Every riad has it, every café advertises it, and the airport hands it out before you reach baggage claim. Free Wi-Fi is one of the easier things to find in Morocco — which is exactly why it's worth thinking about for five minutes before you're sitting in a Marrakech courtyard paying for a hotel with it.
The honest answer to "is it safe?" is: safer than the headlines suggest, and riskier than the sign on the wall implies. Here's what has actually changed, what hasn't, and the setup that sidesteps most of it.
What HTTPS already fixed
Most of the scary advice about public Wi-Fi was written for an internet that barely exists any more. The overwhelming majority of web traffic is now encrypted end to end, so someone sitting in the same café cannot simply watch your banking session go past. That part of the threat has largely been engineered away.
What encryption does not cover is the moment before it starts, and the decisions you make inside the browser:
- Captive portals load over plain HTTP by design. That pop-up asking for your email, your phone number or a room code is the one page on the network that isn't protected.
- A certificate warning you click through cancels the protection. Tired travellers click through them.
- Nothing stops a network from showing you a convincing login page. Encryption proves a connection is private, not that the page at the other end is who it claims to be.
The attack that is real: the look-alike network
An "evil twin" is a hotspot broadcasting a name you trust — the café's, the hotel's, the airport's — from someone else's hardware. Your phone keeps a list of networks it has joined before and will reconnect to a matching name automatically, which means you may never tap anything.
This isn't theoretical. In 2024 the Australian Federal Police charged a man with running fake free Wi-Fi access points at domestic airports and on flights, harvesting the credentials people typed into his portal pages; in November 2025 he was sentenced to over seven years. Nothing about that attack is country-specific — it needs a crowd of travellers and a plausible network name, and a busy airport or a medina café terrace supplies both.
The Moroccan specifics worth knowing
Two things shape what you'll actually run into on the ground.
Most Wi-Fi you join is a shared password, not a private link. When the waiter writes the key on your receipt, everyone who has ever been handed that key is on the same network as you. A shared key is not per-user privacy, and "open" networks with no key at all — common at cafés and transport hubs — give you none at that layer.
A lot of Moroccan "fixed" internet is mobile internet with extra steps. Morocco is a mobile-first country: the regulator ANRT counted more than 57 million mobile subscriptions in the first quarter of 2026, against a fixed base of about 4.6 million — and that figure only gets there because it includes 4G/5G home boxes; true fixed lines number roughly 3.26 million. Fibre is growing fast but concentrated in the big cities. So the riad Wi-Fi in a smaller town is often a cellular router shared by every guest at once, which explains more dropped video calls than any security problem does.
Meanwhile, the mobile side keeps getting better. Maroc Telecom, Orange Maroc and Inwi launched commercial 5G in November 2025, and their licence terms commit them to covering 45% of the population by the end of 2026 and 85% by 2030. Coverage varies by place and by plan, but the investment is clearly going into the networks your phone can use directly.
The rules that actually matter on an open network
- Confirm the network name with staff before joining, especially in airports and busy cafés.
- Never type an account password or card number into a portal page. A genuine portal asks for a room number or a code, not your email password.
- Never install a profile or certificate a network offers you, whatever it promises to unlock. That is the one action that can undo HTTPS.
- Turn off auto-join for public networks and delete the saved ones you don't need, so your phone stops volunteering.
- Keep anything financial off Wi-Fi entirely — bookings, banking, card entry, 3-D Secure confirmations.
Carrying your own connection
That last rule is easier to follow if you don't need the café's network in the first place. Mobile data is encrypted between your phone and the operator's network, there is no shared key being written on receipts, and there is no portal page to misread. A VamosData eSIM for Morocco gives you that from the moment you land: it installs over the connection you already trust at home, and your usual apps work normally.
The practical wins are mundane rather than dramatic:
- Your bank's app runs on a connection nobody else in the building is on.
- You stay online walking between the souk and the riad, so maps and ride-hailing keep working.
- Your home number stays live on your physical SIM for bank codes, while your VamosData eSIM carries the data.
Be clear about what this doesn't do: it isn't a VPN, it doesn't make a phishing email less convincing, and the moment you join hotel Wi-Fi you're back on a shared network whichever SIM is in your phone. What it removes is a category of unknowns you can't inspect from a café table.
Set it up before you fly
Check that your handset supports eSIM with the device checker, then pick a plan from destinations and install it at home — the iOS and Android walkthroughs take a couple of minutes. Installing on arrival is possible, but it means doing it over exactly the network you were trying to avoid.
Planning the rest of the trip? Start with the Morocco travel guide, and for the airport-arrival routine read your first 30 minutes in a new country.