You can't fully audit a hotel network from your room, but five quick checks will tell you whether it's a reasonable connection or one to avoid for anything sensitive.
- Confirm the exact network name. Ask the front desk or check the card in your room. Attackers set up look-alike networks with convincing names; in 2024 Australian police charged a man for running fake "evil twin" Wi-Fi at airports and on domestic flights that harvested logins through counterfeit sign-in pages.
- Look at the security type. A lock icon next to the name means a password is required. No lock means an open network with no Wi-Fi encryption. On an iPhone or Mac, a "Weak Security" note means the router uses outdated protection like WEP or TKIP. WPA2 or WPA3 is what you want, though a shared hotel password still puts you on a network with every other guest.
- Check the sign-in page. A legitimate captive portal asks for a room number, surname, or nothing at all. If it asks for your email password, social media login, or card details for "free" Wi-Fi, disconnect.
- Watch for certificate warnings. If your browser suddenly says a site's certificate isn't valid on a site you use often, something on the network may be intercepting traffic. Don't click through.
- Treat update pop-ups as hostile. The DarkHotel attacks used fake software update prompts shown right after guests logged in. Update only through your device's own settings or app store.
If the network fails any of these, use your phone's cellular data instead. If it passes but you still want cover, a VPN such as NordVPN encrypts your traffic before it reaches the hotel's router.