[Feature Request] Auto-Disconnect VPN upon leaving auto-connected websites

Ori_TS64

Currently, Bitdefender VPN allows users to set up Auto-connect - automatically connecting to the VPN when visiting specific websites or categories. However, once the user navigates away from the site or closes the tab, the VPN remains connected until it is manually turned off.

Suggested Feature: Add an Auto-disconnect toggle or rule setting within the Auto-connect configuration so the user won't have to manually disconnect the VPN every single time they finish browsing in the selected website or category.

Alexandru_BD

Thank you for taking the time to share your thoughts with us.

I have noted your suggestion and it has been forwarded to our product development teams for analysis.

If you ask me, I think an auto-disconnect mechanism is technically feasible, but it should not be designed simply as “close the website or app → disconnect the VPN.” A reliable implementation would need to treat auto-connect as a temporary, rule-owned VPN session and continuously determine whether any active trigger still requires protection. And this is where things can get a bit complicated from the technical perspective.

As it stands, the VPN's auto-connect feature triggers for unsecured Wi-Fi, peer-to-peer applications, selected applications or websites, and website categories. The current feature establishes the tunnel when a condition is detected, but the operating system does not necessarily provide an equally clear event indicating that the user has finished the activity.

Now, I can see some challenges here. Connecting when a website is requested is relatively straightforward. Determining that it is no longer in use is much harder, due to several factors that come into play.
A browser tab may remain open in the background, may continue streaming or downloading, could maintain WebSocket or HTTP/3 connections, can run a service worker after navigation, can open authentication, payment or content on additional domains, or can redirect from the configured domain to a related CDN or identity provider. Closing one tab also does not mean the domain is no longer active in another browser, tab or embedded webview. DNS observation alone would be insufficient because DNS requests do not clearly indicate when usage has ended. More granular browser awareness would probably require browser extensions, browser APIs or traffic inspection, each introducing compatibility and privacy considerations.

Then, website categories are not clean session boundaries. Let's take for example a banking website. A category rule such as financial websites may trigger from a single page, but the browser can immediately load dozens of third-party domains for authentication, analytics, images and content delivery. So, the program must under these circumstances decide whether the VPN requirement ends when the visible financial page is closed, all network connections associated with it stop, the browser leaves the category, and no matching traffic is seen for a defined period. Sure, traffic inactivity is probably the most practical fallback, but it can produce both premature disconnections and tunnels that remain active unnecessarily.

And there are other reasons too, why the disconnect button is simply more practical. A rule for a downloading/uploading app, for example, should probably remain active while transfers continue, even when its main window is closed. Conversely, keeping the VPN active merely because an idle helper process exists would defeat the purpose of auto-disconnect..

Your contributions and ideas are always welcome and please feel free to share with us any other suggestions that come to mind in the future.

Thank you once again for joining us here.