Yes, HTTPS protects the content of your traffic on public Wi-Fi, so other guests cannot read pages or passwords. HSTS adds a rule that makes a browser use HTTPS for a site on later visits. They do not hide which sites you visit or protect you from a malicious download.
Definitions
HTTPS is HTTP carried over TLS. TLS encrypts the connection and lets the browser check that the server holds a certificate for the domain it asked for.
HSTS, short for HTTP Strict Transport Security, is a response header. MDN describes it as informing browsers that a host should only be accessed using HTTPS, and that future attempts over HTTP should be upgraded automatically. It also says that on later connections the browser will not let the user bypass secure connection errors, such as an invalid certificate.
What this means at a hotel or airport
| Question | Answer |
|---|---|
| Can another guest read my password on an HTTPS site? | Not through the Wi-Fi link |
| Can the network see which domain I visit? | Usually yes |
| Can a fake network show me a fake certificate? | It can try, and the browser warns you |
| Does HSTS stop a downgrade to HTTP? | On sites you visited before, yes |
| Does HTTPS make a site trustworthy? | No, only the connection |
HSTS has a gap on the very first visit. If a browser has never seen the header for a site, it has no stored rule yet. Sites you visited earlier on a trusted network are better covered. This is one reason to sign in to important services at home or on a hotspot before a trip, and not for the first time on hotel Wi-Fi.
The warning is the control
The most useful part of HSTS for a traveller is the removed bypass button. With a normal certificate error, many people click Advanced and continue. On an HSTS site that route is closed. If you see an unskippable error for a site you use daily, the network is almost certainly interfering, so disconnect.
For a normal certificate error on a site without HSTS, treat it the same way. Do not continue to a login page.
What HTTPS does not cover
- Metadata. The domain name, timing and volume of traffic stay visible to the network.
- Apps with weak settings. A native app that skips certificate checks gets no benefit.
- Phishing. A valid certificate on a look alike domain is still a fake site. Read the address.
- Downloads. A file served over HTTPS can still be malicious.
- Local actions. HTTPS does nothing about someone looking at your screen.
Habits that follow
- Keep your browser and operating system updated.
- Use a password manager that fills only on the exact saved domain; it will not fill on a look alike.
- Prefer hardware or passkey style MFA for work accounts.
- Use a hotspot for the most sensitive tasks, as in Phone hotspot or hotel Wi-Fi for work.
- Read the broader myths and facts on public Wi-Fi.
Safeguard looks at your code's dependencies and enforces policy on changes, so a commit made over any network gets the same checks. A free scan shows what a repository depends on.
Quick check
If the padlock is shown, is the site safe?
The padlock means the connection is encrypted to that domain. It does not say the site is honest, so check the domain too.
Should I set HSTS on my own sites?
If a site is served only over HTTPS, HSTS is a sensible hardening step. Test it on a staging host first, because a wrong max-age value is hard to undo for returning visitors.
Sources
Last reviewed: 19 October 2026.
