WrapVPN on Windows: the one permission it asks for, and why

Most apps live entirely inside their own window. A VPN can't. To protect the whole PC, it has to add a network connection to Windows and have every app's traffic sent through it, and those are system-wide changes that Windows rightly keeps behind an administrator's approval.

So WrapVPN splits the job in two. The window you click on is an ordinary app. The part that runs the tunnel is a small background component with the rights to change where traffic goes, and installing that part is what Windows asks you to approve.

Think of a block of flats. You can rearrange your own flat however you like, but fitting a new front door to the building needs the building manager's say-so. You ask once, and after that you come and go with your own key.

You'll see the request once, after your first sign-in. Connecting, disconnecting and changing location never need it, although Windows may ask again after an app update replaces that background component. On a PC run by an employer or a school, ask whoever manages it, and follow their rules on VPNs.

Here's the worked example. It's a Wednesday, you're working from the kitchen table in Berlin, and you've connected to Frankfurt, the nearby location with the lowest speed figure. You open your browser and load a news page.

That request leaves the browser, enters the tunnel, travels encrypted to our Frankfurt server, and carries on from there to the website. The site sees the Frankfurt server's address, which everyone using that server shares, rather than your own.

Now suppose another program on the PC tries to send something the ordinary way, around the tunnel. While WrapVPN is connected, Windows blocks it. That's not a setting you have to remember to turn on: it's part of how WrapVPN connects on Windows, so nothing slips out unprotected while the tunnel is up.

At eleven you need to print a boarding pass. The printer is on your home network, a few metres away, but reaching it would mean going around the VPN, so Windows blocks that too. Printers, network drives and other devices on your Wi-Fi may be unreachable while you're connected.

That's the honest cost of keeping everything inside the tunnel. When you need a local device, pause protection: WrapVPN stops for a few minutes, the printer reappears, and protection resumes by itself. Or disconnect, print, and connect again.

The same rule explains hotel and café Wi-Fi. A network's sign-in page is also traffic outside the tunnel, so complete the page first and connect afterwards, not the other way round.

The Windows app doesn't sell plans. Subscriptions are bought on another device: through the App Store on an iPhone, iPad or Mac, or through Google Play on Android. The weekly plan is $1.99 and the monthly plan $3.99, both renew until you cancel in that store's subscription settings, and there's no annual plan.

Then sign in on the PC with the same Apple or Google account, and the plan applies there as well. No plan has a device limit. Without a plan, the account's three free one-hour sessions a week work on the PC too, shared with your other devices.

Clean Web, our ad and tracker blocker, stops the PC looking up the addresses of known advertising and tracking domains, so those connections never start. Check its switch after installing so you know which way it's set. A browser using its own secure DNS goes around it, and it isn't antivirus.

Auto-Connect on Windows connects as soon as the app opens. It's off until you turn it on, and it's handy if you'd rather not start each working day by remembering to connect.

Check that the PC is a 64-bit Intel or AMD machine running Windows 10 (version 2004 or later) or Windows 11, install WrapVPN from the Microsoft Store, and sign in with the account from your phone. Approve the one Windows request, connect, and keep Pause in mind for the next boarding pass.