Wi-Fi Risk Checklist

A practical, printable checklist for cafés, hotels, airports, and coworking spaces. Verify networks, use a VPN, and avoid risky logins.

This page runs entirely in your browser. No data is sent anywhere.

1) Pre-trip setup

Update your OS and browsers, then reboot.

Turn on full-disk encryption, screen lock, and auto-lock timer.

Install and test your VPN, set “auto-connect on untrusted Wi-Fi” if available.

Use a password manager and multi-factor authentication for key accounts.

Disable or remove unused sharing services, remote access tools, and old VPN profiles.

Create a limited user account for travel if you handle sensitive data.

Pack a USB power-only “data blocker” for public charging and a webcam cover.

2) Choosing a network

Ask staff for the exact network name and whether a captive portal appears.

Prefer password-protected WPA2/3 networks over open networks.

Avoid look-alike names, weak signals, and networks that still appear when staff say Wi-Fi is down.

If a captive portal asks to install a certificate or profile, cancel and ask staff.

3) Before you browse

Turn on your VPN before opening websites or apps.

Set the network type to Public, not Private or Home.

Turn on the system firewall, turn off file sharing and network discovery.

Disable auto-join or auto-connect for this network.

Use a separate browser profile for travel; keep extensions minimal.

Prefer HTTPS, and do not click through certificate warnings.

4) Safe behavior while connected

Avoid banking, payroll, admin panels, or cloud consoles unless the VPN is active.

Do not reuse passwords and do not save new passwords on public Wi-Fi.

Do not install new software or browser extensions on public networks.

Watch for surprise logins or “session expired” prompts that ask for credentials.

If anything feels off, disconnect and switch to a phone hotspot.

5) When you finish

Log out of sensitive sites and close your browser.

Disconnect the VPN, forget the network, and turn off Wi-Fi if you will not need it.

Review account activity later and revoke unfamiliar sessions.

If you entered credentials on a suspicious network, change the password on a trusted network and re-issue app tokens.

Windows 10 / 11 quick steps ▶

Set network to Public: Settings, Network & Internet, Wi-Fi, your network, Properties, Public network.

Turn on Windows Defender Firewall: Windows Security, Firewall & network protection.

Turn off Network discovery and File and printer sharing: Control Panel, Network and Sharing Center, Advanced sharing settings.

Disable auto-connect: Settings, Network & Internet, Wi-Fi, Manage known networks, select network, turn off Connect automatically.

Use secure DNS in browser if not on VPN: Edge/Chrome Settings, Privacy and security, Security, Use secure DNS.

Randomize MAC where supported: Settings, Network & Internet, Wi-Fi, Manage known networks, Use random hardware addresses.

macOS (Monterey or newer) quick steps ▶

Turn on Firewall: System Settings, Privacy & Security, Firewall On.

Disable File Sharing, Screen Sharing, and similar services: System Settings, General, Sharing.

Set Auto-Join Off for the café network: System Settings, Wi-Fi, Details, uncheck Auto-Join.

Limit discovery features: System Settings, General, AirDrop & Handoff, set Receiving to Off when not needed.

Use a VPN, or install a trusted encrypted DNS profile if VPN is unavailable.

Linux (Ubuntu / Debian / Fedora) quick steps ▶

Enable a firewall: Ubuntu/Debian sudo ufw enable, or Fedora sudo firewall-cmd --set-default-zone=public.

Disable sharing services you do not need: sudo systemctl disable --now smbd nmbd avahi-daemon.

Set Wi-Fi to randomized MAC in NetworkManager connection settings.

Avoid auto-connect: edit the connection in NetworkManager, uncheck Connect automatically.

Prefer VPN; alternatively consider encrypted DNS via /etc/systemd/resolved.conf with DNSOverTLS=yes.

Minimal “carry-with” rules

Verify the exact SSID with a human.

VPN on first, browser second.

Public network profile and firewall on.

No sensitive logins without VPN.

Forget the network when done.

Red flags — disconnect now

Captive portal demands a device certificate or root certificate.

Repeated SSL warnings on well-known sites.

The network drops and reappears with a slightly different name.

Browser shows an unfamiliar extension or default search suddenly changes.

Staff say the network is offline, yet a similarly named network is visible.

If you think you slipped

Change passwords for any site you used, do it on a trusted network.

Revoke tokens and sessions in account security pages or your password manager.

Turn on multi-factor authentication if it was off.

Watch statements and security alerts for the next few days.

Optional hardening for frequent travelers

Create a separate local user account just for travel, keep data minimal.

Use a privacy screen and position yourself away from shoulder-surfers.

Disable USB data on your phone if you use it for tethering.

Keep a spare browser profile with zero extensions and strict HTTPS-only mode.

Maintain an offline copy of emergency contacts and recovery codes.