Public Wi-Fi Safety for Travelers

The old advice treated all public Wi-Fi as a den of hackers reading your every keystroke. That picture is outdated: the modern web has largely fixed the biggest problem. But "safer than it was" isn't "do nothing" — a few real risks remain, and the steps below close them. This builds on the general principles in public Wi-Fi safety, focused on the traveler's situation.

Step 1: Rely on HTTPS — the foundation

The single biggest safety improvement is HTTPS, which now secures the vast majority of websites. HTTPS encrypts your data in transit, so even on a wide-open network, others can't read what you send to and receive from a site. Modern browsers default to it and warn you when a site isn't secure. Stick to HTTPS sites — which is most of the web — and the classic "someone's sniffing my password on the cafe Wi-Fi" threat is largely neutralised.

Step 2: Add a VPN on networks you don't trust

HTTPS protects individual site connections; a VPN protects everything. It encrypts all your traffic and hides your activity from the network operator and other users, closing the gaps HTTPS alone leaves (such as which sites you visit). On networks you don't control, a VPN is strongly recommended — and running it on a travel router protects every device you carry at once, the cleanest setup for travelers.

Step 3: Watch for the "evil twin"

The most real modern threat isn't sniffing — it's the evil twin: a rogue hotspot set up to impersonate a legitimate one, like an open network named after the cafe or hotel you're in, designed to lure you into connecting so an attacker can intercept your traffic. Defend against it simply: confirm the exact network name with staff before joining, and be suspicious of unexpected open networks mimicking a venue. When in doubt, use your own cellular data instead.

Step 4: Save sensitive actions for trusted connections

Even with HTTPS and a VPN, it's wise to be cautious about high-stakes actions — banking, entering important credentials — on a network that feels sketchy or unverified. For those, switch to your cellular data, which you control, or wait for a connection you trust. This costs you nothing and removes the worst-case scenario entirely.

Step 5: Harden the device itself

A few one-time settings make any network you join safer:

• Keep software updated — patches close the vulnerabilities a hostile network might exploit.
• Disable auto-connect to open networks, so your device doesn't silently join an evil twin.
• Turn off file sharing and set the network as "Public" so other users can't reach your device.
• Enable your firewall for a baseline barrier against the local network.

Set these once and they protect you on every network for the rest of the trip. Combined with HTTPS, a VPN, and a little name-checking, public Wi-Fi becomes a low risk you can use with confidence — which is exactly what staying productive on the road requires.

Frequently Asked Questions

Is public Wi-Fi actually dangerous?

Less than it once was, thanks to HTTPS now encrypting most of the web, which protects your data in transit even on an open network. The real remaining risks are fake "evil twin" hotspots that impersonate a legitimate network, and unencrypted or sensitive activity. Sensible habits — HTTPS, a VPN, verifying the network name — reduce the risk to low.

Do I really need a VPN on hotel and airport Wi-Fi?

It's strongly recommended on networks you don't control. HTTPS already protects most data, but a VPN encrypts everything and hides your activity from the network operator and other users, closing gaps HTTPS alone leaves. Running it on a travel router covers all your devices at once, which is ideal for travelers.

What is an evil twin hotspot?

An evil twin is a rogue Wi-Fi access point set up to mimic a legitimate one — for example, an open network named like a cafe or hotel — to lure you into connecting so the attacker can intercept traffic or harvest credentials. Defend against it by confirming the exact network name with staff and being wary of unexpected open networks impersonating a venue.