Do You Still Need a VPN on Public Wi-Fi? A Business Owner's Guide

Most advice about public Wi-Fi was written for a different internet. It says an open café network is a hacker's playground and a VPN is the only thing standing between you and a data breach.

A decade ago that was close to the truth. Today it overstates the risk and points business owners at the wrong fix.

Here is the short answer. For ordinary web browsing, public Wi-Fi is usually safe, because most of the web now encrypts itself.

A VPN still earns its place on a work laptop that holds client files, but it covers one narrow problem. The bigger risks to your business data sit in your logins and your software updates.

This guide covers what changed, which risks remain, what a VPN does and does not fix, how to set one up so it runs without effort, and what to do about passwords. By the end you should know whether to buy one and what to pair it with.

What Changed: Most Websites Now Encrypt Your Traffic

The old fear was simple. On an open network, anyone nearby with the right software could read what your laptop sent, including passwords typed into websites. That was a real problem when most sites sent data in plain text.

Then the web moved to HTTPS, the padlock in your browser, which encrypts the connection between your browser and the site.

Google's Transparency Report tracks this in Chrome, and Cloudflare publishes its own measurements. Both put the share of page loads over HTTPS at roughly 95% to 99%, depending on the platform and the year.

The Federal Trade Commission's consumer advice reflects the shift. It says that because of widespread encryption, connecting through a public Wi-Fi network is usually safe.

That does not make a café network trustworthy. It means a stranger on the same network mostly sees scrambled traffic when you visit an ordinary website.

What they might still see, and what they can still trick you into doing, is the subject of the next section.

Four Ways a Café or Airport Network Can Still Hurt a Business

Four problems survive the move to HTTPS. Each has a different fix, which is why no single tool covers all of them.

Fake hotspots

CISA, the US Cybersecurity and Infrastructure Security Agency, describes the evil twin attack: someone sets up a network that copies a real one, often with a stronger signal, so your device joins it instead.

Picture a consultant at an airport who taps "Airport_Free_WiFi" without checking that the airport uses that name. The attacker now controls the network the laptop talks to.

CISA advises confirming the name and password of a public hotspot before you use it. The FCC adds that if more than one network seems to belong to the venue, you should ask staff which is real.

Fake sign-in pages

A rogue network can show a login page that looks like the real thing. This attack does not break any encryption. It works because a person types a password into the wrong page, and a VPN does nothing about that.

Older tools that don't encrypt

Some business software, internal tools and file shares still send data in ways HTTPS does not cover.

CISA also warns that file sharing left switched on can expose folders to other people on a public network, and it advises turning sharing off when you are away from home or the office.

Weaknesses on the device itself

A shared network puts your laptop within reach of strangers' devices, and an unpatched laptop is the easier target.

Verizon's 2026 Data Breach Investigations Report found that exploited software vulnerabilities were the most common way into a breach, at 31%, ahead of credential abuse at 13%.

Also Read: The Rise of Autonomous AI Cyberattacks: A Turning Point for Security

What a VPN Fixes, and Where Its Protection Stops

A VPN wraps everything your device sends in an encrypted tunnel to the provider's server. The network you are sitting on only sees scrambled data heading to one place. That helps in specific ways.

It stops anyone on the network, including a café owner or a fake hotspot, from reading traffic from apps that don't use HTTPS. It hides which sites you visit from the network operator. It also covers the odd old tool that sends data in plain text.

This is why the NSA's guidance for its own teleworkers is blunter than the FTC's: avoid public Wi-Fi when you can, and use a personal or corporate VPN when you can't.

What it does not do matters more for your decision. A VPN does not stop you from typing a password into a fake page, downloading malware, reusing a weak password or leaving a laptop unlocked on a table.

Marketing that says a VPN makes public Wi-Fi "safe" promises too much. It also has limits against the one attack that is still real.

On a fake hotspot, a VPN reduces what the attacker can read, but an attacker who controls the network can still block the VPN connection or steer you toward a fake sign-in page. The tunnel protects your traffic. It does not tell you the network is honest.

And a VPN does not remove trust. It moves it. Instead of trusting the café's network, you trust the VPN company with your traffic, which is why the provider's logging policy matters. Nord says NordVPN does not track your online activity, but a claim from the seller is a reason to read the policy, not a reason to skip it.

Some plans reach a little further. NordVPN includes what Nord calls a next-gen antivirus on supported desktop apps and plans, which scans downloads for malware and blocks dangerous websites. Features vary by device and plan, so check what your plan includes for the devices you use before you buy.

Setting Up a VPN So It Protects You Without Effort

A VPN you have to remember to switch on gets skipped on the day it matters. Set it up once so it starts itself. With NordVPN, the settings below live in the app, and Nord says one account covers up to 10 devices.

1. Install it on every device that touches work, including your phone, and sign in on each one.
2. Turn on auto-connect for Wi-Fi. In the app this is Auto-connect on Wi-Fi, and Nord lets you set it to connect on unsecure networks or on every Wi-Fi network.
3. Turn on the kill switch, which cuts your internet connection if the VPN drops, so nothing travels unprotected.
4. Switch off file and printer sharing on your laptop for public networks, as CISA and the NSA both advise.
5. Forget the network when you leave, and turn off your device's own setting that joins known networks automatically.

Two habits do more than any setting. Check the network's name before you join, and update your laptop and phone before a trip, because those updates close the holes attackers use.

Expect one small snag. Some hotel and airport networks make you accept terms on a web page before they allow any connection, and the VPN may not connect until you do. Accept the terms first, then let the app connect.

Expect some trade-offs, too. Traffic takes a detour through the VPN server, so connections can feel slower. A few banking apps and company systems refuse connections from VPN servers, and you may need to pause the VPN for them. If a client's own rules say how you must connect, those rules come first.

The Bigger Threat to Business Data Is Still Your Logins

A fake sign-in page only pays off for an attacker if the password it captures is worth something. Verizon's 2026 report counted credential abuse as the first step in 13% of breaches, but an analysis of the same report by security firm Descope found it appearing at some stage of roughly four in ten breaches.

Two habits take most of the value out of a stolen password: a unique password on every account, and multi-factor authentication wherever it is offered. A password manager makes the first one realistic.

A manager generates long random passwords, stores them in an encrypted vault and fills them in for you, so you rarely type a password into a page at all.

Most managers fill a login only on the site where it was saved, which is a useful warning when a lookalike page asks for credentials and nothing appears.

NordPass includes a password generator, a Password Health tool that flags weak, reused or exposed passwords, and passkey support.

Nord says it uses a zero-knowledge architecture, meaning the company cannot read what is in your vault.

If you run a team, shared logins are the weak spot, because they end up pasted into chat. NordPass's business plans are built for teams and include secure sharing of logins, so people get access without ever seeing the password in a message.

Also Read: AI for Email Writing and Inbox Management: What Helps and What to Watch

When a Phone Hotspot Beats Any VPN

For your most sensitive work, skip the shared network altogether. The FCC's consumer guidance notes that your phone's cellular data may be more secure than public Wi-Fi when you are sending sensitive information. Tethering to your phone gives you a private connection, so a fake hotspot never enters the picture.

The trade-offs are your data allowance and your battery. Give the hotspot a strong password of its own, and switch it off when you finish, so nobody nearby can join it.

You do not need a VPN for everything. On a home or office network you control, with a device that is up to date, doing ordinary web work over HTTPS, a VPN adds little. The same goes for a café visit where all you do is read public websites.

There is also a point where a consumer VPN is the wrong tool. If you handle regulated data such as health, legal or financial records, or you need to set and enforce rules for staff, you need a company-managed setup with admin controls.

Nord's business product is called NordLayer, and your IT provider can advise on alternatives.

Also Read: How to Set Up Business Banking the Right Way

Which Setup Fits Your Business, and the Rule to Hand Your Team

Three questions settle most cases. Does the device hold client or financial data? Do you use older tools or file shares that may not encrypt? Do you often connect to networks you don't control? My rule of thumb is that two yes answers make a VPN worth paying for.

Solo freelancer or consultant: A consumer VPN such as NordVPN on your laptop and phone, a password manager and multi-factor authentication. That is a few minutes of upkeep a month.

Team of five to twenty: The same layers, plus a shared password vault and a written rule about networks and updates. Consider a business-grade VPN if you need admin control.

Owner who travels a few times a year: Skip the subscription until a trip is booked. Set up the password manager first, and use your phone hotspot for anything sensitive.

Technology only helps if people follow the same habits, and a short written rule does more than a long policy nobody reads. Here is a version you can adapt:

"Before joining any public network, confirm its name with staff. Use the VPN on every public network, and use your phone hotspot for client files and financial accounts.

Never approve a sign-in you did not start. Update your laptop and phone before any trip, and tell us the same day if a device is lost."

Review it once a year, and again after any incident. The aim is not to cover every threat. It is to make the four or five habits that matter automatic.

Conclusion

The old advice said a VPN makes public Wi-Fi safe. The accurate version is narrower. A VPN closes one gap on one layer, and it matters most when your work is sensitive or runs on older tools.

Most of your protection comes from updates, unique passwords, multi-factor authentication and checking which network you join.

Start there, add a VPN if your answers say you need one, and keep the phone hotspot for the work you can't risk.

Note: Some links are affiliate links. We may earn a commission if you sign up or purchase through them, at no extra cost to you. Read our full disclaimer here.