5 Best VPNs for WiFi Hotspots

Stephen Cooper

Stephen Cooper

December 18, 2017

WiFi hotspots are great when you’re out traveling. You can connect to the internet without gobbling through your phone’s data allowance. You can also access the web on your laptop or tablet without having to be within range of your home router. However, whether you pay for WiFi access through a hotspot or find a free hotspot, you’re risking your data’s security when you connect.

Hackers are very clever. They have many ways to trick you into handing over access to your devices. Although people know to be suspicious of free services, somehow they trust free WiFi hotspots without question. This belief in the security systems of WiFi connection encryption lays most members of the public open to exploitation when they connect to public WiFi services. Even paid hotspot services are sometimes scams, so you really have to be careful when you connect to a WiFi hotspot.

It’s impossible to thoroughly investigate every hotspot that you encounter. If you want to get online while out of the house, you’ll have to connect to a hotspot at some point. However, you don’t have to suspend your skepticism in order to connect. Nor should you let down your guard. If you install a Virtual Private Network (VPN), you’ll have sufficient protection to connect to unknown WiFi hotspots without risk.

Quick Links to Our 5 Best VPNs for WiFi Hotspots

  1. Buffered
  2. ExpressVPN
  3. CyberGhost
  4. NordVPN
  5. TorGuard

You can read about scams and the dangers of WiFi hotspots later in this report. However, first, take a look at our list of the five best VPNs for WiFi hotspots.

Best VPNs for WiFi Hotspots: Summary

BestVPN Editor's Choice Award
Buffered Homepage
  • 30-day money-back guarantee
  • P2P permitted
  • No logs
  • Apps for Windows, Mac OS X, macOS, Android, and iOS
  • Firewall rules to prevent unprotected internet access
  • Can't get into all streaming services

Buffered doesn't have specific WiFi protection. However, if you leave the VPN turned on, your device will be protected from automatic connections to fake WiFi hotspots. You won't find a kill switch setting in this VPN's app. However, you can set the Buffered firewall to block all access to the internet if the VPN isn't engaged - and that, to all extents and purposes, acts as a kill switch.

Connecting to the internet while you're traveling on a train or sitting at a café gives you a great opportunity to keep a download running - you don't have to limit your download time to when you're at home. Buffered offers strong identity protection to torrenters and it keeps no logs. The network includes servers in 41 countries and you get speeds that are good enough for streaming video. However, this VPN can't get you into Netflix.

Try the best VPN for WiFi hotspots today!

Visit Buffered »30-day money-back guarantee
ExpressVPN Homepage
  • 30-day money-back guarantee
  • Servers in 94 countries
  • P2P allowed
  • No logs
  • Gets into Netflix
  • Quite expensive

ExpressVPN has an automatic WiFi protection setting and a kill switch, so you can be safe from unintended hotspot connections when you're out in public. This VPN has very high speeds and is brilliant at getting into overseas video streaming services, including Netflix. As this service includes access to servers in 94 countries, It's a great choice if you travel abroad.

The company is based in the British Virgin Islands and it keeps no logs. These two factors are part of ExpressVPN's commitment to protect peer-to-peer (P2P) downloaders. The company produces apps for devices with the Widows, Mac OS X, macOS, iOS, and Android operating systems. Back home, you can also install ExpressVPN on your router and your Linux machine.

3. CyberGhost

CyberGhost Homepage
  • 77% off 3-year plans!
  • 30-day money-back guarantee
  • Free version
  • Strong privacy procedures
  • System-wide and per-app kill switch
  • Automatic WiFi protection
  • Can't get into Netflix

CyberGhost is based in Romania, which is a good location for VPNs because the high court of that country prioritizes the individual's right to privacy. The company keeps no logs and creates anonymous accounts - the VPN doesn't hold any personal details on its customers. As such, this is a great option if you like to download with torrents.

The VPN app has a pre-screen that optimizes the program's settings for specific activities. When CyberGhost detects a nearby WiFi hotspot, it asks you whether you want to turn on automatic WiFi protection. This option covers your device with anti-malware as well as strong connection encryption. The app also has a kill switch. The free version of CyberGhost made it onto the BestVPN list of the five best free VPN services.

NordVPN Homepage
  • 30-day money-back guarantee
  • Servers in 61 countries
  • Allowance of six simultaneous connections
  • Automatic WiFi protection
  • Gets into Netflix
  • Customer support can be slow

NordVPN includes automatic WiFi protection and a kill switch. The main screen of the interface is very easy to use. It's composed of a map of the world, with a marker in each country where the company runs a server. You just double-click on a marker to connect. Alternatively, you can connect by scrolling through a server list. That gives you extra options, such as double-hop encryption, which routes your traffic through two VPN servers.

NordVPN is very cheap if you play smart. The price of a subscription, when calculated on a monthly basis, comes crashing down if you opt for the two-year plan. Additionally, the company gives you an allowance of six simultaneous connections, which makes it possible to share an account with a friend.

5. TorGuard

TorGuard Homepage
  • Seven-day money-back guarantee
  • Servers in 55 countries
  • Allowance of five simultaneous connections
  • Per-app kill switch
  • No logs
  • Can be difficult to install

TorGuard allows five simultaneous connections, which should be enough to cover your whole family. The company offers a large range of payment methods. This includes store gift cards, so you don't have to give your bank account details when subscribing. The company doesn't store activity logs, so it's a good service for torrenters. You get access to a fast network with servers in 55 countries.

You get a per-app kill switch with this VPN. It also includes ad, tracker, and malware blockers. You can install the app on Windows, Mac OS X, macOS, iOS, and Android devices. In addition, you can set up the TorGuard VPN on Tomato and DD-WRT routers and Linux machines.

VPNs for WiFi Hotspots: Considerations

Fake WiFi Hotspots

Not every WiFi hotspot was created to provide a service to the public. A growing number of them exist solely to reap log-in information and personal details from unsuspecting members of the public. There are three types of hotspots that you need to guard against:

  1. Open hotspots without passwords
  2. Fake free WiFi hotspots
  3. Fake paid WiFi hotspots

Open Hotspots

There isn’t much point in connecting to a WiFi hotspot that doesn’t require a password. Those hotspots don’t include encryption. Therefore, most of the websites you visit won’t accept page requests (as the connection is not secure). As such, you won’t be able to get into any site that uses the HTTPS schema. That includes Yahoo Mail, Google, Gmail, and Outlook.

Hackers who run open WiFi hotspots aren’t really looking to tempt members of the public into connecting. They rely on the propensity of some mobile devices to connect automatically to the nearest available hotspot. In these instances, your smartphone might connect to a hacker hotspot as you walk by. You won’t even realize that your phone has made a connection. After a few moments, that connection will be broken. However, in the short time that your device is connected to the hacker’s computer, a Trojan or controlling program can be loaded onto it. After that, all of your information will be available to the hacker. This scenario can also make your smartphone into part of a botnet (a zombie army of devices around the world that hackers can use to launch attacks on others).

Fake Free Hotspots

You enter a café and see that it has WiFi. You open up your laptop and look for available networks. There are a couple of options that include the name of the establishment in their titles. To connect to either, you’ll need a password. It might be printed on the menu or written on a board on the wall. If you can’t find it written anywhere, you just need to ask the waiter. Which network do you have the password for? They probably both use the same one, but only one of those hotspots is actually run by the establishment.

You’ll notice lots of other devices in the list of available networks when you get into the cafe. All of those devices are obviously the phones and laptops of other customers. However, one of those two WiFi hotspots that are available could also be the computer of someone else sitting in the café and not actually a real hotspot. Anyone can change the identifier of their device (called a Service Set Identifier, or SSID) from something seemingly random into a name that sounds like a genuine hotspot.

The hacker passes your traffic out to the café’s router and onto the internet, so you won’t even notice that you aren’t on the real WiFi hotspot. While you connect to the internet through the hacker’s computer, that interloper controls the encryption that protects your connection. That means that the programs on his computer can decrypt everything you write and store selected information. Webpages that require the entry of log-in credentials or deal with bank account information usually use their own extra connection encryption. However, the hacker doesn’t have to deliver the inbound page with encryption that he can’t crack. Instead, he blocks the real page and sends you his own version, enabling him to gather all of your passwords and bank info.

Fake Paid Hotspots

Usually, when you pay for a WiFi hotspot, it’s a professional service and not a con. However, hackers rely on that assumption. As such, they sometimes provide fake paid services to win your confidence. In these instances, the hacker can control your connection in exactly the same way as he can with a free WiFi hotspot. However, in the paid version you make things just a little easier for the hacker by entering your credit card details. Most people use the same passwords again and again. Therefore, if the fake paid WiFi hotspot requires you to set up an account and nominate a password, you’ve probably just handed the hacker the password you use all over the web.

VPNs for WiFi Hotspots: Conclusion

There isn’t much a VPN or any online security or privacy service can do to protect you against the fake paid hotspot scenario. This is because no encryption service is designed to prevent you from entering your details into a web page. VPNs operate behind the scenes to prevent privacy invasions that occur in transit. Thus you have to help yourself by being cautious.

However, a VPN will prevent you from being scammed by intrusions that you could never possibly detect by yourself. In the case of the fake free WiFi hotspot, the VPN client on your computer will block any webpages that haven’t come through the corresponding VPN server. Therefore, the intruder can’t con you by delivering a fake webpage. Only pages that arrive encrypted by the cipher that the VPN client and server share will be accepted.

Similarly, that VPN encryption means the hacker’s ability to decrypt the encryption that protects the WiFi connection is irrelevant, because he/she isn’t going to be able to crack the extra encryption that the VPN puts on.

A VPN with automatic WiFi protection and a kill switch will prevent your device from connecting to any network without the VPN engaged. This prevents the scenario of your phone connecting to an unencrypted WiFi hotspot without your knowledge.

The big wide world is full of opportunities, but it also harbors lots of unseen threats. Protect your computer and your mobile devices from damage – install one of the five best VPNs for WiFi hotspots.

Image Credit: StudioByTheSea/

Exclusive Offer
Get NordVPN for only