How to Protect Yourself on Public WiFi

Public Wi-Fi is everywhere. Coffee shops, airports, hotels, libraries, even parks. Although it’s convenient, it is also one of the easiest places for scammers to take advantage of rushed, distracted users. 

The good news is you don’t need to be a cybersecurity expert to use public hotspots to protect your online security. A handful of habits can reduce your risk a lot. This guide walks you through what to be aware of, what to avoid, and a simple checklist you can follow to protect yourself on public Wi-Fi. 

Key Takeaways: Public Wi-Fi Security Tips 

• Assume any public Wi-Fi is unsafe, even if it looks legitimate.
• Verify the network name (SSID) with staff when possible.
• Disable auto-connect on your device.
• Disable file sharing before you connect.
• Use a VPN on public Wi-Fi, especially on open, unsecured networks.
• Avoid sensitive accounts, making purchases, and resetting your password on public Wi-Fi.
• Look for “HTTPS” in the URL or the lock icon when browsing. This indicates that the site is secure.
• When you are done, forget the network so your device doesn’t reconnect without your input.

What Makes Public Wi-Fi Risky?

Public hotspots aren’t always dangerous, but you should use them with caution. In many cases, you do not know who set up the network, who else is connected, or what equipment is behind it. Some public networks are managed and secured. Others are wide open, so they’re a risk for identity theft, fraud, and even theft.  

Here are the most common risks when using a public Wi-Fi network. 

Man in the Middle (MITM) Attacks

A man-in-the-middle (MITM) attack happens when an attacker intercepts the connection between your device and the website or service you’re trying to use. They can then relay, monitor, and alter data without you knowing. In many MITM cases, the attacker intercepts or spoofs the connection via a rogue hotspot. 

What it can look like: 

• You get unexpected sign-in prompts
• You see certificate warnings or redirects
• Websites and browser activity feels “off,” slow, or inconsistent

How to reduce the risk: 

• Use a VPN on public Wi-Fi
• Avoid sensitive logins and financial transactions
• Avoid websites that lack “HTTPS” in the URL or the lock symbol

Fake Hotspots (Evil Twin Wi-Fi)

An evil twin hotspot is an impostor Wi-Fi network. It might use a name like “CoffeeShop Guest” or “Airport Wi-Fi Free,” hoping you will connect to it without thinking twice about it. They’re common in places you’d expect to find a public Wi-Fi, like hotels, airports, and coffee shops. 

What it can look like: 

• Multiple networks with similar or related names
• A network name that looks official, but no one at the business recognizes it
• A login page that asks for information beyond what a public or guest Wi-Fi should need

How to reduce the risk: 

• Ask staff for the network name (SSID)
• Avoid generic names like “Free Public Wi-Fi”
• Disable auto-connect on your device

Network Snooping (Wi-Fi Sniffing)

Network snooping is when someone on the same Wi-Fi network captures or monitors traffic to see what other users are doing online. This is common on open and unsecured public networks. 

What it can look like: 

• There are no obvious signs, and it’s difficult to detect

How to reduce the risk: 

• Ensure the websites you visit have “HTTPS” in the URL or the lock icon
• Use a VPN
• Avoid sending sensitive information over public Wi-Fi

Captive Portal Phishing and Session Hijacking 

A captive portal is that login screen you see when you connect to an airport or hotel’s Wi-Fi network. Establishments that host public or guest networks use them to control traffic, increase security, and force compliance.  

Captive portal phishing happens when a fake login page tries to trick you into entering a password, email credentials, or personal details. Session hijacking is when an attacker steals or reuses your active login session, often by capturing a session cookie or token, so they can act as you, even without knowing your password. It’s important to note that the attacker has taken over the session, not the password itself. 

How to reduce the risk: 

• Never reuse important passwords in a captive portal
• Avoid signing into financial accounts on public Wi-Fi
• Log out when you are done, especially on shared or public devices
• Use multi-factor authentication (MFA) on key accounts

Is Public Wi-Fi Safe Today? 

Public Wi-Fi is often safe enough for basic browsing, but it’s still not the same as a network you know or control. Here is the simplest way to think about it: 

• Safer activities: reading news, checking the weather, browsing a retailer without logging in, streaming music or video as long as you’re not signing in or paying for it.

• Higher-risk activities: banking, paying bills, online purchases, password resets, signing into your email, accessing work admin tools, and submitting medical forms.

The danger isn’t just about someone reading your data. The bigger issues are often fake networks, malicious login pages, and account takeover attempts that can cause financial harm or compromise your identity. 

If you only remember one rule, make it this: use public Wi-Fi for low-risk tasks unless you have extra protections in place. 

How to Tell If a Public Wi-Fi Network is Secure

A common misconception is that a browser lock icon means the Wi-Fi network is secure. It does not. The lock icon indicates that your connection to a specific website is encrypted (HTTPS). It has nothing to do with Wi-Fi security. 

Follow these steps to verify the integrity and security of a public network before you connect. 

Step 1: Confirm you are joining the right network (SSID)

Before you connect, verify the name of the network. 

• Ask staff for the Wi-Fi name
• Look for signage but be cautious. Signs can be copied
• If you see multiple similar names, ask which one is correct
• Do not connect if you can’t verify the network name

Red flags: 

• “Free Wi-Fi” with no business name
• Extra numbers or letters that seem random, like CoffeeShop_2
• Names that mimic staff networks (CoffeeShop Staff Secure)

Step 2: Check for Wi-Fi encryption (WPA2 or WPA3)

Wi-Fi encryption refers to how your device connects to the hotspot at the network level. 

• Password-protected networks using WPA2 or WPA3 are generally more secure than open networks
• Open networks (no password) are easier to misuse and should be avoided

It’s not bulletproof, but it is a useful signal. If you have the option to use a password-protected network from the business, choose it as long as you know the business hosts the network.

Step 3: Check the website connection (HTTPS)

Once you are online, pay attention to the site connection when you enter information. 

• Look for “HTTPS” in the URL
• The lock icon suggests the website connection is encrypted
• Avoid entering passwords or payment info on pages that are not secured (missing HTTPS in the URL or the lock icon)

Remember: HTTPS and the lock icon indicate that the website is secure, not your internet connection. 

Public Wi-Fi Safety Checklist

It may seem like a lot, but the following checklist is intuitive and will become second nature the more you implement the tips. Awareness is your first line of defense, so question the validity of any public or guest network before connecting to it. If it feels off, don’t use it.

Before you connect 

Disable Wi-Fi network auto-connect 

• This prevents your device from hopping onto networks you used once before or networks with similar names without your input.

Disable file sharing

• On Windows, check sharing settings and turn off public folder sharing.
• On macOS, disable file sharing and sharing services you do not need.

Turn off nearby sharing features

• Examples: AirDrop, Nearby Share, Bluetooth sharing. Turn them back on later if needed.

Update your device

• Keeping your OS and browser up to date closes known security holes.

Enable your firewall

• Many devices have it on by default. Confirm that it is enabled, especially on laptops.

While you’re connected 

Use a VPN 

• A virtual private network (VPN) encrypts your internet traffic between your device and the VPN server and hides your IP address. This reduces your exposure while using a public network. 

Avoid critical activity 

• Skip banking, credit card entry, password resets, and sensitive work tools.
• Switch to cellular data or your phone hotspot if you can for critical tasks.

Use multi-factor authentication (MFA)

• MFA can stop many account takeover attempts, even if your password is compromised.

Log out when you are done

• Especially for email, banking, shopping, and work accounts.

Do not ignore browser warnings

• If you see certificate warnings, suspicious redirects, or strange popups, disconnect immediately.

After you disconnect 

Forget the network 

• This stops your device from reconnecting to it automatically in the future. 

Review what you did 

• Did you log into anything important? Did you enter a password? If so, it’s time to change your password. 

If something felt wrong: 

• Change the password for the account you used
• Turn on MFA if it is not already enabled
• Monitor your financial accounts for unusual activity

When You Should Avoid Public Wi-Fi 

Sometimes avoiding public Wi-Fi is the best move. But that’s not always practical. Always avoid unknown public networks. Use unsecured networks with caution and via a VPN if possible. Avoid connecting to public networks with general names, or variations on the hosting business’ name. If you must connect to public Wi-Fi, avoid the following actions while connected: 

• Banking and bill pay
• Shopping checkout and credit card entry
• Password resets and account recovery
• Work admin dashboards or sensitive internal tools
• Medical portals and personal forms

If you need to do any of the above, use cellular data or your own hotspot when you, or wait until you can access a known, secured network.

 
 
Risk: What it Looks Like, What to Do (Quick Reference) 

Stay Connected Without Giving Up Your Privacy 

Public Wi-Fi isn’t always a bad option when you need connectivity. But when you do use it, do what you can to protect yourself and limit exposure. Verify the network name, turn off auto-connect, disable sharing, and use a VPN whenever possible. Save critical, sensitive tasks, like banking, purchases, and accessing your employer’s network infrastructure, for cellular data or your own hotspot. When you’re done with a public Wi-Fi, delete or “forget” the network in your device’s Wi-Fi settings. 

Those small habits take a minute or two, and they can prevent a long list of headaches later.