What the Hotel Wi-Fi Could See Before My VPN Finally Connected

The hotel Wi-Fi accepted my surname and room number, showed a page asking me to “update my browser for a better connection,” and then dropped me back at the login screen. I blamed the captive portal. I turned Wi-Fi off, switched it on again and opened a plain web address to force the sign-in page to return. The internet finally appeared, but the client presentation I needed to upload before an 8 a.m. meeting remained at zero percent. That was when a more uncomfortable question replaced my annoyance: what could the hotel already see—the client’s website, the file itself, my messages, perhaps even the meeting link?

The browser prompt made the Wi-Fi feel different

A year earlier, I might have dismissed the update message as another badly designed hotel page. Recent security reporting made that harder.

In July 2026, Microsoft described a campaign targeting travelers through compromised captive-portal networks used by hotels, conference centers and similar venues. Attackers manipulated web traffic to display convincing browser or operating-system update prompts. Installing the supposed update could deliver malware designed to steal credentials, files and active login sessions.

The unsettling part was that travelers did not necessarily have to join an obviously fake network. A legitimate venue network could be compromised.

I had not clicked the update. Still, it clarified what I was really asking. I was not imagining a hotel employee watching my screen from reception. I wanted to know what the network could record automatically while I uploaded a confidential file and prepared for a client call—and whether a VPN could hide that activity without making the connection unusable.

Shared Wi-Fi is convenient precisely because nobody stops to investigate who operates every router, captive portal or network-management system behind it. A room password controls access. It does not make the network private.

What the hotel could see before the VPN connected

The hotel already knew that my device had joined its network.

It could record when I connected, how long the device remained online and how much data moved. The captive portal also received the surname and room number I entered because that happened before any VPN connection existed.

The contents of most modern websites and apps were better protected. HTTPS encrypted my passwords, messages, presentation and the exact pages I opened. Carrying the traffic did not give the hotel a readable copy of the file.

But HTTPS did not hide the whole pattern.

Without a VPN, the network could see the IP addresses my device contacted and could frequently identify destination services through domain lookups and other connection information. It might know that I opened a cloud-storage platform, a video-meeting service and the client’s website, even though it could not read the slides or listen to the call.

That distinction mattered. A network log showing a large upload to a client portal followed by a long meeting connection would not reveal the presentation, but it would still describe more of my working evening than I wanted a hotel network to know.

The fake update prompt created a separate risk. A VPN cannot protect someone who voluntarily installs malicious software from a captive portal. Nor can it hide information entered before the portal grants internet access.

So I completed only the minimum login step, refused the update and tried to establish a VPN tunnel before opening anything related to work.

The familiar VPN never reached the useful part

I started with the VPN I normally associated with travel.

The decision made sense. It had a long public history, extensive support resources and far more server locations than I would ever need. At home, it usually connected so quickly that I barely noticed it.

On the hotel Wi-Fi, the app moved from Connecting to Reconnecting and back again.

I chose another country. Then another protocol. The captive portal reopened and asked me to authenticate again. By the time I returned to the desktop, the VPN still had no stable connection and the presentation had not moved.

The provider did not lack infrastructure. It offered more locations than I had time to test. What it lacked on that network was one route I could actually reach.

Travelers describe the same practical frustration in public discussions: a familiar VPN works normally at home, then becomes unstable on hotel Wi-Fi and sends the user through repeated server changes, protocol changes and captive-portal logins. The point was…

While the app remained stuck, the hotel network continued carrying my connections directly. HTTPS still protected the presentation’s contents, but the destination sites and traffic pattern remained exposed.

I tried my phone hotspot next. The room had one bar of mobile signal, and the estimated upload time rose to nearly an hour.

That option solved the local network problem by creating a more immediate one: the file would not arrive before the meeting.

What changes after the VPN connects

A working VPN narrows the hotel’s view dramatically.

Instead of separate connections to the client portal, meeting platform, email service and other websites, the network sees one encrypted connection between the device and a VPN server. It can still record when that connection begins, how long it lasts and how much data passes through it.

What it no longer sees are the destinations and activities carried inside the tunnel.

The hotel can tell that encrypted traffic is moving. It cannot see that the large transfer is a client presentation, which portal receives it or which meeting service opens afterward.

This shifts trust from the local network to the VPN provider. For me, that was a reasonable trade. I had chosen the VPN service. I had not chosen the hotel’s network vendor, portal contractor or whoever had administrative access to its systems.

The remaining question was no longer how many servers the VPN advertised. It was whether one encrypted route would form before midnight.

One reachable route finished the job

I opened OnlydogVPN and selected the preset for a restrictive or unreliable network instead of choosing another country from a server map.

The connection completed.

I returned to the client portal and restarted the upload. The progress bar passed the point where it had stalled, crossed 50 percent and finished. I opened the meeting link in a second tab, checked the waiting room and sent the client a message confirming that the deck was ready.

The result came before the explanation, which was how I wanted it.

The service uses HTTP/3-based transport with additional traffic obfuscation. In practice, that gave the connection another way through a network that had interfered with the more familiar VPN attempt. The hotel still saw encrypted traffic going to a remote server, but the client portal, meeting platform and work activity disappeared inside that connection.

The smaller service does have fewer server locations, a shorter public history and fewer independent reviews than the established provider I tried first. That is a real limitation for software trusted with network traffic.

But the comparison had changed.

The established provider’s large infrastructure had not protected my upload while its app remained stuck at Connecting. The smaller service formed a usable tunnel before the file had to leave my laptop.

One reachable encrypted route did more for my privacy than a long list of unavailable ones.

The reason I left it running

With the presentation delivered, I opened the conference website to check the next morning’s room number. A blocked-request counter began increasing as the page loaded.

The service was filtering advertising and tracking requests. I could see the counter and the cleaner page behavior, although I could not independently inspect every internal filtering rule.

That was not what hid the presentation from the hotel. The VPN tunnel had already done that.

It addressed a smaller problem that appeared afterward. The hotel network could no longer see the sites inside the tunnel, while fewer third-party advertising and analytics requests were leaving the browser. One reduced the visibility of the network beneath me; the other reduced some of the background connections created by the pages themselves.

It was enough to keep the app installed after the emergency had passed.

What the hotel was left with

By the time I closed the laptop, the hotel could still know that my device had connected from the room, used a VPN and transferred a substantial amount of encrypted data shortly before midnight.

It could not see the client portal inside the tunnel, inspect the presentation, read my messages or identify the meeting service I opened afterward.

The familiar provider offered the reassurance of scale and history, but its encrypted route never became usable on that network. The smaller app offered fewer locations and less public history, yet it connected while the work still needed doing.

On hotel Wi-Fi, privacy did not begin with the number of servers shown on a map. It began when one encrypted route stayed open long enough for the client’s file to leave my laptop.