both come from the same address. Mullvad is frank about it: its blocker isn't an anti-malware tool, and it suggests a browser extension such as uBlock Origin for more (Mullvad).
What each VPN offers
Each has its own name for it: Surfshark's CleanWeb, NordVPN's Threat Protection, Proton VPN's NetShield, PIA's MACE, ExpressVPN's Advanced Protection, CyberGhost's Content Blocker, and Mullvad's DNS content blockers. "On some plans" means a cheaper plan gets less, or none; the notes say what's in each.
| VPN | Ad, tracker and malware blocking |
|---|---|
| CyberGhost | Yes, on every planContent Blocker blocks DNS lookups for ad, tracker and malware domains. CyberGhost describes it on its Windows app page. |
| ExpressVPN | On some plansAdvanced Protection: ad blocker, malicious-site blocker and adult-site blocker on all tiers (Basic is listed as Lite Protection on the order page); the tracker blocker is only on Advanced and Express Pro. It is a DNS-based blocker run on the device, and only works while the VPN is connected (Automatic, Lightway, WireGuard or OpenVPN). Apps for Windows, Mac, Linux, Android, iOS, Fire TV and Meta Quest; Apple TV gets ad and tracker blocking only. |
| Mullvad | Yes, on every planDNS content blockers in the app for ads, trackers, malware, adult content, gambling and social media. They don't work with a custom DNS server. |
| NordVPN | On some plansScam and phishing protection blocks ads, trackers and unsafe sites by DNS while you're connected. The fuller ad and tracker blocker, with malware scanning on Windows and macOS, comes with the Complete plans. |
| Private Internet Access | Yes, on every planMACE blocks ad, tracker and malware domains by DNS, in the Windows, macOS, Android and Linux apps and the Chrome and Opera extensions. PIA's MACE page doesn't list iOS. |
| Proton VPN | Yes, on every planNetShield filters DNS queries through Proton's resolver: malware only, or malware, ads and trackers (default). On every paid plan, not on the free plan. Not usable with custom DNS. No Privacy Panel on Linux. |
| Surfshark | Yes, on every planCleanWeb is 'included in all Surfshark subscriptions'. The app blocks ads, trackers and malware while connected (iOS, macOS, Android, Windows, Linux, Fire TV, Apple TV); the Chrome, Firefox and Edge extension also blocks cookie pop-ups and works without the VPN on. |
Things to know
- Only while connected. The in-app blockers work only while the VPN is on. Surfshark's browser extension is the exception: it blocks in the browser with the VPN off.
- Custom DNS turns it off. Proton VPN and Mullvad say their blockers don't work with a DNS server you set yourself (Proton VPN).
- NordVPN has two layers. DNS-based blocking while you're connected, and a fuller version that also scans downloads, on Windows and the macOS app downloaded from NordVPN's site (NordVPN).
- Some block more than ads. Mullvad and ExpressVPN can also block adult sites, and Mullvad gambling and social media too: handy on a family device.
Will it stop scams?
It can stop your device opening scam and phishing sites that are already on the provider's lists. New scam sites appear every day, though, and a blocker does nothing about scam calls and texts. The ACCC's Scamwatch has the current scams targeting Australians and what to do if you've been caught by one.