Public Wi-Fi is the quiet workhorse of remote work and travel. You settle into a café, an airport gate, or a hotel lobby, open your laptop, and expect the internet to just work. Most of the time, it does. The trouble is that the same openness that makes public networks convenient also makes them attractive to attackers. A few careful habits can keep your data and your devices out of the wrong hands.
That does not mean you need to avoid public Wi-Fi altogether. For many remote workers and travelers, it is the only realistic option between flights, during a layover, or while waiting for a hotel room. The goal is to use it deliberately: verify the network, encrypt your traffic, lock down your device, and know when to walk away.
Verify the Network Before You Connect
The first step is simple: know exactly which network you're joining. At a hotel, ask the front desk for the exact network name and password. At a coffee shop, ask the barista. Don't rely on the list that pops up on your screen, because anyone can create a network called "Cafe Wi-Fi" or "Hotel Guest."
Ask for the exact spelling, including capitalization and underscores. A legitimate business may use something like "BluebirdCafe_Guest," while a rogue hotspot might appear as "Bluebird Cafe Guest" or "BluebirdCafe_Free." Those small differences are easy to miss when you are tired or in a hurry, which is exactly what attackers count on.
Look at the captive portal. A legitimate network usually shows a terms-of-service page or asks for a room number. If it asks for a credit card before you've even opened a browser, or if it prompts you to install a certificate or profile, stop. Those are signs of a network that wants more than your browsing traffic.
Red flags to watch for:
- A network name that's almost identical to the real one, like "Hotel_Guest" next to "HotelGuest."
- No password required for an otherwise private-sounding network.
- A pop-up asking for your email, social media login, or payment details just to get online.
- A browser warning about an invalid certificate when you try to reach a major site.
- A captive portal that looks different from the one you used at the same location before.
- Pressure to download a "required" app, browser extension, or security profile.
Spotting Evil Twin Hotspots
An evil twin is a fake Wi-Fi network that mimics a real one. The attacker sets up a hotspot with a convincing name, sometimes near the legitimate business, and waits for devices to connect automatically or for users to choose it from the list. Once you're connected, the attacker may be able to see unencrypted traffic, redirect you to fake login pages, or push malware downloads.
Evil twins are especially common in airports, train stations, hotels, conference centers, and tourist areas. Imagine you're in an airport and see both "Free Airport WiFi" and "Airport Free WiFi." One may be real and one may be fake. Without asking staff or checking official signage, you cannot be sure which is which.
If two networks look almost the same, treat both as suspect until someone at the venue confirms the real one.
Other signs include a network that appears out of nowhere with a very strong signal, a connection that repeatedly drops or redirects you, and a login page that asks for information the real network never requested. If you accidentally connect to a suspicious network, disconnect immediately, choose "Forget This Network," and turn off Wi-Fi until you can verify the correct one.
Use a VPN and Encrypted Connections
A virtual private network, or VPN, creates an encrypted tunnel between your device and the VPN server. On public Wi-Fi, that tunnel helps protect your traffic from other people on the same network, including attackers who might be snooping. If you regularly work from cafés, airports, or hotels, a reputable VPN is one of the best investments you can make.
Not all VPNs are equal. Avoid free VPN apps that fund themselves by selling data, injecting ads, or limiting security. Choose a paid provider with a clear privacy policy, strong encryption, and a kill switch that blocks internet access if the VPN drops. If your employer provides a VPN, use it exactly as instructed, especially before opening email, internal dashboards, or file-sharing tools.
Encryption also happens at the website level. Look for https:// and the padlock icon in your browser before entering any password or personal information. Enable your browser's HTTPS-Only mode if it has one. Even with HTTPS, a VPN adds another layer of protection because it hides the sites you visit and the data you send from others on the local network.
If you cannot use a VPN, your phone's mobile hotspot is often safer than an unknown public network. It uses your cellular data, which is far harder for a nearby attacker to intercept. Save public Wi-Fi for low-risk browsing, and switch to your hotspot for banking, work logins, or anything involving sensitive data.
Lock Down Your Device Before You Leave
Your device settings matter as much as the network you choose. Before you travel or work remotely, take a few minutes to reduce what your laptop or phone shares with the world.
- Install operating system and app updates. Security patches close known holes that attackers exploit.
- Turn on your firewall and keep it on, even on networks you trust.
- Disable file sharing, printer sharing, and network discovery when you are on public Wi-Fi.
- Turn off AirDrop, Nearby Sharing, Bluetooth, and NFC when you are not using them.
- Use a strong screen lock and a short timeout, so no one can access your device if you step away.
- Enable full-disk encryption, such as FileVault on macOS or BitLocker on Windows.
- Use a privacy screen in crowded places and never leave your laptop unattended.
Consider creating a separate user account for travel or public-network work. That account can have fewer saved passwords, no access to sensitive files, and stricter privacy settings. If something does go wrong, the damage is contained.
Handle Accounts, Payments, and Sensitive Work Carefully
Some tasks are better saved for a trusted network. Avoid logging into banking apps, tax portals, medical records, payroll systems, or company admin tools on public Wi-Fi unless you have no alternative and are using a VPN. Even then, be cautious. A fake captive portal can capture your credentials before your VPN ever connects.
Use a password manager to create and store unique passwords for every account. Turn on multi-factor authentication everywhere you can, and prefer an authenticator app or hardware security key over SMS codes when possible. Do not click "Remember Me" on a shared or public device, and always sign out when you finish.
For remote workers, follow your company's security policy. If IT says to connect to the corporate VPN before checking email, do that every time. If you handle client data, health information, or financial records, treat public Wi-Fi as untrusted by default. A few extra seconds of setup is worth avoiding a data breach.
Incognito or private browsing mode does not make public Wi-Fi safe. It only prevents your local browser from saving history and cookies. It does not encrypt your traffic or hide it from the network.
What to Do If Something Feels Wrong
Trust your instincts. If a network behaves strangely, if your browser warns you about a certificate, or if a login page looks slightly off, disconnect. Then take these steps:
- Turn off Wi-Fi and forget the suspicious network.
- Run a malware scan on your device.
- Change any passwords you entered while connected, using a trusted network.
- Check your accounts for unfamiliar activity and enable MFA if you have not already.
- Notify your IT or security team if you were using a work device or account.
- If payment details were exposed, contact your bank or card issuer and monitor your statements.
Acting quickly matters more than being embarrassed. Most incidents are manageable when they are caught early.
A Quick Pre-Flight Checklist
- Ask staff for the exact network name and password.
- Turn off auto-connect for public networks.
- Connect to a reputable VPN before opening sensitive accounts.
- Confirm HTTPS and the padlock before entering data.
- Disable file sharing, AirDrop, Bluetooth, and nearby sharing.
- Use MFA and a password manager.
- Avoid banking, payroll, and confidential work unless necessary.
- Keep your device updated, locked, and encrypted.
- Log out and forget the network when you leave.
- If anything looks wrong, disconnect and investigate.
The Bottom Line
Public Wi-Fi is not inherently dangerous, but it is inherently shared. You do not control who else is on the network or what they are doing. By verifying the network, encrypting your connection, hardening your device, and saving sensitive tasks for trusted connections, you can work and travel with far less risk.
Make these habits automatic. The next time you open your laptop in a café, airport, or hotel lobby, you will spend less time worrying about security and more time getting things done.
Photo: Vitaly Gariev / Pexels
