VPN on a Trip: A Practical Checklist for Travel and Public Wi-Fi
Travel is the situation where a VPN earns its place more easily than at home, and also the situation where people use one badly. The marketing version says a VPN makes public Wi-Fi safe. The accurate version says a VPN closes one specific gap that public Wi-Fi leaves open, and leaves several others exactly as they were. This guide is a checklist rather than a recommendation: what a VPN does helpfully, what it does not, and the small number of things that matter more than the tunnel.
Table of contents
- The actual threat on a hotel or airport network
- What the tunnel fixes
- What it does not fix
- The pre-departure checklist
- On arrival: the first fifteen minutes
- Countries, blocks, and the limits of a tunnel
- FAQ
- Bottom line
The actual threat on a hotel or airport network
It is worth being precise, because the popular mental model overstates the risk in one direction and understates it in another.
On an open network, traffic between your device and the sites you visit is usually visible to the network operator, and in many cases to anyone else on the same network. That is the gap a VPN closes. What this means practically: the operator of the airport or hotel Wi-Fi can generally see which domains your device is contacting, and in unencrypted HTTP cases can see the content as well. Modern encrypted connections to major sites mean the content is usually protected already; the domain visibility is the part that remains.
The underappreciated direction is that the network operator may also be able to interfere: redirecting a lookup to a different address, or serving a page that intercepts a login. This is why the second half of this guide is about signals and behaviour rather than about the tunnel.
What the tunnel fixes
- Domain visibility to the local network. With a tunnel, the local operator sees a connection to your provider's server rather than a list of the sites you are visiting. This is the main gain and it is real.
- Interception on unencrypted connections. Anything that still travels in the clear gets carried inside the tunnel. The number of such connections has fallen a great deal, but it has not reached zero.
- Location-based rate limiting. Some services behave differently by the apparent location of the connection. A tunnel changes the apparent location, which can help or hurt depending on the service.
- Hotspot substitution. A device that appears to be a hotel access point cannot read the contents of the tunnel, though it can still see the connection to the provider.
What it does not fix
- Compromised endpoints. A device with malware, a malicious app, or a browser extension with wide permissions is unaffected by where the traffic goes.
- The coffee-shop camera. Physical observation of your screen and keyboard is not a network problem.
- Phishing. A convincing login page will capture your credentials regardless of the tunnel. The form is encrypted end to end to the criminal's server, not to yours.
- Device-to-device attacks on the local network. File sharing and local discovery features can expose your device to other people on the same network. Turning those off is more effective than any tunnel.
- The provider's own logging. A tunnel moves trust from the local network to your provider. Reading the logging policy is what determines whether that is an improvement, and the method is in reading a logging policy clause by clause.
- Which sites you visit. A provider that cannot read your traffic may still know which servers you connect to, and websites can identify you by other means entirely.
The pre-departure checklist
- Install and sign in before you leave. Setting up a client on an unfamiliar network is a bad time to discover the app needs an update or your account needs a second factor you cannot reach.
- Confirm the client works on every device you will use. A laptop is usually covered; a phone often needs a separate setup, and some providers treat mobile and desktop as separate subscriptions on a single plan.
- Turn on the kill switch. If the tunnel drops, the client should block traffic rather than let it go out unprotected on the local network. This is the single most useful setting to enable before you leave.
- Decide the auto-connect behaviour. Auto-connect on untrusted networks is convenient and prevents the failure mode where you forget. Leaving it off entirely means one day you will forget.
- Check your subscription validity date. A subscription that lapses mid-trip is a bad failure mode, because the client will keep trying to reconnect and produce a stream of errors that look like a network fault.
- Update the operating system and browser. Not primarily a privacy step; a patched browser is the thing that stops a hostile page doing damage when you connect to a captive portal.
- Note the provider's server locations near your destination. A nearby server is faster and more reliable than one on the other side of the world.
- Set up multi-factor authentication on your email account. If your mail is compromised, every other account that uses it for recovery is at risk. This matters more on a trip than at home.
On arrival: the first fifteen minutes
Hotel and airport networks have a familiar shape, and knowing it saves time.
- Expect a captive portal. You will connect to a network named like the hotel, and a page will appear asking for a room number or password. Do the sign-in first. Attempting to open other sites before the portal is released often produces errors that look like a broken connection.
- Then connect the VPN, and check it. Open your usual IP or DNS check page and confirm the address has changed as expected. If it has not, the tunnel is not running, and everything you do next is unprotected.
- Watch for the hotel network pretending to be something else. A network name is not an identity, and a name that resembles a legitimate one may be an impersonation attempt. The portal page should be served over the network you are on, and it should look like the hotel's. If a certificate warning appears for the portal itself, stop and ask the front desk.
- Prefer your own hotspot if you have one. A phone hotspot is generally more trustworthy than a venue network, at the cost of your mobile data plan and battery. For genuinely sensitive work on an unfamiliar network, it is the more reliable option.
- Do not enable “auto-join” for the hotel network permanently. Join it for this stay, and forget it afterwards. A network you never re-join is a network that cannot silently reappear.
Countries, blocks, and the limits of a tunnel
A VPN changes the apparent location of your connection, and that has consequences which are sometimes useful and sometimes the opposite of useful.
- Some services react badly to a distant location. A banking application may refuse a sign-in from an unexpected country, and a service that geoblocks content may now block you. A tunnel that solves one access problem can create a payment problem.
- Some networks block the tunnel itself. A network that filters by domain or by port can interfere with a connection to a provider, particularly on port 443. This is a real limitation, and no configuration guarantees it will not happen.
- Being blocked in a jurisdiction is not fixed by a tunnel. A service that refuses to operate in a country will usually refuse based on the payment details or the account origin, not the connection path.
- Know the rules where you are. What is lawful to access varies by country, and using a tool to reach something prohibited locally is a legal question rather than a technical one. This guide does not cover that question and cannot advise on it.
FAQ
Is a VPN enough on public Wi-Fi?
It closes the most common network-level exposure, and it does not close several others. Treat it as one control rather than a solution: combine it with multifactor authentication on your important accounts, a password manager that will not autofill on a lookalike domain, disabled file sharing and discovery, and attention to what you type on public machines.
Should I use the VPN on my phone's own cellular connection?
Generally not necessary. The cellular connection is not a shared network, and its operator is not in the position to see which sites you are visiting in the way a venue operator can. The tunnel is worth it on networks you do not control.
What about a VPN that also blocks malicious sites?
That is a reasonable addition rather than a replacement for anything, and it is worth having. The same caution applies as with desktop antivirus: the blocklist is a published set of names, so it catches known-bad hosts and not unknown ones. Treat it as a cheap extra layer.
Will a VPN slow my connection noticeably?
Some, and less than most people expect. The overhead comes from the extra hop and from encryption work, and it is smallest when the provider's server is near you. On a poor venue network the tunnel can actually improve throughput, because the network's own congestion is often worse than the added hop.
Is a free VPN service acceptable while travelling?
No, and the reason is structural rather than about one provider's intentions. A free service has to be paid for somehow, and the usual mechanisms — selling your browsing data, serving advertising infrastructure, or being an unreliable business — run directly against what you are paying a subscription to avoid. The method in how to read a VPN's claims covers how to check what a provider's business model is.
Bottom line
On a trip, a VPN is worth having and worth configuring before you leave rather than on arrival. It removes the network operator's visibility of your browsing and closes the gap that open Wi-Fi leaves. It does not protect you from a compromised device, a convincing phishing page, or a camera pointed at your screen, and those are the risks that account for most actual losses. Set up the client, turn on the kill switch, enable multi-factor authentication on the accounts that matter, disable local file sharing, and check the tunnel is actually up before you do anything sensitive. Then enjoy the trip.
If you have settled on a provider category and want to see current pricing, the link below goes to our own page for the category.