What to do if your IP is exposed
Someone says they have it. Here is the calm, ordered version of what to do, starting with the part that usually ends the worry.
Read this part first
Somebody having your IP address is not an emergency. Every website you have loaded today already has it, along with every font service, analytics script and ad network embedded in those pages. It is a return address, and it has never been secret.
They cannot find your home with it. The record linking an address to a named subscriber sits with your internet provider and normally requires a subpoena. They cannot get into your devices with it. That needs a service that is both exposed and vulnerable, which is a separate condition that has to be true independently.
If you are here at 2am after an argument in a game lobby, that is the answer, and the rest of this page is optional.
Step 1. Work out what is actually at risk
Two things are genuinely possible. Everything else in the usual list is not.
Your connection can be flooded
Traffic aimed at your address can saturate your line and make it unusable. This is the real one, it happens mostly to people who stream or play competitively, and it is a nuisance rather than a compromise. Nothing is stolen. It affects the line, not the devices on it, and it stops when the traffic stops or the address changes.
Anything you deliberately opened can be reached
If you set up port forwarding for a game server, a camera or remote access, those services are reachable from the internet. Worth knowing: the whole address space is scanned continuously by automated systems, so exposed services get found whether or not anybody has your address specifically. Somebody knowing it does not meaningfully change this, and closing what you are not using does.
Step 2. Close what you opened
This is the highest-value step and the one most often skipped, because it addresses the risk that was already there.
- Open your router's admin page, usually at the address it lists as the default gateway.
- Find port forwarding, sometimes called virtual servers or NAT forwarding.
- Remove every rule you do not currently need. Old rules for a game you stopped playing or a device you replaced are pure liability.
- Check for UPnP and consider turning it off. It lets applications open ports on their own without asking you, which means the list of what is exposed may not match what you thought you had configured.
- If you are keeping a rule, make sure whatever is behind it is updated and not using a default password.
Then none of this applies, because you have no inbound path at all. Compare your router's WAN address to the one on our front page: if the router shows something in 100.64 through 100.127, you are sharing a public address and nothing can be forwarded to you. See why your IP changes.
Step 3. Get a new address, if you want one
Optional, and worth doing if the address is being attacked or has been posted somewhere.
- Power the router off for several hours. You are waiting for the lease to lapse. A one-minute reboot usually renews the same address.
- Call your provider. Often the fastest route. Explain that the address is being attacked; many will reassign on request.
- Use a VPN in the meantime. An immediate fix, since websites and attackers see the VPN's address instead. See how to hide or change your IP for what that does and does not do.
Step 4. Stop it leaking again
Worth knowing how it got out, because the usual routes are few and avoidable.
| How it usually leaks | What to do about it |
|---|---|
| Peer-to-peer voice chat in games | Use a service that relays through its own servers rather than connecting players directly. Most mainstream ones do |
| Hosting a game server from home | Use a hosted server, or accept that players will see the address |
| Clicking an unfamiliar link someone sent | Any page they control logs the request. There is no way around this except not clicking |
| Torrenting | Every peer in the swarm sees your address by design |
| Email headers, on some providers | Most major webmail strips the originating address now, but not all systems do |
Step 5. Know when it stops being a networking problem
If a specific person is threatening or harassing you, changing an address does not address that. It may briefly interrupt one method while leaving the person and their motivation exactly where they were.
At that point the useful tools are different ones: reporting to the platform where it is happening, keeping records of what was said and when, and involving the police if there are threats. Those are the responses proportionate to a person, and a VPN is not one of them.
People sometimes claim to have your name or street to frighten you. If they produce genuinely correct details, the source is almost never the IP address, because it cannot yield those. It is far more likely something already public: an old account, a reused username, a data breach, or a post with more detail than intended. That is worth investigating calmly, and it changes what you would do next.
The short version
- Nobody finds your house from an address. Breathe.
- Remove port forwarding rules you do not need, and turn off UPnP.
- Power the router off for a few hours, or ask your provider, if you want a new address.
- Stop the leak: relayed voice chat instead of peer to peer.
- If it is a person rather than a packet, use the tools that work on people.