7 things every VPN needs before it gets my money

Stop picking VPNs by review sites — judge them by these 7 criteria instead

Every "best VPN" list you've ever read was probably an affiliate farm.

Speed tests and streaming unblocks ranked first, the privacy fine print ranked nowhere. This is the checklist I run before any provider gets my money.

1. A kill switch that fails closed. If the tunnel drops, your traffic has to die with it — not "briefly reconnect over the open internet." Test it yourself: connect, quit the app mid-download, and load a leak-check site. If your real IP shows up, the kill switch is decorative.
2. WireGuard, plus an OpenVPN fallback. WireGuard has been the go-to for speed and battery life for a while now — lean codebase, fast reconnects. But it only runs over UDP, and plenty of networks (hotels, offices, some carriers) block it. OpenVPN over TCP is slow but gets through. A provider with only one protocol stops working exactly when the network turns hostile.
3. A no-logs policy that's been tested, not just written. A privacy policy is a promise; a warrant is a test. Point-in-time audits are better than nothing, but honestly most of them are marketing — a consultant reads policies for a week and issues a pdf. What actually earns trust is a provider whose servers got seized or whose office got visited by police, and there was nothing to hand over.
4. RAM-only servers — with an asterisk. Everything lives in memory and wipes on reboot, so a seized server is a blank server. Not everyone agrees this one's essential — at least one major provider publicly calls it marketing hype and trusts full-disk encryption instead. My take: it's cheap hardening. The red flag is a provider that talks about RAM-only and nothing else.
5. DNS and IPv6 leak protection on by default. Your OS will happily fire DNS queries around the tunnel if the provider doesn't force every request through it, and IPv6 is the classic silent leak. Default behavior, not a checkbox buried in advanced settings.
6. Open-source apps. You cannot audit a black box. A closed client plus a no-logs promise is just "trust me."
7. Anonymous signup. Cash or monero accepted, no email required, random account number instead of a username tied to you. If your account is attached to your name and card, the no-logs policy is the last line of defense between a legal demand and your identity.

The one I keep going back and forth on: jurisdiction. Half of Reddit treats 5/9/14 Eyes membership as an automatic disqualifier, but the providers that have actually been tested by warrants sit inside those alliances anyway. Genuinely curious where people land — does a provider's country still move your decision, or is it only about what they log?

TL;DR: Kill switch that fails closed, WireGuard with an OpenVPN fallback, no-logs proven by real warrants and not just audit pdfs, RAM-only as a nice-to-have, DNS/IPv6 leak protection on by default, open-source apps, and anonymous signup. If a provider markets streaming and speed but goes quiet on all seven, that's the tell.