Who Can See Your Browsing History Online and How to Hide the Websites You Visit
Updated:
For businesses, exposed domains can mean exposed business interests: for example, requests to a recruitment service or a supplier portal. Your internet provider and the owner of the Wi‑Fi network can observe the details of your connections: destination addresses, timing and traffic volumes, and, where ordinary DNS is in use, the domain names of the websites you connect to. Encrypted DNS and Encrypted Client Hello (ECH) narrow this visibility but do not remove it entirely. To hide the websites you visit from network surveillance, route all traffic and DNS queries through a VPN; an employer with access to a managed device may be able to observe more than a home provider can.
Below we look at who can observe the connection, what a VPN hides and what remains visible. You will be able to choose protection and test it before transmitting work data.
Browser history and network logs are stored separately. The ISP does not receive a ready-made "History" tab from your computer. It observes connections: destination IP addresses, timing, data volumes and, where plain DNS is in use, website name lookups. DNS translates a domain, such as a shop's name, into a server address.
With HTTPS, the page content, password and search phrase are protected in transit. An observer can still usually determine the domain, but not the full page address. Reducing this visibility requires additional mechanisms: encrypted DNS such as DNS over HTTPS, and ECH, which conceals the website's name in the initial exchange when establishing a secure connection. Note the limits: not every website supports ECH, and the destination IP address remains visible in any case, so the purpose of the connection is not fully hidden.
| Observer | What they can see without a VPN | What visibility depends on |
|---|---|---|
| Internet service provider | IP addresses, timing and traffic volumes, often domains and DNS queries | DNS encryption, ECH support, the applications used |
| Wi‑Fi owner or network administrator | Connected devices and connections; whether domain lookups are visible | The network's capabilities and its settings |
| Employer | Activity on the organisation's network; on a managed device, additional oversight of the device is possible | Network, browser and device management settings |
| Someone with access to the browser | Local history, downloads, open tabs | User profile, syncing and device locking |
Not every network operator keeps a detailed record of visits, and the absence of such a record in a familiar interface does not prove the absence of surveillance. Conversely: being able to see a connection does not mean the operator keeps a log of every visit.
A VPN creates an encrypted tunnel between the device and the VPN server. If all browser traffic and DNS pass through the tunnel without leaks, the ISP and the Wi‑Fi owner cannot directly see which websites you are accessing; they see the connection to the VPN server, its address and the volume of data transferred.
The visibility picture is simple: device → encrypted tunnel through the provider's network → VPN server → website. The ISP observes the outer part of the tunnel. The VPN operator becomes a new point of trust, while HTTPS continues to protect the content between the browser and the website.
If all browser traffic and DNS pass through the tunnel without leaks, the ISP and the Wi‑Fi owner cannot directly see which websites you are accessing; they see the connection to the VPN server, its address and the volume of data transferred.
The VPN operator becomes a new point of trust, while HTTPS continues to protect the content between the browser and the website.
So choose a service based on its data handling terms rather than a promise of total invisibility. The EFF's recommendations on choosing a VPN explain this shift of trust. An independent audit is useful if its date and scope are clear; it does not guarantee that future practices will not change.
A VPN does not delete browser history and does not break the link with an account you have logged into. The website can still recognise you via the account, cookies and browser characteristics. Location transmitted by an application via GPS is also not hidden by changing the network route.
Start with the specific task. Protecting a password in transit and hiding a domain from the ISP require different mechanisms.
| Tool | What it protects | Limitation |
|---|---|---|
| HTTPS | Connection content: pages, messages, search phrases | On its own, it usually does not hide the domain |
| Encrypted DNS, including DNS over HTTPS | Name lookups from an observer on the path to the DNS service | Does not hide website IP addresses; the DNS service receives the queries |
| VPN | Destinations and DNS inside the tunnel from the local network and ISP | The VPN server and traffic volume are visible; leak protection is needed |
Simply switching DNS to 1.1.1.1 does not guarantee encrypted queries: for that, you need a secure protocol and an actually active connection, and even working encrypted DNS does not turn all device traffic into a tunnel. The details and differences between these modes are covered on the page about protection with HTTPS and DNS without a VPN.
These tools cannot hide your traffic volume from the ISP: it carries the data and counts its volume.
At home, first determine where access is possible from: via the router or via your device. A VPN helps against network surveillance. Against local history viewing, you need a separate profile, screen locking and control over browser syncing.
Incognito mode solves a limited task. After all its windows are closed, Chrome does not keep the history of that session or its site data, but downloaded files and bookmarks remain. This is explained directly in Chrome Help. Similar limits are described for Firefox private windows: private mode does not hide your IP address from websites or your activity from the organisation managing the network.
On a work laptop, a VPN does not remove oversight of the device itself: on a managed device, the organisation can apply additional device controls. For personal tasks, use your own device and personal connection, while observing the organisation's rules.
An example scenario: an employee opens personal webmail in incognito on a work laptop. The session's local history disappears after the windows are closed, but oversight of the managed device may continue. Moving personal correspondence to your own phone with mobile internet removes the work laptop and office network from that route. Other scenarios are covered on the page about keeping browsing history private at home and at work.
An ISP can interfere with VPN connections in various ways, so a single failure does not by itself prove deliberate blocking: the cause may be router settings, an unavailable server or an application error.
If the VPN does not work over your home connection, compare the same device's connection over the home network and over mobile internet. Then try a different server and a protocol supported by the service. Such a check helps narrow down the cause but does not by itself establish the operator's policy. A step-by-step procedure is given on the page about ISP blocking of VPNs.
Before transmitting work data, it is important to check whether the browser has been left outside the tunnel. For managing the route, I recommend CitadelVPN: split tunnelling is included in all plans. Which applications and connections can be included in the tunnel or excluded from it depends on the client and platform. Check the rules for the browser and DNS against the list above: if the browser goes directly, this kind of connection will not hide the websites you visit from your ISP.
Yes. A VPN does not replace account protection: use a strong password and a second factor. These measures are needed regardless of the connection method.
Yes, such demands can be made to a VPN operator as well. Before choosing a service, review what data it stores and how it handles disclosure requests; a VPN provides no guarantee of legal untraceability.
Provided the traffic and DNS pass through the tunnel without leaks, a VPN hides the websites you visit from the ISP and the Wi‑Fi owner. HTTPS protects content, incognito limits local traces, and on a managed work device oversight by the organisation remains possible.
Start with your own device: check the browser's route, DNS and behaviour when the connection drops. Repeat the checks after reconnecting before transmitting work data.