The single best move for hotel Wi-Fi is simple: treat the network as untrusted, use a reputable VPN or your phone's cellular hotspot for anything sensitive, and stick to sites that show HTTPS. Disable auto-connect, confirm the exact network name with the front desk, and forget the network once you check out. The checklist below covers every step in more detail.
TL;DR:
- Using a reputable VPN and verifying the hotel's network name with staff significantly reduces risk, especially before entering sensitive information.
- Connecting through a cellular hotspot offers stronger isolation than public Wi-Fi and is recommended for high-stakes transactions.
- Always check the captive portal URL and certificate, and treat any request for more than minimal login details as suspicious.
- Disabling auto-connect, updating devices beforehand, and turning on full-disk encryption help prevent common hotel Wi-Fi attacks.
- Disruptive signs like repeated certificate errors or duplicate SSIDs signal it may be better to switch to a trusted cellular connection.
Table of Contents
- Why hotel Wi-Fi is risky
- How attackers exploit hotel networks
- Defenses that actually reduce your risk
- How to confirm a hotel's Wi-Fi is real before you log in
- When hotel Wi-Fi is not worth the risk
- Why this guidance holds up
- The checklist matters more than the technology
- Finding a VPN that actually protects you on the road
- Sources
- FAQ
Why hotel Wi-Fi is risky
Hotel networks are built for convenience, not protection. Dozens or many strangers share the same access point, often with no isolation between devices, which creates several ways for your data to leak or get stolen.
Unencrypted or weakly protected connections let anyone on the same network watch unprotected traffic pass by. The good news is that most of the modern web has closed this gap: most websites now use HTTPS, which encrypts traffic and cuts the risk of eavesdropping compared with plain HTTP. The risk shifts to the sites and apps that still skip encryption, or to the moment before your VPN or browser protections kick in.
Beyond passive eavesdropping, hotel Wi-Fi carries several other hazards:
- Session hijacking: attackers intercept login cookies and take over an active account session without ever seeing your password.
- Rogue or evil-twin networks: a fake access point mimics the hotel's real SSID to pull in unsuspecting devices.
- Compromised captive portals: the login page itself can be altered to harvest credentials or push a fake software update.
- Physical exposure: lobby business-center computers and unattended laptops add old-fashioned theft and shoulder-surfing to the mix.
Microsoft's threat intelligence team has tracked targeted campaigns against travelers that use fake hotel captive portals to deliver malware and steal credentials, a reminder that this is not a theoretical problem confined to security conference slides.
How attackers exploit hotel networks
Most hotel Wi-Fi attacks follow a handful of well-worn patterns, and knowing the mechanics helps you spot trouble before you hand over a password.
- Evil-twin SSID cloning: an attacker sets up an access point named exactly like the hotel's real network, sometimes with a stronger signal, so devices connect to the fake one automatically.
- Man-in-the-middle and TLS interception: the attacker sits between your device and the internet, and a certificate warning in your browser is often the only visible sign that your encrypted connection has been tampered with.
- Captive-portal phishing: instead of the hotel's real login page, you land on a lookalike page asking for an email and password rather than just a room number, which hands credentials straight to the attacker.
- DNS or API manipulation: malicious redirects send you to fake login or payment pages that look identical to the real thing, often before you even open a browser yourself.
Historic cases underline why certificate checks matter at all. The FTC's action over the Superfish/VisualDiscovery software showed how preinstalled software can silently substitute its own certificates, breaking the encryption users assumed was protecting them. That incident involved a laptop manufacturer rather than a hotel network, but the lesson carries over directly: a device that already trusts the wrong certificate authority can be intercepted even on a network that looks fine.
Defenses that actually reduce your risk
Security guidance from the FBI, CISA, and the FTC converges on a short list of habits that cut hotel Wi-Fi risk dramatically without requiring technical expertise. Apply them in three phases: before you connect, while you're online, and after you disconnect.
- Turn off auto-connect and Bluetooth before you arrive, so your device never joins a network automatically or broadcasts to nearby accessories.
- Update your operating system and apps ahead of travel, since patches close many of the holes that attackers rely on.
- Turn on full-disk encryption and a screen lock so a lost or stolen device does not become a second breach on top of a network one.
- Connect through a reputable, up-to-date VPN before doing anything sensitive, which wraps your traffic in encryption the local network cannot read.
- Stick to HTTPS sites with valid certificates and treat any certificate warning as a stop sign, not a pop-up to dismiss.
- Turn on two-factor authentication for email, banking, and work accounts, so a stolen password alone is not enough to get in.
- Use your phone's cellular hotspot or a travel eSIM for banking, corporate logins, or anything you would not want a stranger reading over your shoulder.
- Forget the network and sign out of accounts once you are done, then glance at recent account activity and change passwords if anything looks off.
Security authorities frame this as a "zero trust" approach to hospitality networks: assume the network itself cannot be trusted, and build your habits around minimizing exposure rather than hoping nothing goes wrong. Guidance from CISA's public Wi-Fi best practices lays out the same sequence: confirm the network name with staff, disable auto-join, open a fresh browser tab rather than an in-app browser, and verify the portal before entering anything beyond a room number.
A VPN is the workhorse of this list, but it is not a cure-all. It encrypts your traffic once it is active, yet it cannot protect a device that is already compromised, and it does nothing during the brief window before you connect to it, which is exactly when captive-portal phishing strikes. For a deeper look at where VPN protection starts and stops, it helps to pair the tool with the device hygiene steps above rather than relying on it alone. Picking the right one also matters: protocol choice affects both speed and security, which is worth understanding before you travel by reading up on how VPN protocols differ.
For the highest-stakes tasks, cellular data beats Wi-Fi entirely. A mobile hotspot generally offers stronger isolation than a shared public network, since you are not sharing an access point with strangers in the first place.
Pro Tip: Set your VPN to launch automatically every time your device joins a new Wi-Fi network, so you are never browsing unprotected even for a few seconds.
How to confirm a hotel's Wi-Fi is real before you log in
Confirming the network before you touch the keyboard is the step most travelers skip, and it is also the cheapest one.
- Ask the front desk or check in-room materials for the exact network name and login steps rather than guessing from a list of similar-sounding SSIDs.
- Open a brand-new browser tab to trigger the captive portal yourself, instead of clicking a link from an email, text, or QR code you did not verify.
- Check the portal's URL and certificate before typing anything: a padlock and a domain that matches the hotel are good signs, while a certificate warning means you should stop and try again.
- Treat requests for more than a room number or last name as a red flag, since a legitimate hotel portal rarely needs an email password or payment details to grant internet access.
CISA's recommended sequence matches this exactly: confirm the SSID with staff first, disable auto-join, open a fresh tab, verify the portal, and only then enter the minimum information required. If a portal asks for anything more, contact hotel IT or the front desk before proceeding rather than guessing it is a formatting quirk.
When hotel Wi-Fi is not worth the risk
Some situations call for skipping hotel Wi-Fi altogether rather than trying to secure it. Sensitive corporate work, cryptocurrency transactions, and investigative journalism all involve stakes high enough that an isolated connection, such as a cellular hotspot, is worth the extra cost or hassle.
Certain signs should trigger an immediate disconnect: repeated certificate errors, unexpected prompts to install software or an app, or multiple networks broadcasting the same SSID with different underlying hardware. CISA notes that mismatched network details are a classic evil-twin indicator, one worth watching for whenever a network list looks duplicated.
When in doubt, switch to a cellular hotspot, flag the issue to hotel security or IT, or move sensitive work to a trusted location entirely.
Why this guidance holds up
This advice draws directly on public guidance from the FBI, CISA, and the FTC, along with Microsoft's threat intelligence reporting on active hotel-targeted campaigns, rather than generic best-practice lists. The recommendations are built around independent, reader-supported reviews, no-logs policy standards, and money-back guarantees on the services compared, with ongoing coverage of travel-specific VPN use cases. The goal is advice you can act on at check-in, not after a problem shows up on a bank statement.
The checklist matters more than the technology
The conventional advice on this topic leans hard on technology, buy a VPN, check for HTTPS, and call it done, while underselling the few seconds of discipline that actually prevent most incidents. Confirming the SSID with the front desk and opening a fresh tab for the captive portal takes ten seconds and blocks an entire category of phishing, yet most guides bury it under paragraphs about encryption protocols.
The bigger gap is timing. A VPN protects you once it is running, but the riskiest moment is often the login itself, before any VPN tunnel exists. That is where captive-portal phishing lives, and it is why the first priority should be verifying the network before you ever reach for an app. Readers who internalize that sequence—verify first, connect second, work third—avoid the mistakes that technology alone cannot catch.
— Secure
Finding a VPN that actually protects you on the road
A travel VPN is only as good as four things: an app that gets updated regularly, a no-logs policy that has been independently audited rather than just claimed, support for the phones and laptops you actually travel with, and a refund policy that lets you back out if it does not fit your trip.
Free VPN apps are especially worth scrutinizing before a trip, since some monetize user data in ways that undercut the privacy you are trying to buy, a pattern worth understanding before relying on a free option for travel. When you are ready to compare vetted options side by side, Top10VPNs' best VPN comparison breaks down pricing, audited no-logs claims, and device support in one place, and the current VPN deals page is worth a look if timing your subscription around a trip. For platform-specific needs:
- Laptop travelers can check the best VPN options for Windows before a work trip.
- Anyone planning to stream from a hotel room can review streaming-focused VPN picks to avoid buffering alongside security tradeoffs.
Install and test your VPN at home before you travel, so the first time you use it is not during a frustrating hotel login.
Sources
- Are public Wi‑Fi networks safe? What you need to know — FTC
- FBI warns of cyber risks when telecommuters use hotel Wi‑Fi — WaTech
- CaptiveCrunch — Microsoft Security Blog
FAQ
How to stay safe while using hotel Wi-Fi?
Confirm the exact network name with hotel staff, disable auto-connect, and run a reputable VPN before doing anything sensitive. Stick to HTTPS sites, enable two-factor authentication on your accounts, and use your phone's cellular hotspot for banking or work logins when possible.
Can hotels see what I do on their Wi-Fi?
A hotel's network operator can potentially see unencrypted traffic and which sites you visit, though HTTPS encryption, now used by most websites, limits what is visible even to someone monitoring the network. A VPN adds another layer by encrypting your traffic before it reaches the hotel's router.
How to get secure Wi-Fi at a hotel?
Ask the front desk for the official network name and login steps rather than picking a similar-looking SSID from the list, then open a fresh browser tab to load the captive portal yourself. Once connected, turn on a VPN and avoid entering anything beyond a room number or last name on the login page.
Why does my hotel Wi-Fi say it's not secure?
That warning usually means the network does not use encryption between your device and the router, which is common on open hotel networks that rely on a captive portal instead. It does not necessarily mean the network is compromised, but it is a signal to use a VPN and avoid sensitive logins until one is active.