Who could be watching?
Anyone can create a network named Free_Cafe_WiFi in a few minutes, and everyone who joins sends their traffic through that person's equipment. Even on a real network, the operator can log your lookups and read whatever isn't encrypted.
When there's no password at all, another customer at the cafe may be able to watch too.
What does the hotspot see once I connect?
Every app sends its data through the tunnel. The hotspot gets scrambled packets heading to one address and nothing more.
DNS lookups travel inside that same tunnel and are answered by our own DNS, so the hotspot can't rebuild a list of the sites you opened.
Why won't it connect on some networks?
Train station and cafe Wi-Fi often shows a portal page first, asking you to tick a box or enter a room number. Get past it first; CoxVPN comes second. The tunnel can't open until the portal lets you through.
Your logins are a separate job. Give key accounts their own passwords, turn on two-step sign-in, and back off from any certificate warning that appears out of nowhere.
Which settings should stay on?
Hotspot signals drop often. With the kill switch on, apps wait for the tunnel to return instead of sending data over the open network.
Plus and Pro owners get one more guard worth leaving enabled: malicious site blocking. It catches known phishing pages, including ones made to look like Wi-Fi login screens.
- Kill switch enabled
- Plus or Pro: malicious site filter enabled
- Tunnel won't open: change to OpenVPN TCP