How to stay safer when using a VPN

You walk into a café, join the Wi-Fi and switch on your VPN. Can you now open your email, pay for something or send a document without worrying? A VPN can make the connection safer, but some things still depend on you: the app you installed, the website you opened and who receives your password.

The good news is that you do not need technical knowledge to take care of these things. A few habits go a long way. Here is what to check once and what to keep in mind each day.

Choose a VPN with clear terms

Running a VPN costs money: there are servers to maintain and people to support. Before installing it, find out how the service pays for that. It might use subscriptions, advertising, donations or a free trial. What matters is understanding the arrangement before you agree.

Some services may earn money by sharing user information with advertising companies. Check what information is collected and who can receive it. A promise to “care about your privacy” does not answer those questions.

Another risk is letting strangers use your internet connection. You think you have simply turned on a VPN, while other people's requests are passing through your device. To websites, those requests may appear to come from you. The FBI has warned about these schemes.

Before choosing a service, check a few things:

• Who runs it. Is there an identifiable company or team, a working website and a way to contact support?
• How it earns money. Is it clear what you are paying for or why access is free?
• What it can do with your connection. Look out for unexpected permission to share your internet connection or device resources with other people.
• What supports its promises. If it mentions an independent security audit, find the report and check when it happened and what it covered. This is worth considering when choosing a VPN.

You can ask support directly: “Will other people's traffic pass through my device? Do you share information about me with advertisers?” If you cannot find clear terms and an understandable answer, look for another service.

Free access does not automatically mean a scam, and a paid subscription does not guarantee honesty. Base your choice on clear terms and information you can check.

Download the app from a trusted link

Someone in a group chat offers you an “improved VPN app”. All you need to do is download a file and install it. Take a moment before doing that. A familiar name and icon can hide a different developer.

Open your VPN service's website and find its setup instructions. Follow the app link from there and check the name and publisher. This reduces the chance of installing a lookalike. If you are unsure, ask the service's official support team whether you have the right app.

Your phone may ask for permission to establish a VPN connection. That is expected. If the app also wants to read text messages or contacts, find out why.

Connect before you start doing important things

You open the app, tap Connect and immediately put it in the background. The connection might still be starting. Before sending documents or doing other important tasks, wait for “Connected” or a similar confirmation.

Check again after your phone switches from Wi-Fi to mobile data or wakes after a long time asleep. Sometimes the connection needs to recover. If the app offers automatic connection, that can help you remember less often.

It is also worth checking the exclusions list once. Look for a setting such as “Excluded apps” or “Apps without VPN”. Apps on that list may use the internet directly. Your browser could use the VPN while your email app does not.

You do not have to understand every switch yourself. You can ask support a plain question: “I want to use the VPN in my browser and messaging app. Which settings should I check?”

Find out what happens if the VPN disconnects

Imagine you are working at a hotel. The VPN disconnects, but websites keep loading. You still have internet access, although it may now be working without the VPN. That is easy to miss.

Some apps offer a setting called “Block internet without VPN”, sometimes labelled kill switch. It is intended to pause the connections it covers while the VPN is unavailable.

If your app offers this feature, read its instructions: the details differ between apps. Automatic reconnection is useful too, but it does not by itself mean internet access is blocked during a disconnection.

It is easier to learn about this at home when you are not in a hurry. If the internet stops working after you enable blocking, first check whether the VPN is connected. The app may be doing exactly what you asked it to do.

At a café, check which Wi-Fi network to join

You might see “Cafe Wi-Fi”, “Cafe Free” and several similar names. Ask a member of staff which network belongs to the café. The word “free” is not enough to identify it.

Some hotels and cafés show a welcome page asking you to accept access terms or enter a code they gave you. Complete that step, then make sure the VPN connects. The welcome page can prevent the VPN from connecting until you have completed the network's sign-in step.

If an unfamiliar page asks for your email or banking password “to activate Wi-Fi”, stop. Check with staff. If you are uncertain, you can use your own mobile connection.

You do not need to fear every public hotspot. Most modern websites already protect information in transit using HTTPS. A VPN can further reduce the information about your connections available to the local network operator.

Check where you enter your password

An email says your account has been blocked and you must confirm your details immediately. You follow the link and see a familiar logo and sign-in form. Your VPN may be working perfectly, but the password you enter will still go to whoever runs that page.

If a message pressures or frightens you, open the familiar app yourself. For example, check for notices inside your banking app. Contact the organisation using details you already know, rather than a phone number in a suspicious email.

Check the website address too. An extra letter or an unfamiliar ending is a reason to pause. https:// at the start means the information is encrypted during the journey, making it harder for outsiders to read. It does not establish that the website's owner is honest. Scammers use HTTPS too.

If your browser warns that the connection is not secure, do not enter a password or card details, or press “Continue anyway” just to finish a purchase. A VPN does not cancel that warning.

Add another check when you sign in

Using the same password for email, shopping and social media is convenient until one of those passwords leaks. Someone who gets it can try it on other sites.

Use different passwords. A password manager can help: it is an app that stores passwords and fills in sign-in forms so you do not have to memorise them all.

Next, open your email account's security settings. Look for “Two-factor authentication” or “Two-step verification”. The idea is simple: signing in needs another confirmation as well as your password, such as a code from an authenticator app. This makes access harder for someone who has learned your password.

Start with email, since it is often used to recover other accounts. Then check your bank, social media and other important services. Keep verification codes private and enter them only where you started the sign-in yourself.

When your phone offers a system, browser or VPN app update, choose a convenient time to install it. Updates can fix security problems. Use the device's settings or app store rather than an “Update urgently” button on an unfamiliar website.

What to remember each day

• Install the app from a trusted link and keep it updated.
• Check that the VPN has connected before important tasks.
• Ask for the correct name when joining unfamiliar Wi-Fi.
• Check website addresses and take browser warnings seriously.
• Use different passwords and enable sign-in verification.
• Choose a service with clear terms for using your data and connection.

You do not need to study every setting each day. Set up the app once, then watch for straightforward things: the connection is active, the website is familiar, and passwords and codes stay with you.

For a clearer picture of what changes when you press Connect, read “What is a VPN, and what problem does it solve?”. You can set up your own device using 2Wisp's step-by-step instructions.