You land, you are tired, and the airport offers free Wi-Fi with one tap. Your phone connects before you have finished reading the name.
Most of the time, nothing bad happens. But shared networks in busy places are exactly where attackers go, because so many people connect without looking. This checklist takes about ten minutes the first time and becomes automatic after that.
Before you travel
1. Install and test your VPN at home. Do not wait until you are on a hotel network to discover your login does not work. Connect once, check that your IP address changes, and note a couple of nearby server locations for where you are going.
2. Update your phone and laptop. Many real-world attacks rely on bugs that were fixed months ago. Updating over a trusted network before you leave closes them.
3. Turn on two-factor authentication for email, banking and social accounts. If a password is ever captured, it is not enough on its own.
4. Turn off auto-join for open networks. Phones love to reconnect to any network with a familiar name. An attacker only needs to broadcast "Airport_Free_WiFi" to be joined automatically.
When you connect
5. Confirm the real network name. Ask the front desk or look for official signs. A fake network with an almost-identical name, an "evil twin", is one of the oldest tricks there is, and it works because both names look reasonable.
6. Be suspicious of login pages that ask for too much. A hotel portal may ask for your room number and surname. It should not ask for your email password, a card number or an app download.
7. Connect the VPN immediately after the login page, before you open email or messaging. That way everything after the portal travels through the encrypted tunnel, and the network owner and anyone else on it see only that you are connected to a VPN.
While you are online
8. Watch for certificate warnings. If your browser suddenly says a well-known site's connection is not private, do not click through. On public Wi-Fi, that warning can mean someone is trying to intercept your traffic.
9. Keep file sharing and AirDrop off. Set AirDrop to "Contacts only" or off, and disable network discovery and file sharing on laptops.
10. Do not leave the device unattended and unlocked. Most "hacks" in hotels and airports are still physical: an open laptop at a charging station is easier than any network attack.
When you get home
- Forget the networks you joined on the trip, so your devices stop trying to reconnect to them.
- Review account activity for anything unexpected, especially email and banking.
- Change any password you typed on a network you did not trust without a VPN running.
Why the VPN step matters most
Most of the risk on shared Wi-Fi comes from not knowing who else is on the network or who runs it. A VPN does not make the network trustworthy. It makes the network's trustworthiness matter much less, because what crosses it is encrypted end to end between you and the VPN server.
Korp VPN works on Android and iOS, with unlimited data, so you can leave it on for the whole trip without counting megabytes. There is a 5-day free trial if you want to test it before you fly.