Enhancing Public Wi‑Fi Security: A Guide to VPN, DNS over HTTPS (DoH) and Captive Portal Best Practices

November 22, 2025

Working Safely on Public Wi‑Fi: VPN, DoH and Captive Portals Explained

Public Wi‑Fi networks are everywhere: in airports, hotels, cafés, coworking spaces and even city parks. They are convenient, but they are also one of the weakest links in your digital security. Attackers love open networks because they can intercept traffic, steal credentials and inject malicious content with little effort.

This article explains how to work safely on public Wi‑Fi using three key concepts: VPN (Virtual Private Network), DoH (DNS over HTTPS) and captive portals. You will learn what risks you face, which tools protect you, how to configure them in practice and what to avoid when you connect from an untrusted hotspot.

Why Public Wi‑Fi Is Inherently Risky

Public Wi‑Fi is usually open, shared and poorly segmented. That combination creates several security threats:

Packet sniffing
On an unencrypted network, attackers can capture traffic and see what you do online. Even when websites use HTTPS, metadata such as domains you visit, connection times and data volume may still leak.
Evil twin access points
An attacker can set up a fake hotspot with a name like “Free Airport WiFi” and trick users into connecting. Once you join the rogue network, the attacker can monitor or modify your traffic.
Man‑in‑the‑middle attacks (MITM)
With access to the same network, attackers can attempt to downgrade encryption, inject fake login pages or redirect you to phishing sites through DNS spoofing.
Insecure captive portals
Captive portals are the login or acceptance pages you see when you first connect. Many portals use unencrypted HTTP, weak certificates or outdated scripts, which can be abused to collect personal data or install tracking cookies.
Lateral movement on the LAN
If the hotspot does not isolate clients, other users on the same Wi‑Fi can scan your device for open ports, weak shares or vulnerable services.

To work safely in these environments, you need to encrypt as much of your traffic as possible and harden the way your device connects to the internet.

VPN: Your First Line of Defense on Public Wi‑Fi

A Virtual Private Network (VPN) creates an encrypted tunnel between your device and a trusted server. When you connect to a VPN on public Wi‑Fi, several important protections kick in:

End‑to‑end encryption of your traffic
All data from your device to the VPN server is encrypted. Local attackers on the same hotspot only see unreadable ciphertext, not your logins, emails or documents.
Protection against local DNS spoofing
When configured correctly, a VPN routes your DNS queries through its own DNS servers. Attackers on the Wi‑Fi cannot easily redirect you to fake websites via poisoned DNS responses.
Hidden browsing activity from the hotspot owner
The café or hotel operator can see that you are using a VPN, but they cannot see which websites you visit or what content you access through the tunnel.
Consistent security policy across networks
Whether you work from an airport lounge, a coworking space or your home router, the VPN applies the same encryption and routing rules, reducing your attack surface.

Best practices for using a VPN on public Wi‑Fi

Choose a reputable provider with a clear, audited no‑logs policy and strong protocols such as WireGuard, OpenVPN or IKEv2/IPsec.
Enable a kill switch so that if the VPN connection drops, your device does not silently fall back to the insecure Wi‑Fi connection.
Use auto‑connect on untrusted networks. Many VPN clients can automatically start the tunnel when you join a new or open Wi‑Fi.
Avoid free VPNs that monetize your data. Free services often log traffic, inject ads or impose weak encryption.

A properly configured VPN drastically raises the bar for any attacker on public networks.

DoH: Securing DNS Lookups Over HTTPS

Even with a VPN, there are situations where DNS over HTTPS (DoH) adds an extra layer of privacy and integrity.

DNS translates human‑readable domain names like example.com into IP addresses. Traditional DNS queries are often unencrypted, meaning anyone on the path can see which sites you resolve and potentially tamper with responses.

DoH solves this by sending DNS queries inside HTTPS traffic:

Confidentiality: Observers on the local network cannot easily inspect which domains you look up.
Integrity: Responses are protected by TLS, making spoofing more difficult.
Resistance to simple DNS‑based tracking: Hotspot owners and casual attackers lose a direct view of your DNS requests.

When DoH is most effective

On networks where you cannot or do not want to use a VPN.
On devices with system‑wide DoH support (for example, modern desktop browsers or mobile operating systems).
In combination with reputable DNS resolvers that offer malware blocking or phishing protection.

How to enable DoH in practice

In browsers: Most modern browsers (Chrome, Firefox, Edge, Safari) allow you to enable “Secure DNS” or “DNS over HTTPS” and choose a trusted resolver.
On operating systems: Some OS versions support system‑wide DoH or DNS over TLS (DoT) in the network settings.
With VPNs: Many premium VPN apps bundle their own encrypted DNS, which works similarly to DoH and may be preferable to mixing multiple resolvers.

DoH is not a full replacement for a VPN, but it is a powerful complement, particularly against DNS‑based surveillance and manipulation.

Captive Portals: Connecting Safely Before You Are Secure

Most public hotspots force you through a captive portal before granting full internet access. This is the page where you accept terms of use, enter a room number, provide an email address or type in a one‑time password.

Understanding captive portals is critical because:

Your traffic is often unencrypted before login. Until you reach and pass the portal, your device communicates in the clear on the local network.
VPN and DoH may not work until after authentication. The portal intercepts your connection attempts and redirects them to the login page, so security tools can temporarily fail or misbehave.
Portals can be spoofed. Attackers can clone the look of a hotel or airport login page to harvest credentials or trick you into installing malicious apps.

Safer workflow for captive portals

Connect to the Wi‑Fi and open a new browser tab.
Visit a non‑sensitive website (for example, example.com). This typically triggers the captive portal.
Check the address bar carefully.
Make sure you are on an expected domain and, if possible, that the connection uses HTTPS with a valid certificate.
Provide minimal data.
Enter only the required information. Avoid using primary email addresses or real phone numbers where possible.
Complete portal authentication first, then enable security tools.
Once you have full internet access, turn on your VPN and verify that your secure DNS (DoH or VPN DNS) is active.
Disable auto‑connect for that SSID if it seems suspicious.
This prevents your device from automatically rejoining a potentially malicious network later.

Captive portals are a necessary inconvenience on many public networks, but you can reduce the risk with careful behavior and minimal data sharing.

Practical Checklist: Working Safely on Any Public Hotspot

To keep your remote work sessions secure on public Wi‑Fi, follow this simple checklist:

Confirm the official network name with staff before connecting to avoid evil twins.
Turn off file sharing and remote access features on your device before joining.
Use a reputable VPN with auto‑connect and kill switch enabled.
Enable DoH or encrypted DNS at the browser or OS level, especially when not using a VPN.
Treat captive portals with caution and avoid entering sensitive credentials on portal pages.
Access corporate resources only through secure channels, such as a company VPN or zero‑trust access solution.
Log out and forget the network when you finish working, especially on shared or suspicious hotspots.
Keep your system, browsers and security tools updated to patch vulnerabilities exploited on local networks.

By combining a strong VPN, encrypted DNS (DoH) and safe handling of captive portals, you significantly lower the risks of working over public Wi‑Fi.

Recommended Product from Amazon

To further improve your security on the go, consider using a hardware VPN/router such as the GL.iNet travel router series available on Amazon. These compact devices let you: