The most useful public Wi-Fi advice begins by separating the network from the things you do through it. A hotel network can be unfamiliar without every password you enter becoming visible to everyone nearby. A website can use encryption and still be a convincing fraud.
For a remote worker, that distinction matters. Treating every hotspot as catastrophic encourages expensive reassurance purchases; treating every padlock as proof of safety encourages the wrong kind of confidence. A workable routine checks the network, the destination, the device and the employer's rules separately.
Encryption has changed the old public Wi-Fi story
The US Federal Trade Commission's current guidance notes that widespread website encryption makes public Wi-Fi generally safe to use. It also cautions that an encrypted connection does not establish that a website is legitimate. Those two points belong together: modern protection is meaningful, but it does not make judgment unnecessary. FTC public Wi-Fi guidance
Think of HTTPS as protecting the exchange with the website you reached. It is not a character reference for that website. If you follow a fraudulent link and submit credentials to the wrong business, an encrypted connection may have protected the journey to precisely the wrong recipient.
That leads to a better habit than scanning for one security icon. Open important services through a saved bookmark or known application. Check unexpected sign-in requests against the action you intended to take. A hotel asking you to accept network terms is one thing; a page asking for your employer's password to “activate faster Wi-Fi” is another.
Verify the network before joining it
Ask the venue for its network name and login process. A familiar-looking name on the Wi-Fi list is not independent confirmation. A written instruction in your room or a conversation with staff gives you something to compare with the screen.
Network verification reduces one uncertainty; it does not certify everything connected to the access point. You should still keep the operating system and browser updated and use the device's appropriate public-network or sharing settings. Do not enable file sharing merely to make a login screen work.
Be especially cautious when the proposed remedy changes the security of the device. Installing an unfamiliar certificate, management profile or application is a different action from accepting a venue's ordinary terms. If access appears to require it, stop and verify with an appropriate administrator. On a work-managed device, that means your IT team, not just the person at reception.
Understand the captive portal problem
Many guest networks let a device join Wi-Fi before granting it internet access. The sign-in or terms page in between is a captive portal. This explains a common situation: the laptop shows a Wi-Fi connection, yet work applications report that they are offline.
A VPN that refuses all traffic outside its tunnel can complicate this stage. The tunnel may need an internet connection that the portal has not yet permitted. The UK's National Cyber Security Centre discusses captive portals as a consideration in VPN deployment. This is an interaction to plan for, not proof that the VPN is broken. NCSC VPN guidance
For a personal device, follow your VPN provider's documented portal procedure, complete only the expected network login, then confirm the VPN is operating before continuing with work that requires it. Do not improvise around employer-enforced controls. If policy leaves no permitted way to authenticate, use an approved alternate connection.
The useful preparation happens before the trip: learn what the application looks like when connected, disconnected and blocking traffic. Otherwise a protective block can look indistinguishable from an unreliable hotel connection.
Decide what a VPN is supposed to accomplish
A consumer VPN is a route through another network provider. It can reduce what the local access network can observe about traffic inside the tunnel, but it also creates a relationship with the VPN operator. It is not an invisibility service, a phishing cure or permission to access company resources from an unapproved location.
A company VPN serves a different operational purpose: it may be the approved route into business systems. You should not replace it with a consumer subscription because the latter has better advertising, or place another tunnel around it without checking compatibility.
Start with the requirement. If your employer mandates its own VPN, that requirement leads. If you are choosing a consumer VPN for personal use, evaluate its actual behavior on your device: connection failures, network changes, captive portals and disconnection. Our public Wi-Fi VPN comparison focuses on those decisions rather than promising a universal “safest” product.
Account protection still matters on a good network
A well-maintained browser on a legitimate network cannot rescue an account protected by a reused password after that password is stolen elsewhere. Network hygiene and account hygiene address different risks.
Use unique passwords and the strongest practical sign-in method offered by the services you depend on. More importantly for travel, prepare the recovery route. An authenticator that lives only on the phone you use as a hotspot can become a serious availability problem if the phone disappears.
Keep recovery information protected and independent enough to survive that loss. Independence does not mean scattering plaintext secrets across email and luggage. It means knowing which other trusted device, security key or securely stored recovery record gets you back in. The account recovery guide walks through that dependency.
Consider the room around the network
A privacy screen does not encrypt traffic; a VPN does not hide a confidential spreadsheet from the person beside you. Public work involves both technical and physical exposure.
Choose a seat with your screen facing away from foot traffic when possible. Use headphones, but remember that your side of a conversation is still audible. A busy café may be perfectly adequate for editing a public document and inappropriate for a client call containing sensitive information.
Lock the device when you step away and keep it with you. Avoid turning a discussion of Wi-Fi into an excuse to overlook straightforward device custody. If the work requires privacy the venue cannot provide, changing networks is not enough: change the work or the place.
Run a short check before consequential work
A useful check has an outcome. You should finish it knowing whether to proceed, use your fallback or postpone the sensitive part.
First, confirm you joined the intended network and completed only the expected portal. Next, open the actual work application and verify that its sign-in and connection behave normally. If an employer VPN is required, check that it is active. Finally, assess the surroundings and make sure the backup connection can carry the essential task.
Do not use a certificate warning as a puzzle to solve by clicking through. Do not move a company file to personal storage because the approved service will not load. Both actions change the risk of the work to get around a temporary connectivity problem.
A warning or unfamiliar login request deserves investigation. A weak signal or slow meeting deserves a performance fallback. Keeping those problems separate helps you respond proportionately.
When mobile data is the better choice
Use a hotspot when you cannot establish the network's identity, when the permitted portal process will not work, or when the network is too unreliable for the task. It can simplify the path, but it still requires adequate allowance, power and account security.
For a routine session on a verified public network, with current software and properly protected services, buying a new security product is not automatically the next step. Consistency is more valuable: know where you are signing in, keep recovery workable, obey work policies and have another way to complete the essential task.
A verified network is only the start of the decision. The hotel, airport and café work routine checks whether the connection and surroundings suit the task. The VPN comparison explains the additional controls worth evaluating when a personal VPN has a defined role.
Research note: primary guidance reviewed on 11 October 2026. This article does not certify any venue or network and does not report penetration testing. Employer requirements take precedence over the personal-device workflow.
