You land at 11 p.m., your phone finds a network called "Airport_Free_WiFi," and you tap Connect without thinking. Most of the time nothing happens. But the handful of times something does — a fake hotspot, a captive portal asking for more than it should, a hotel network that lets the room next door see your laptop — are the reason a short routine is worth learning.

Public Wi-Fi is not automatically dangerous. Plenty of airports, cafés, and hotels run well-configured networks. The trouble is that you cannot tell from the outside which one you have joined, so the safe approach is to behave as if the network is shared and possibly watched. Here is what to do before, during, and after you connect.

Why shared networks are different from your home Wi-Fi

At home you control the router, the password, and who gets on. On a public network, the person at the next table is on the same local network as you. That changes three things.

Traffic can be visible. On an open network without encryption, anything not protected by HTTPS can be read by someone nearby. Even with HTTPS, the network can usually see which domains you visit, because the domain name travels in the clear unless the connection uses newer privacy features.

Anyone can name a hotspot. Setting up a network called "Hotel_Guest_WiFi" takes a laptop and two minutes. That is the classic evil twin: a lookalike network that harvests your login page or pushes a malicious download.

Your devices trust too much. Phones and laptops remember old networks and reconnect on their own. They may still have file sharing, AirDrop, or Nearby Sharing switched on from your last meeting.

The pre-connection checklist

Run through this before you join anything. It takes two minutes the first time and about ten seconds after that.

1. Ask staff for the exact network name. "What's the Wi-Fi called?" is faster than guessing and removes the evil twin problem almost entirely.
2. Turn off auto-join. In your phone's Wi-Fi settings and your laptop's network preferences, disable joining open networks automatically.
3. Forget old public networks. Delete saved hotspots from airports and cafés you no longer visit. A remembered network is a spoofing opportunity.
4. Switch off sharing features. File sharing, printer sharing, AirDrop set to "Everyone," and Nearby Sharing should all be off.
5. Enable your firewall and make sure your operating system and browser are fully updated.
6. Decide what you actually need to do. For banking, government paperwork, or anything involving a card number, use your phone's mobile hotspot instead.
7. Start your VPN before you log in, not after. If a captive portal needs a browser first, connect the VPN the moment the portal accepts you, before opening anything else.

Captive portals and fake hotspots: where travelers get caught

The login page is the most exposed moment of the whole session, because it is the one page you have to interact with before any protection is in place. A real captive portal asks for a room number, a code from a receipt, or a simple "Accept terms" click. It rarely asks you to install something.

Treat these as red flags:

• A prompt to install a certificate or configuration profile to "complete" the connection.
• A login page asking for your email password, Apple ID, Google password, or card details on a network that is advertised as free.
• Certificate warnings in the browser. Never click through them on a network you do not control.
• A page that imitates your bank, your webmail, or your company login but arrived from the Wi-Fi.

If something feels off, disconnect and ask the front desk or a staff member. A two-minute detour beats a compromised account.

HTTPS checks and what the padlock does not prove

Look at the address bar before you type anything sensitive. "https://" and the padlock mean the connection between your browser and that site is encrypted, so someone sharing the network cannot read it in transit. What the padlock does not mean is that the site is honest, or that you typed the right domain. Phishing sites can obtain certificates too.

Two habits cover most of this. First, type the address yourself or use a bookmark rather than clicking a link from an email or a search result. Second, turn on your browser's HTTPS-only mode if it has one, so it refuses to load the unencrypted version of a page without asking. If you see "Your connection is not private," stop there instead of clicking through the warning. Browsers flag insecure forms for a reason, and the one time it matters, it really matters.

It also helps to log out of accounts when you finish, rather than just closing the tab. A session left open on a shared machine or a shared network is an invitation.

VPN, mobile hotspot, and what to avoid

A VPN builds an encrypted tunnel between your device and the VPN provider, so the café's network sees one scrambled stream instead of your individual connections. That is genuinely useful on an open network, especially for work email and anything unencrypted.

What it does not do: it does not make you anonymous, it does not stop malware from a download you chose, and it does not save you if you log into a phishing page. It also does not help when a network blocks VPN traffic, which some hotels and conference venues do. In that case, your phone's mobile hotspot is the better answer.

If you rely on a VPN, pick a reputable provider, keep the app updated, and know how to reconnect quickly. Free VPNs that monetize your traffic are a poor trade on a network you already distrust. If your employer issues a laptop with a company VPN, use that for work rather than a personal one.

One more thing worth doing: keep your phone's hotspot as the default for anything sensitive. It costs a little data, but it removes an entire category of risk from your trip.

Your five-step travel routine

Ask for the network name. Turn off auto-join. Join and watch for anything unusual in the portal. Start the VPN before opening mail or banking. Forget the network before you leave the building.

That routine takes less time than ordering a coffee, and it holds up whether you are in a departure lounge, a chain café, or a hotel that hands you a room number and a password on a card. The goal is not to avoid public Wi-Fi entirely — it is to use it deliberately, keep the sensitive tasks on a connection you control, and notice when something about the setup does not add up.

Photo: jothamsutharson / Pixabay