Airport Wi-Fi, hotel Wi-Fi, and five minutes that protect you
Public networks abroad are mostly fine and occasionally not. What the real risks are in 2026, what the theatre is, and the settings worth changing.
onesim team
Most advice about public Wi-Fi was written before every website used HTTPS, and it has not been updated since. The idea that someone in the corner of the café is reading your banking session out of the air is, in 2026, largely not the threat.
Here is what actually goes wrong, and the handful of settings worth changing.
What is no longer a real risk
Traffic interception on a normal website. Virtually every site and app now uses encrypted connections. Someone on the same network sees that you connected to a bank, not what you did there.
"Evil twin" networks stealing your password. A fake hotspot named Airport_Free_WiFi can see which servers you talk to and can try to interfere with unencrypted connections. Modern browsers and apps refuse to downgrade, and you get a certificate warning rather than a silent compromise.
What still goes wrong
Captive portals that ask for too much. The sign-in page on a hotel or airport network is a web page, and some of them ask for a phone number, a date of birth or a social login. That is a data-collection exercise, not a security requirement. Give the minimum. Never sign in with your main Google, Apple or Facebook account to get Wi-Fi.
Certificate warnings that people click through. If your browser says a connection is not private on a public network, that is the system working. Do not proceed. Ever.
Auto-joining networks you do not know. Phones remember network names, and any hotspot can claim any name. A phone that auto-joins Starbucks will auto-join anything called Starbucks, anywhere in the world.
File sharing left on. AirDrop set to Everyone, Windows network discovery, and printer sharing are all ways for a stranger on the same network to see your device.
Everything that is not the network at all. By far the most common way people lose money abroad is a phone left on a table, a bag opened on a beach, or a card skimmed at an ATM in a tourist street. The Wi-Fi is rarely the problem.
The five minutes
- 1
Turn off auto-join for public networks · Both platforms
iPhone: Settings → Wi-Fi → the network → Auto-Join off, and set Ask to Join Networks to Ask or Off. Android: Settings → Network & internet → Internet → the gear beside the network → turn off auto-reconnect. Do this for every airport and café network as you leave it.
- 2
Turn off sharing · Both platforms
iPhone: Settings → General → AirDrop → Receiving Off, or Contacts Only. Android: turn off Nearby Share when not using it. On a laptop, turn off file and printer sharing on any network you mark as public.
- 3
Say yes to "Private Wi-Fi Address" · Both platforms
Both platforms can present a different hardware address to each network, which stops networks correlating your device across venues. It is on by default on recent versions; check it is not turned off for networks you use often.
- 4
Keep the phone updated before you go · Both platforms
The single most effective security measure is a current OS. Do the update at home on Wi-Fi, not on a hotel connection at 60 kB/s.
- 5
Use mobile data for anything that matters · Any network
A mobile connection is encrypted between the phone and the mast and is not shared with the lobby. For banking, work email or anything you would not do in front of a stranger, switch to your data package for two minutes.
Do you need a VPN?
Honest answer: for security on public Wi-Fi in 2026, mostly no. HTTPS already does the job a VPN was sold for a decade ago.
A VPN is genuinely useful for three other things: reaching a service that is blocked or geo-restricted where you are, connecting to a work network that requires it, and keeping the network operator from logging which sites you visit. Those are real reasons. "Hackers on the café Wi-Fi" is not the strongest one.
If you use one, pick a paid provider with a published audit. A free VPN pays for itself by selling something, and the something is your traffic.
The things that matter more than the network
Actually protective, in order
- A screen lock with a real passcode, not a four-digit one
- Find My iPhone or Find My Device switched on and tested
- Two-factor authentication on your email above all else
- A separate card for travel with a low limit, not your main account
- Automatic cloud backup, so a lost phone is an inconvenience and not a disaster
Do those five and the Wi-Fi question stops mattering very much.
