How to Stay Safe on Public Wi-Fi: The Airport and Hotel Security Checklist

You’re at the gate with forty minutes to kill, or you’ve just dropped your bags in a hotel room after a long flight. The first thing most of us do is join the free Wi-Fi — and that’s exactly the moment your data is most exposed. So, is public Wi-Fi safe, and how do you protect yourself? The FTC’s actual position is more reassuring than most people expect: thanks to widespread HTTPS encryption, connecting through a public Wi-Fi network in a coffee shop, airport, or hotel is usually safe for browsing sites that show the padlock/https. The risk lives in the gaps around that — logins on non-HTTPS pages, fake hotspots, and traffic that never touches an encrypted site — which is exactly where someone on the same network can still get at your accounts or personal information.

The good news is that staying safe doesn’t require a computer science degree. It requires a short checklist you run before you connect, while you’re connected, and after you disconnect. This guide walks travelers, remote workers, and anyone who regularly uses airport or hotel Wi-Fi through that exact checklist — including where a VPN like NordVPN or Surfshark fits in, and where it doesn’t.

By the end, you’ll know which risks actually matter in 2026, the five-minute setup to do before your next trip, and the habits that close the remaining gaps.

Table of Contents

1. What actually goes wrong on public Wi-Fi
2. Before you travel: the 5-minute setup
3. At the airport: the connection checklist
4. At the hotel: the room checklist
5. Choosing a VPN for travel: NordVPN vs Surfshark
6. Common mistakes and user-reported issues
7. FAQ
8. Conclusion
9. Sources

What actually goes wrong on public Wi-Fi

Understanding the threats makes the checklist make sense. According to NordVPN’s own security documentation, the most common public Wi-Fi attacks are:

• Man-in-the-middle (MITM) attacks — someone on the network positions themselves between you and the sites you visit, reading or altering unencrypted traffic.
• Evil twin networks — a fake hotspot named to look like the real one (“Airport_Free_WiFi” vs. the official network), set up specifically to capture logins.
• Wi-Fi sniffing — passively capturing data that travels over the network unencrypted.
• Malware injection — compromised networks pushing malicious downloads or redirects.

The FTC adds important context here: encryption is the key defense. When a website address starts with “https,” your information is encrypted before it’s sent — and you should look for that on every page you visit, not just the login screen. Most major sites use HTTPS everywhere now, which has genuinely reduced the risk compared with a decade ago. But HTTPS protects individual site connections, not everything your device does — DNS lookups, apps with sloppy encryption, and file-sharing services can still leak. That’s the gap a VPN closes by encrypting all traffic between your device and the VPN server.

Before you travel: the 5-minute setup

Do these once, at home, before your trip. Every item is easier on a fast, trusted connection.

1. Update everything. The FTC recommends keeping your security software, operating system, and browser up to date, with automatic updates turned on. Patches close the holes attackers scan for on shared networks.
2. Install a VPN on every device you’re bringing. Phone, laptop, tablet. Set it up and test it at home so you’re not fumbling with account activation on airport Wi-Fi. Both NordVPN and Surfshark offer apps for Windows, macOS, Android, iOS, and Linux.
3. Turn on the kill switch in your VPN app. A kill switch cuts your internet if the VPN connection drops, so your traffic never travels unprotected — Surfshark documents this feature across all its major platforms, and it matters most on exactly the kind of unstable networks you find in airports and hotels.
4. Enable auto-connect on untrusted networks if your VPN app offers it, so protection starts the moment you join a hotspot instead of relying on memory.
5. Turn off auto-join for open networks in your phone and laptop Wi-Fi settings. This is your main defense against evil twin hotspots — you choose the network deliberately instead of your device grabbing whatever looks familiar.
6. Use unique passwords + a password manager. The FTC specifically warns against reusing the same password across sites, because one captured login otherwise unlocks many accounts.
7. Enable two-factor authentication on email, banking, and any account you’ll touch while traveling. Even if a credential is intercepted, 2FA blocks the follow-up login.

At the airport: the connection checklist

Run through this every time you connect at a terminal, lounge, or café:

• Verify the network name on official signage or by asking staff — don’t guess between “AIRPORT-FREE-WIFI” and “Airport Free WiFi.” One of them may be an evil twin.
• Connect your VPN immediately, before opening email, messaging, or a browser.
• Check for HTTPS on every site you use, per FTC guidance — the padlock/https on every page, not just at login.
• Skip sensitive tasks if you can. NordVPN’s travel guidance is blunt: avoid logging in to sensitive accounts on airport Wi-Fi where possible. If you must check a bank balance, do it through the bank’s official app over your VPN — or better, over mobile data.
• Turn off Bluetooth and AirDrop-style sharing when not in use. The FCC’s consumer guidance flags Bluetooth as a separate wireless attack surface worth disabling in public.
• Log out when you’re done. The FTC advises against staying permanently signed in to accounts on shared networks.

Tip: if a captive portal (the “accept terms” page) won’t load while your VPN is on, connect to the portal first, accept, then enable the VPN before doing anything else. This is normal behavior, not a security failure.

At the hotel: the room checklist

Hotel networks add a wrinkle: you’re on them for days, not minutes, and dozens of strangers share the same infrastructure. NordVPN’s hotel Wi-Fi guidance recommends three specific steps:

1. Keep your firewall on. Windows and macOS both ship with one — confirm it’s active before joining the hotel network.
2. Disable file sharing. On Windows, set the network profile to “Public” when you connect (this disables network discovery and sharing). On macOS, check System Settings → General → Sharing and switch off File Sharing.
3. Use a VPN for the whole stay. Treat the hotel network as untrusted for its entire duration — a VPN encrypts your connection so the network operator and fellow guests can’t view or intercept your activity.

Two more habits worth adding:

1. Ask the front desk for the exact network name and password. Hotels are prime territory for lookalike networks.
2. Prefer your phone’s hotspot for truly sensitive work. Cellular data isn’t shared with strangers the way hotel Wi-Fi is. For a tax filing or a large money transfer, tether the laptop to your phone instead.

Choosing a VPN for travel: NordVPN vs Surfshark

Both are strong choices for the traveler use case; here’s how the features that matter on the road compare, based on each vendor’s official documentation:

Feature (travel relevance)	NordVPN	Surfshark
Traffic encryption on untrusted networks	Yes — encrypted tunnel between device and server	Yes — data encrypted even on non-secure networks
Kill switch (protects during drops)	Yes	Yes — Windows, macOS, Android, iOS, Linux
Malicious site/download blocking	Threat Protection Pro	CleanWeb (ads, pop-ups, malware alerts)
Split tunneling (exclude apps from VPN)	Yes	Bypasser
Double-hop routing	Yes	Dynamic MultiHop (choose both server countries)
Simultaneous devices	Multiple devices per account	Unlimited devices

Honest framing: for a public Wi-Fi checklist, either service covers the core job — encrypting your traffic so the checklist above holds together. Surfshark’s unlimited simultaneous devices is convenient for families traveling with a pile of gadgets; NordVPN’s Threat Protection Pro adds blocking of malicious sites and downloads before they reach your device. Note NordVPN’s own caveat, which applies to every VPN: it significantly reduces common public Wi-Fi risks, but no tool makes a hostile network completely safe on its own — the habits in this checklist still matter.

Common mistakes and user-reported issues

These come up repeatedly in traveler forums and independent reviews — labeled as user reports, not our testing:

• Users report captive portals conflicting with always-on VPNs — the hotel login page never loads. Fix: temporarily allow the portal, authenticate, then reconnect the VPN (some apps have a dedicated captive-portal mode).
• Users report forgetting the VPN on one device. The laptop is protected; the phone quietly syncs email over the raw network. Auto-connect rules on every device close this gap.
• Users report joining lookalike networks in busy terminals because the fake network had a stronger signal. Verifying the SSID with staff or signage is the only reliable defense.
• Mistake: assuming “password-protected” means safe. A hotel password shared with every guest doesn’t protect you from the other guests — the FTC notes you can only be confident in a network’s encryption when it uses WPA/WPA2, and even then everyone with the password is inside it.
• Mistake: leaving file sharing on. A laptop set to “Private network” behavior on hotel Wi-Fi may advertise shared folders to the whole floor.

FAQ

Is public Wi-Fi safe in 2026 if most sites use HTTPS? Safer than it used to be, but not safe by default. HTTPS protects individual website connections; it doesn’t cover DNS lookups, poorly built apps, or fake-hotspot tricks. The FTC still advises treating hotspots in airports and hotels as potentially insecure.

Do I really need a VPN if I’m just browsing news at the airport? For casual browsing on HTTPS sites, the risk is lower. The VPN earns its keep the moment you touch email, cloud storage, work systems, or payments — and since most people do those things reflexively, running it whenever you’re on public Wi-Fi is the simpler habit.

Is hotel Wi-Fi safer than airport Wi-Fi? Not inherently. Hotel networks are shared with every guest, and NordVPN’s guidance treats them as untrusted — firewall on, file sharing off, VPN on. The longer exposure time in hotels arguably makes discipline there more important.

What’s the single most important item on this checklist? Verifying you’re joining the real network, then encrypting your traffic (VPN + HTTPS). Those two steps neutralize the evil twin and sniffing attacks that account for most public Wi-Fi trouble.

Is my phone’s mobile hotspot safer than public Wi-Fi? Generally yes — cellular data isn’t shared with strangers on a local network. For the most sensitive tasks, tethering to your own phone is the conservative choice.

Conclusion

Public Wi-Fi is a convenience worth using — with a seatbelt on. The pre-trip setup takes five minutes, the per-connection checklist takes thirty seconds, and together they close off the realistic attack paths: fake hotspots, traffic sniffing, and man-in-the-middle interception.

If you only change one thing before your next trip, make it this: put a reputable VPN with a kill switch on every device you travel with, and set it to connect automatically on unknown networks. It’s the one item on the checklist that keeps working when you’re tired, distracted, and just trying to check your gate.

Ready to lock down your travel Wi-Fi? Get the VPN we recommend for travelers here — set it up at home tonight, and your next airport layover takes care of itself.