A café's wifi splash page asks you to tick a box promising you won't torrent anything illegal — and that's the entire security check most networks bother with. It has nothing to do with whether the email you're about to send, contract attached, stays private from the fifteen other laptops sharing that same signal. Cafe wifi, VPN security, remote work logins: those phrases get thrown around together so often as digital nomad advice that it's easy to assume ticking a box and seeing a padlock icon mean the same thing. They don't. Mixing them up is the single most common mistake I see people make with a VPN on the road.
Most of that mistake happens quietly, at a table like the one I use on Largo do Intendente in Lisbon, where the login page usually clears in about ten seconds. It's tempting to just start typing right then. My habit is to treat that clearance as background noise: connect to the wifi, ignore Outlook, ignore Slack, and only open the VPN app after that. I wait for it to actually lock in before touching anything work-related. It sounds fussy written out, but in practice it takes less time than reading this paragraph.
The Cafe Wifi Splash Page Isn't the Security Step
What that VPN app is doing, underneath the loading spinner, is closing the gap that makes public wifi risky in the first place. An open café network works less like a private phone line and more like a party line. Anyone else logged on, with the right (freely available) software, can watch the traffic passing between your laptop and the router, the same way a stranger could read a postcard passed hand to hand across a crowded room. Encrypting the connection turns that postcard into a sealed, unreadable parcel. Most decent VPN apps use Advanced Encryption Standard with a 256-bit key. In practical terms, a stranger on the same café wifi would need something like a supercomputer, and more patience than any human has, to make sense of what you sent. That's the actual security step. The splash page was never it.
Apps usually offer a choice of two tunnelling protocols, WireGuard or OpenVPN. I default to WireGuard because it's faster, which matters more than I expected once my partner started working from the same table. He's on video calls most of the day, and the second a connection dips he looks up without saying anything, which somehow communicates more than actual words would.
Two Different Problems Wearing the Same App
Late one night in an Airbnb, well past eleven, I watched a loading wheel spin uselessly against wifi too patchy to hold a stream. That stalled, useless feeling belongs to a completely different problem than whether a work email stays private earlier the same day. The same VPN app handles both, which is exactly why people mix them up. Getting BBC iPlayer or Disney+ to load somewhere it technically shouldn't isn't the same task as keeping a client's contract safe from strangers on shared wifi. Streaming problems look different: wrestling with geo-blocking and region spoofing to make a service think you're back in Manchester, or running into proxy detection the moment Amazon Prime flags a VPN's IP address. Sometimes it's hunting through server switching until one clears a blackout, or checking whether a travel router even supports the protocol a particular app wants. I once paid for a second streaming subscription from a completely different country, convinced the library overlap between the two would cover whatever gap I hit. It didn't, streaming libraries don't stack like that, and it's an argument I've mostly stopped having with myself. I know a stream is behaving the moment a Netflix thumbnail grid loads all at once with no proxy error breaking it. That tells me nothing about whether the same tunnel is protecting an email with a client's bank details attached. Device limits, whether a phone and a Fire Stick and a laptop all play nicely with one protocol, the speed overhead a weak signal adds on an already patchy connection, even DNS-level filtering that strips ads out of a stream, all real, all worth knowing about. None of it is the question that matters before you hit send on a work email.
There's a real security-side complication, though, and it runs the opposite direction. Some café routers get suspicious of a VPN precisely because it's doing its job well. All the traffic goes out through one encrypted tunnel, usually over the same port ordinary encrypted web traffic already uses. To a router that can't see inside it, that unreadable stream can look like an anomaly worth throttling or blocking outright. I've had a café's wifi drop the connection over and over, every time the VPN tried to reconnect, not slow, just refusing to hold. That's the one situation where I reach for an obfuscated server setting, not to unlock anything, but because the tunnel itself won't establish otherwise. If a connection keeps dropping in a way that feels personal, it's also worth checking whether you need a dedicated IP for remote work. A shared IP address gets flagged by aggressive filters far more often than one that belongs only to you.
What Does a Kill Switch Actually Buy You?
A kill switch sounds dramatic for what it actually does, which is cut your whole internet connection the instant a VPN tunnel wobbles. Instead of letting your laptop quietly fall back to the open café wifi sitting right underneath it, the connection just dies. I watched this happen during a storm in Porto, wifi flickering in and out of a stone-walled café while I had a large attachment mid-send. Without a kill switch, the moment that connection blinked, my email client would have happily finished sending over the unsecured network acting as a backup. With one, the whole connection stopped instead, and I sat there for a few seconds with nothing at all on screen, a small enough inconvenience next to the alternative.
Since my partner and I both work while we travel, we run this on every device, laptop and phone, using the Best VPN with Unlimited Device Connections for Nomadic Couples. Neither of us has to log in and out just to stay covered, which matters given how fast a device limit gets eaten up by two people working from the same table. My friend Yemi, from my old co-working days in London, convinced me a VPN wasn't optional the moment I started traveling for work. She still keeps a running spreadsheet logging every VPN outage she's had since 2020, which sounds excessive until you realize how often 'it just disconnected' turns out to be the real cause when someone's inbox gets compromised.
The Habit That Actually Keeps an Inbox Safe
None of this requires understanding networking any deeper than what's written above. What it requires is a habit: connect to the wifi, let the splash page clear, open the VPN, and wait for it to actually confirm before touching Outlook or Slack. Treat a kill switch as a default, not an optional extra. That order matters more than which protocol you picked or how fast a connection tested at some point in the past.
A café's free wifi was never going to protect anything on its own. No VPN, however good, fixes the habit of opening email before the tunnel is actually confirmed. Treat the two as separate jobs: one gets you online, the other keeps what you send private. Handled in that order, the drama about kill switches, NDAs, and dropped signals mostly takes care of itself.