Protect yourself on hotel Wi-Fi by encrypting your traffic, keeping your device locked down, and refusing anything the network pushes at you. These steps take about five minutes to set up.
- Use a VPN. A VPN encrypts everything leaving your device, so the hotel and other guests see only a connection to the VPN server. NIST's guidance for travelers recommends one for public networks. A service like NordVPN works on phones and laptops. Check local law first in places like China or the UAE, where VPN use is restricted.
- Stick to HTTPS. Look for the lock in the address bar. HTTPS hides page contents and passwords, but the network can still see which domains you visit, which is the gap a VPN closes.
- Turn on two-factor authentication. The FTC recommends strong passwords plus 2FA and keeping your OS and browser updated. A stolen password is far less useful without the second factor.
- Switch off sharing. On a laptop, disable file and printer sharing and AirDrop "Everyone" mode. The NSA advises the same for anyone on public Wi-Fi.
- Stop auto-joining. Tell your device to forget the hotel network when you check out, so it won't connect to a copycat with the same name at your next stop.
- Ignore update prompts from the network. Install updates only from System Settings or the app store.
- Log out when done. Especially on shared lobby computers, which you should avoid for banking entirely.
A VPN doesn't block phishing emails or malware you download yourself, so steps 3 through 6 still matter even with one running.