WebRTC leak test
Does WebRTC expose an IP address other than the one your HTTP requests use? A proxy that does not cover WebRTC leaks the real one to every site.
How to stop WebRTC from leaking
Nothing to fix right now; this is what to change if a leak ever shows up.
Anti-detect and automation browsers
Set the WebRTC mode to replace (also called altered), so STUN reports the proxy address instead of the real one. Avoid disabled: a browser without RTCPeerConnection stands out on its own.
Chrome, Edge, other Chromium builds
Apply the WebRtcIPHandling policy with disable_non_proxied_udp, or use the WebRTC Network Limiter extension. uBlock Origin has a matching switch under Privacy.
Firefox
In about:config set media.peerconnection.ice.proxy_only to true to keep WebRTC but route it through the proxy, or media.peerconnection.enabled to false to switch it off.
VPN clients and IPv6
Enable the client's leak protection and kill switch. If the VPN does not tunnel IPv6, disable IPv6 on the adapter — otherwise the IPv6-only host above keeps seeing the real connection.
How this test works
The page opens an RTCPeerConnection and lets the browser gather ICE candidates. For the server-reflexive candidate the browser sends a UDP packet to a STUN server, which replies with the address it saw. HTTP proxies and many VPNs carry TCP only, so that address can be the real one. Host candidates list the machine's own interfaces. In parallel, the same endpoint is fetched over an IPv4-only and an IPv6-only hostname, which forces each address family into the open on its own.