A VPN on iPhone that won't turn off is not stuck; something is turning it back on. iOS does not switch a tunnel on by itself. One of four things does: the profile's Connect On Demand rule, a VPN app's own auto-reconnect setting, a management profile from your employer or school, or a stale configuration left behind by an app you deleted months ago. Flipping the switch in Settings only wins if nothing else is holding it. Find the holder and the switch stays put.
Below, the four culprits in order of likelihood, how to tell which one you have in two minutes, how to turn each off, and how to remove a VPN you no longer want, including the profile that survives deleting the app.
First, see what is installed
Settings, General, VPN & Device Management. This screen lists every VPN configuration on the phone, and separately any management or configuration profile. If you see more than one VPN entry, or a profile you do not recognize, you already have your answer: the extra ones are the suspects. One active VPN configuration is normal; two is a conflict, and the phone will flip between them.
Culprit 1: Connect On Demand
Each VPN configuration has a Connect On Demand switch, and when it is on, iOS re-establishes the tunnel automatically whenever a rule says so, typically "any network" or "any Wi-Fi". You turn the VPN off; the rule turns it back on a moment later. Fix: in VPN & Device Management, tap the configuration, then the (i) next to it, and switch Connect On Demand off. Now the toggle behaves. If you actually want the tunnel to come back on its own, this is the right switch to leave on; just know it exists.
Culprit 2: the app's auto-reconnect
Most VPN apps have their own "reconnect automatically", "auto-connect on untrusted Wi-Fi" or "always-on" setting, independent of the iOS switch. The app notices the tunnel is down and brings it up again. Fix: open the app, find the setting and turn it off, or disconnect from inside the app rather than from Settings; the app then knows you meant it. Apps also react to network changes, so a phone that hops between Wi-Fi and cellular will trigger reconnects; that behavior and its cousins are in Why does my VPN keep disconnecting.
Culprit 3: a management profile
If the phone is enrolled with an employer, a school or a parental-control service, a management profile can enforce a VPN and prevent you from disabling it; iOS calls this Always On VPN, and it is only possible on supervised devices. Fix: there is none on your side by design. Check VPN & Device Management for a management profile; if it is there, the tunnel belongs to whoever installed it, and the conversation is with them, not with Settings. On a personal phone that has never been enrolled, this is not your case.
Culprit 4: a leftover configuration
You deleted a VPN app; its configuration did not go with it. iOS keeps VPN configurations after the app is removed, and a leftover one can still be selected and, if Connect On Demand was on, still activate. Fix: in VPN & Device Management, tap the stale entry and delete the configuration. While you are there, remove any configuration profile from an app you no longer use; a profile with a certificate inside is the one to treat with suspicion, and why is explained in Is a VPN safe.
The two-minute diagnosis
- VPN & Device Management: count the VPN entries and note any profiles.
- More than one entry, or an unknown profile: delete the ones you did not install on purpose.
- One entry: tap (i), turn Connect On Demand off, then toggle the VPN off in Settings.
- Still coming back: open the app and turn off auto-reconnect, or disconnect from inside the app.
- Still coming back and there is a management profile: it is enforced; talk to whoever manages the phone.
Turning it off is not the same as being safe
Two cautions. If you turn the tunnel off to fix a website and forget, the café Wi-Fi is back to seeing your browsing; a kill switch does not help here, because you disabled the tunnel yourself. And if the VPN was on because a work profile put it there, disabling it may cut you off from company services. Know why it was on before you make it stay off. What a tunnel actually hides from the network is in What can my ISP see.
Removing a VPN completely
- Open the app and disconnect.
- Delete the app.
- Settings, General, VPN & Device Management: delete the app's VPN configuration and any profile it installed.
- Restart the phone; the VPN icon in the status bar should not return.
- Confirm on What Is My IP that the address and location are your own again.
The iOS VPN switch, explained once
The toggle in Settings, VPN, and the one in Settings, General, VPN & Device Management are the same switch. It connects or disconnects the currently selected configuration. It does not delete anything, does not stop apps from reconnecting, and does not override a management profile. Treat it as "hang up", not "uninstall". What the rest of that settings screen means is in What is VPN on iPhone settings.
404 VPN's iPhone app keeps its reconnect behavior in one obvious setting and installs exactly one configuration, which is removed with the app; VLESS and WireGuard, DNS inside the tunnel, and a kill switch that only acts while you have the tunnel enabled on purpose. Start on the home page.