A VPN protects one part of the connection. It does not erase account history, stop you from typing a password into a phishing page, or replace endpoint security. Marketing that blurs those lines is selling comfort, not a threat model.
Editorial rule: keep the original evidence boundaries. Do not turn untested speed, access, pricing, or support claims into facts.
Where this advice breaks down
- An encrypted tunnel cannot undo credentials submitted to an attacker.
- A DNS-level blocker is not an antivirus engine.
- Signed-in accounts and browser sync can retain activity regardless of the VPN.
How NetShield actually works
Per the official support documentation, NetShield is DNS filtering. When you’re connected, Proton’s dedicated DNS servers resolve your domain requests and check them “against databases of domains known to host malware, ads, or trackers.” Two modes exist (block malware only / block ads, trackers, and malware), with a third adult-content option on Windows.
One premise before anything else: NetShield is paid-plan only. It is not included in Proton’s free tier (see Free vs. Plus for the full boundary).
Same word “blocking,” different layers
| Tool | Layer | Blocks | Cannot block |
|---|---|---|---|
| VPN DNS blockers (NetShield-type) | Domain lookup | Known ad/tracker/malware domains | Brand-new domains · file inspection · malware already installed |
| Browser ad-block extension | Inside the browser | Page ad elements | Traffic from apps outside the browser |
| Antivirus | Device (files/processes) | Scans and removes downloaded/running malware | Network snooping · tracking ads |
| Password manager + MFA | Accounts | Reused passwords · stolen-credential logins | Device infection itself |
What NetShield cannot do — including the official fine print
- Fresh phishing domains. DNS blocking works from lists of known bad domains; a scam site registered this morning may not be on any list yet. That’s why phishing response is its own procedure (what to do after you clicked).
- Files already downloaded. Scanning and quarantining is antivirus work; NetShield never inspects files.
- Information you type yourself. No blocklist can stop you from entering a password on a convincing fake page.
- Documented exceptions. Per the official docs, NetShield does not apply over Tor over VPN, and Android 10+’s Private DNS setting takes precedence over NetShield when enabled.
So how do you stack them?
Since the roles don’t overlap, the answer is division of labor, not replacement. Device layer: antivirus (on Windows, built-in Microsoft Defender is the sane starting point). Account layer: a password manager plus MFA. Network layer: a VPN, optionally with DNS blocking. And the layer no tool covers: checking the address before you type.
FAQ
Q. Can I uninstall my antivirus if NetShield is on?
No. NetShield never inspects files — the official documentation describes it purely as domain blocking. On-device scanning stays antivirus territory.
Q. I already run a browser ad blocker. Is NetShield redundant?
Partially overlapping, not identical. Extensions work only inside the browser; DNS blocking covers other apps’ traffic on the device too.
Q. Does free Proton include NetShield?
No — paid plans only, per official docs (verified August 11, 2026).
Q. Do NordVPN and Surfshark have equivalents?
Yes — NordVPN’s Threat Protection and Surfshark’s CleanWeb are the same family of ad/malicious-domain blocking. Scope differs per vendor; check each official page. Full three-way comparison: pick one trade-off.
Bottom line
“My VPN blocks ads, so security is handled” is the misconception this post targets. NetShield is a good reduction layer — not the whole shield. One tool per layer, plus the typing-check habit no software replaces, gets you a realistic defense without marketing inflation.
Sources (verified 2026-08-11)
- NetShield official support doc — DNS filtering, two modes, paid-only, Tor/Private DNS exceptions
- Proton VPN plans explained — per-plan features
- NordVPN Features — Threat Protection
- Surfshark Features — CleanWeb wording
Some links are affiliate links (no effect on rankings or your price). Features and policies change over time.
Published 2026-08-11 · Not verified by us: block-rate figures (not officially published — we won’t invent them), detailed scope comparison of Threat Protection vs. CleanWeb (future deep-dive).
Who should not use this approach
- Anyone looking for one app to replace MFA, updates, and antivirus
- Anyone who will ignore device or employer security policy
- Anyone who assumes a connected icon proves every threat is blocked
When this approach actually helps
- Users who separate connection privacy from device and account security
- People who pair a VPN with MFA, updates, and careful link handling
- Travelers using untrusted networks with a defined threat model