Boarding a commercial flight at a U.S. airport today generally requires a boarding pass to get anywhere near a gate, federal government-controlled security screening, and close scrutiny of what goes into carry-on bags. It was not always so.

Travelers once passed through checkpoints staffed by private contractors hired by the airlines. Full-sized shampoo bottles and cans of shaving cream were not confiscated for exceeding liquid limits, and friends and relatives could walk departing passengers to the gate and share a goodbye hug at boarding time.

The security architecture and screening procedures flyers encounter today were assembled layer by layer, often in the aftermath of attacks or attempted attacks that exposed new vulnerabilities — from bombs hidden in luggage to hijackers who turned airplanes into weapons. The pattern has repeated for decades: a plot succeeds or is foiled, investigators identify the vulnerability it exploited, and new procedures or technology follow — usually at the cost of longer lines and new demands on travelers.

"Attacks on aviation have an impact much greater than attacks on anything else because aviation commands the attention of the world as the thing that links the world," said Mary Schiavo, an aviation disaster attorney.

With the 25th anniversary of 9/11 approaching, here is how those attacks, the earlier bombing of Pan Am Flight 103, and subsequent plots shaped airline and airport security.

9/11 forced authorities to rethink aircraft hijackings

No single day changed air travel more dramatically than Sept. 11, 2001, when 19 al-Qaida hijackers commandeered four commercial airplanes, crashing two into New York's World Trade Center, one into the Pentagon, and another into a Pennsylvania field. Nearly 3,000 people were killed, making it the deadliest terrorist attack in history.

Before then, authorities presumed hijackers would seek to negotiate rather than deliberately crash an aircraft as part of an attack, according to Schiavo, who served as the U.S. Department of Transportation's inspector general from 1990 to 1996.

"The focus at the time, generally, was not on suicide attackers," she said.

U.S. officials introduced changes before the 9/11 Commission identified the systemic failures and missed warning signs that allowed the plot to proceed.

The Federal Aviation Administration immediately restricted airport gate access to ticketed passengers and banned knives and box cutters from carry-on bags. The hijackers had used small knives to threaten passengers, attack crew members, and seize the planes.

Congress created the Transportation Security Administration, shifting responsibility for screening passengers, baggage, and other cargo to a federal workforce. The same November 2001 law — the Aviation and Transportation Security Act — required reinforced cockpit doors, more federal air marshals on flights, and screening of 100% of checked luggage for explosives. The creation of TSA also federalized a screening workforce that had previously varied widely in training and pay from airport to airport, and the agency grew into a workforce of tens of thousands of officers stationed at more than 400 U.S. airports.

Another post-9/11 development also changed how passengers prove who they are at the airport: the REAL ID Act, passed by Congress in 2005, established federal minimum standards for state-issued driver's licenses and identification cards. Enforcement of its requirement that travelers present REAL ID-compliant identification to fly domestically began in May 2025.

As screening times and lines lengthened, TSA looked for ways to move pre-vetted travelers through more efficiently, said Sheldon Jacobson, a University of Illinois professor whose research on risk-based screening contributed to the design of TSA PreCheck.

The agency increasingly relied on watchlist checks, voluntary background investigations, and other information to sort passengers by assessed risk. Travelers flagged for additional scrutiny faced more intensive checks. Civil liberties advocates warned that opaque selection criteria and inaccurate watch lists would encourage discriminatory profiling based on race or religion.

The range of security flaws that 9/11 exposed came after authorities and the aviation industry had already spent more than a decade trying to close gaps revealed by earlier attacks.

A bombing high above Scotland put the spotlight on checked bags and hidden explosives

Almost 13 years before 9/11, a bomb destroyed a jumbo jet operated by a U.S. airline flying at 31,000 feet over Lockerbie, Scotland, killing all 259 people aboard and 11 people on the ground. Investigators determined that an explosive device hidden in a radio-cassette player had been inside a suitcase checked in Malta and ultimately transferred to Pan Am Flight 103 without an accompanying passenger. The attack, which came to be known simply as Lockerbie, remains one of the deadliest attacks on aviation in history and became a benchmark case in the study of baggage-security loopholes.

The Dec. 21, 1988, attack on the London-to-New York flight "stimulated the most significant changes in aviation security since the early 1970s," former FAA Administrator Jane Garvey told the 9/11 Commission in 2003.

The FAA ordered U.S. carriers at airports in Europe and the Middle East to X-ray or physically search all checked baggage, to conduct additional random checks, and to confirm that checked bags belonged to flying passengers.

Acting on recommendations from a presidential commission and legislation passed by Congress, the FAA assigned security personnel at major U.S. and foreign airports, established intelligence-sharing agreements, instituted tighter cargo controls, developed training standards for private screeners, and researched explosives-detection and mitigation technology.

The agency also covertly tested airport and airline security systems by assigning a team "to simulate the criminal and terrorist attacker modus operandi," Garvey testified. On Sept. 10, 2001, the FAA viewed attacks with explosive devices as the most dangerous threat to an airliner and the people aboard, she told the 9/11 Commission.

"The challenge is not formulating attack scenarios," Garvey said. "The challenge is figuring out how best to allocate finite resources in an environment of uncertainty."

Footwear and beverage bottles became security concerns after foiled bomb plots

Three months and 11 days after 9/11, Richard Reid boarded American Airlines Flight 63 from Paris to Miami with explosives hidden in his shoes. The British man tried to ignite them midflight but struggled to light the fuse before other passengers and crew members subdued him.

After the Dec. 22, 2001, incident, TSA and airlines asked passengers to remove their shoes voluntarily at security screening. Shoe removal became mandatory less than five years later, around the same time TSA restricted outside liquids and gels on commercial planes.

Those changes followed British authorities' announcement that they had disrupted a plot to use liquid explosives concealed in beverage bottles to destroy seven transatlantic airliners. Authorities alleged the plotters planned to assemble and detonate the devices in suicide attacks, and six men were ultimately convicted. The disruption of the plot in August 2006 forced the cancellation or delay of hundreds of flights and abruptly upended carry-on rules on both sides of the Atlantic, showing how quickly security procedures can change in response to a single threat.

TSA immediately banned nearly all liquids, gels, and aerosols from remaining with travelers beyond security screening. The agency soon replaced that prohibition with the "3-1-1" rule, which limits passengers to containers of 3.4 ounces or less that must fit in a single quart-sized, clear plastic bag.

In July 2025, the Trump administration ended the shoe screening requirement that had sent passengers shuffling through security barefoot or in socks.

The "underwear bomber" accelerated the rollout of body scanners

On Christmas Day 2009, a passenger on Northwest Airlines Flight 253 tried to detonate explosives hidden in his underwear as the plane approached Detroit. The device failed but caused a fire, and the passenger — who identified himself as a Yemen-trained member of al-Qaida — was severely burned. The young man, Umar Farouk Abdulmutallab, later pleaded guilty to attempting to destroy the aircraft.

The traditional metal detectors then in use could not detect the plastic explosives under Abdulmutallab's clothes. TSA was already testing full-body scanners at some U.S. airports, and the averted disaster persuaded authorities to fast-track the technology.

The radio wave scanners check for a wide range of prohibited items. Stepping inside one with feet apart and hands raised overhead has become a familiar ritual for most travelers.

Aviation security keeps evolving with new technology and equipment

Security screening at U.S. airports is still evolving. TSA has been expanding facial recognition technology to verify passengers' identities, an effort that has drawn objections from privacy advocates and some members of Congress who have pressed the agency to make participation optional. As of last month, newly manufactured passenger airplanes must have a retractable security gate between the cabin and flight deck to protect the cockpit when its reinforced main door is open. The Air Line Pilots Association wants those secondary barriers added to existing aircraft as well.

"Any one layer of security can be breached," Jacobson said, "but collectively, when you put them on top of each other, what you end up with is a very resilient system."

This story was originally featured on Fortune.com (fortune.com).