Should I connect the VPN before or after the hotel captive portal?

Usually finish the captive portal first so the hotel gateway allows internet access, then enable the VPN and kill switch. If the VPN blocks the portal page, temporarily allow the portal domain or use the provider’s split-tunnel captive helper, then return to full tunnel.

Public Wi-Fi threat model (2026)

Q: Is a VPN enough on café Wi-Fi?

A VPN with a working kill switch greatly reduces local-network snooping and rogue hotspot risk for your traffic path, but it does not stop phishing sites, malware, or shoulder surfing. Pair it with HTTPS, MFA, and common-sense limits on sensitive logins.

Q: What should I never do on open Wi-Fi?

Avoid password resets, payroll, banking, and uploading ID documents on networks you cannot verify. If you must share photos later, strip GPS/EXIF with a local tool before posting.

Last updated 2026-10-27 · Asia/Shanghai · Original practical guide · not legal advice

“Just use a VPN” is incomplete advice. This page models who can hurt you on open Wi-Fi, which controls actually change the outcome, and when you should refuse the network entirely. It is written for travelers, remote workers, and anyone who habitually joins “Free_Airport” without reading the SSID twice.

Disclosure: wordok.top publishes VPN educational pillars and a USA VPN 2026 scorecard. We also ship browser-local image tools (EXIF Strip, Watermark). This checklist is hygiene guidance, not a penetration-test report.

Assets you are protecting

Session cookies for email, work SaaS, and shopping.
Credentials typed into HTTP or broken TLS paths (rare but still seen on captive portals).
Local device reachability when hotels skip client isolation.
Metadata in photos you upload from the lounge (GPS, device tags) — separate from network crypto.

Threat actors (keep them separate)

Actor	Typical move	What helps
Opportunistic peer on same LAN	Port scans, SMB probes, mDNS noise	OS firewall, client isolation (hope), VPN full tunnel
Evil-twin / fake portal	Lookalike SSID; harvest passwords	Verify SSID with staff; never reuse hotel portal passwords elsewhere; MFA
Local passive observer	Sniff open or weakly segmented traffic	HTTPS everywhere + VPN encryption on the path
Phishing site after you are “online”	Malicious ads / typosquat	Not a VPN job — browser hygiene, password manager, MFA

Control stack (ordered)

Identity the network — ask front desk for the exact SSID; watch for “HotelGuest_Free” twins.
Captive portal first — complete login so the gateway routes you; then enable VPN.
Kill switch on — if the tunnel drops, traffic should not silently fall back to clearnet. See our privacy best practices.
Leak check — after connect, confirm DNS / WebRTC expectations with a trusted leak test page.
Task triage — postpone banking and password resets if the network feels wrong; use phone cellular for those.
Share-later hygiene — strip EXIF before posting travel photos (photo privacy checklist).

Café vs hotel vs airport

Café: short sessions, often open or weakly segmented; prioritize VPN + avoid account recovery flows.
Hotel: longer stays, captive portals, sometimes no client isolation — see hotel Wi-Fi VPN notes and public Wi-Fi security guide.
Airport: high evil-twin density; prefer cellular for anything sensitive; treat “free premium Wi-Fi” ads as hostile until proven.

What a VPN does not fix

Endpoint malware, fake apps, shoulder surfing, and “I reused my email password on the portal” are outside the tunnel. If your threat model is a nation-state or a targeted stalker, public Wi-Fi plus a consumer VPN is the wrong primary control — reduce exposure instead.

wordok.top related pages

USA VPN 2026 scorecard (streaming + privacy weights)
What is a VPN · How VPN protects privacy
How to protect privacy online
EXIF Strip · Watermark · Tools hub

FAQ

Is a VPN enough on café Wi-Fi?

It helps for path encryption and IP masking; it is not a complete security program. Keep MFA and phishing awareness.

VPN before or after captive portal?

Usually portal first, then VPN + kill switch. Providers differ — test once on a low-stakes site.

What should I never do on open Wi-Fi?

Password resets, payroll, banking, and ID uploads. Use cellular or wait for a trusted network.