The question of whether hotel Wi‑Fi is safe has no single answer. Security vendors such as Norton describe hotel networks as generally unsafe by default, while the Federal Trade Commission points out that widespread HTTPS encryption usually makes public Wi‑Fi safe for casual browsing. This resource balances both views, drawing on government guidance, security-industry research, and traveler reports to give you an actionable safety framework.

Last checked: 2026-07-02

Default Security Level: Often unsecured or protected with weak passwords (source: goleadingit.com) · Hotel’s Ability to Track: Yes, hotels can see browsing activity (source: PAA and related search consensus) · Recommended Protection: Use a VPN (source: related searches and multiple top results) · Critical Safe Practice: Avoid logging into sensitive accounts such as banking (source: RD.com)

At a glance: Hotel Wi‑Fi safety facts

1 Default Security

• Hotel Wi‑Fi is generally unsafe by default, especially for sensitive activities (Norton)

2 Breach Incident

• 31% of hospitality organizations have experienced a data breach (Surfshark)

3 Encryption

• Widespread HTTPS encryption usually makes public Wi‑Fi safe for typical browsing (FTC)

4 Mitigation

• VPN use is recommended for every connection to hotel Wi‑Fi when handling sensitive data (Kyber Security)

Category	Fact
Default Safety	Hotel Wi‑Fi is generally unsafe by default, especially for sensitive activities (Norton).
Encryption Benefit	Widespread HTTPS encryption usually makes public Wi‑Fi safe for typical browsing (FTC).
Breach Rate	31% of hospitality organizations have experienced a data breach (Surfshark).
Personal Info Breaches	About 20% of personal information breaches on public Wi‑Fi are linked to hotel open networks (Surfshark).
VPN Recommendation	VPN use is strongly recommended for handling sensitive data on hotel Wi‑Fi (Kyber Security).
Sensitive Login Warning	Avoid logging into sensitive accounts such as banking and confidential work materials (RD.com).
Best Practice – SSID Confirmation	Confirm the exact network name (SSID) with hotel staff before connecting (Norton).
Best Practice – Disable Sharing	Disable file sharing, auto‑connect, and Bluetooth to reduce attack surface (Norton).

Is it safe to connect to a hotel Wi‑Fi?

Connecting to a hotel network carries inherent risk because the network is shared among unfamiliar devices and often lacks strong configuration. Norton’s editorial team states, “No, it’s generally unsafe to use hotel Wi‑Fi because many establishments have lackluster network security, older networking technology, and insufficient data encryption.” The IT firm GoLeadingIT echoes this: “Hotel Wi‑Fi is often unsecured, frequently protected with weak passwords, and shared by hundreds of guests on the same network.” On the other hand, the FTC notes that if you stick to encrypted sites (HTTPS) and keep your device updated, typical browsing can be safe. The safety level ultimately depends on what you do: casual reading vs. logging into a bank account.

“Because of the widespread use of encryption, connecting through a public Wi‑Fi network is usually safe.”

Federal Trade Commission, consumer guidance (2022)

However, the FTC’s advice applies primarily to modern websites and apps that use HTTPS. Older web pages, unencrypted email, and any service transmitting plain‑text passwords remain vulnerable. Several sources, including GoLeadingIT and Aura, stress that hotel networks should be treated as untrusted. Aura’s editorial team puts it bluntly: “In short: No, hotel Wi‑Fi isn’t safe.”

The bottom line: Hotel Wi‑Fi is safe for lightweight, encrypted browsing, but it becomes risky as soon as you access sensitive accounts or transmit unencrypted data.

How do I know if my hotel Wi‑Fi is secure?

Judging the security of a hotel network is tricky because most of the technical details are invisible to guests. Kaspersky lists 12 warning signs that a Wi‑Fi network may be compromised, including a drastic slowdown in speed, unexpected redirects to unfamiliar pages, and repeated requests to accept security certificate exceptions. On Reddit’s r/AskNetsec, security practitioners advise that you should never accept a certificate warning, even if the hotel’s login portal seems to require it. A legitimate portal should use a valid certificate trusted by your browser.

Other indicators of a potentially unsafe network include: a network name that doesn’t match what the hotel front desk provides, a splash page that asks for unnecessary personal data (such as your passport or credit card), or a network that doesn’t require any password at all. GoLeadingIT notes that some hotels still run outdated security protocols like WEP or poorly configured WPA/WPA2, which makes traffic interception relatively easy for an attacker within range.

What to watch: A secure hotel network will match the SSID provided by staff, use a valid certificate, and not ask for sensitive personal data during login.

How do I protect myself on hotel Wi‑Fi?

When you must use hotel Wi‑Fi, a layered approach dramatically reduces your risk. Follow these steps based on recommendations from Norton, Kyber Security, and Aura:

1. Confirm the exact network name (SSID) with the front desk. Avoid any network that looks like a variation (e.g., “Marriott_Free” instead of “Marriott_Guest”).
2. Turn off auto-connect and disable file sharing and Bluetooth before joining the network.
3. Use a VPN (Virtual Private Network) for all traffic, especially if you plan to access email, banking, or work systems. Multiple sources, including Kyber Security, call a VPN the single most effective protection.
4. Keep your device updated – operating system, browser, and antivirus – because patches close vulnerabilities that could be exploited over public Wi‑Fi.
5. Avoid sensitive transactions such as online banking or logging into confidential corporate systems unless you are connected through a VPN or a personal mobile hotspot.
6. Use a personal mobile hotspot or cellular tethering for any activity involving financial data or work-sensitive material. This gives you a private, encrypted connection that bypasses the hotel network entirely.

“Short answer: no, not by default. Hotel Wi‑Fi is often unsecured, frequently protected with weak passwords (or no real protection at all), and shared by hundreds of guests on the same network.”

GoLeadingIT, cybersecurity services firm

For business travelers, Kyber Security recommends that employers issue corporate VPN access and enforce multi‑factor authentication. A personal hotspot, when available, is always the safer alternative for sensitive work.

Why this matters: Taking these steps can reduce the risk of credential theft, malware infection, and data interception – even if the hotel network itself is compromised.

Can hotels track what you do on their Wi‑Fi?

Yes, hotels (or any entity operating the network) can see your browsing activity. Every connection passes through the hotel’s router and infrastructure, which means the hotel can log which IP addresses (and thus roughly which sites) you visit, how long you stay connected, and how much data you use. If the sites you visit use HTTPS, the content of your traffic is encrypted, but the destination domain and the duration of your connection remain visible. If you visit sites using plain HTTP, a hotel (or anyone on the same network) can see everything: passwords, messages, uploaded files.

Theft of session cookies or login credentials is a well‑known risk on shared networks, which is why security guides uniformly recommend using a VPN. A VPN encrypts your entire traffic and routes it through an external server, preventing the hotel from seeing which sites you visit or what data you send. Aura’s security team advises that even with HTTPS, the hotel can still see the target website’s domain; only a VPN hides that from the network operator.

“No, it’s generally unsafe to use hotel Wi‑Fi because many establishments have lackluster network security, older networking technology, and insufficient data encryption.”

NortonLifeLock (Norton) editorial team

The catch: The hotel can track your browsing pattern, but using HTTPS limits what they see; a VPN hides everything from the network operator.

Frequently asked questions

Is it safe to use hotel Wi‑Fi for banking?

No, you should avoid conducting banking or other financial transactions over hotel Wi‑Fi. RD.com explicitly warns against using hotel networks for sensitive logins, and security vendors like Norton and Kyber Security recommend using a VPN or a mobile hotspot if banking cannot be postponed.

Can hotels see what I search on hotel Wi‑Fi?

Yes, the hotel can see the domain names you visit and how long you stay on each site. The content of HTTPS pages is encrypted, but if you visit non‑HTTPS sites, your full browsing activity (including search terms and passwords) is visible to the hotel network and to anyone else on the same network.

Does a VPN protect me on hotel Wi‑Fi?

Yes, a VPN encrypts your entire internet connection and tunnels it through a remote server, preventing the hotel and anyone on the network from seeing your traffic destination or content. Multiple sources, including Kyber Security and Aura, recommend using a VPN at all times when connected to hotel Wi‑Fi.

What are the biggest risks of hotel Wi‑Fi?

The primary risks include man‑in‑the‑middle attacks, rogue “evil twin” access points that impersonate the hotel network, traffic sniffing, and malware injection via captive portals. GoLeadingIT and Norton highlight that networks are often poorly secured and shared by hundreds of guests, making these attacks easier to execute.

How can I tell if my hotel Wi‑Fi is safe?

Check that the network name (SSID) matches what the hotel staff provides. Never accept a security certificate exception. Look for a valid HTTPS connection on the login page. Use a VPN and avoid sensitive activities. Reddit’s r/AskNetsec contributors also recommend confirming that client isolation is enabled – though you may not be able to verify this without a network test.

Is hotel Wi‑Fi safe on iPhone?

An iPhone is not inherently safer on hotel Wi‑Fi than any other device. Apple’s iOS locks down some settings, but the same risks apply: your traffic can be intercepted if you visit non‑HTTPS sites, and you remain vulnerable to rogue access points. Using a VPN on your iPhone is just as important as on a laptop.

Can hotel Wi‑Fi give my device a virus?

Direct virus infection from hotel Wi‑Fi is uncommon, but it is possible through drive‑by downloads or malicious pop‑ups in a compromised captive portal. Keeping your device updated and avoiding suspicious downloads reduces this risk. Aura recommends scanning your device with an antivirus after returning from travel as a precaution.

The bottom line: Direct virus infection from hotel Wi‑Fi is uncommon, but it is possible through drive‑by downloads or malicious pop‑ups in a compromised captive portal. Keeping your device updated and avoiding suspicious downloads reduces this risk. Aura recommends scanning your device with an antivirus after returning from travel as a precaution.