Public WiFi Safety: What Can Actually Go Wrong and How to Prevent It

You sit down in a cafe, your phone finds the WiFi before you do, and you connect without thinking. Everyone does it. Most of the time nothing happens — and that is exactly why public WiFi is worth taking seriously. The risk is not that every hotspot is a trap. The risk is that the few that are traps look identical to the safe ones.

This is not a reason to stop using public WiFi. It is a reason to understand what can actually go wrong, because the fixes are small and mostly one-time setup.

What "public WiFi" actually means

A public network is one you do not control, shared with strangers, and usually set up for convenience rather than security. Many are unencrypted, which means the traffic between your device and the router is not scrambled. Anyone else on the same network with basic tools can see a surprising amount of it: which sites you visit, unencrypted requests, and sometimes more.

Your home network is different. You (probably) know the password, you control who is on it, and your router is not shared with the table next to you. Public WiFi removes all three of those advantages at once.

What can actually go wrong

1. Someone watches your traffic

On an unencrypted network, data travels in a form that can be read by anyone listening. Most websites now use HTTPS, which encrypts the content of your connection to that site — your passwords and messages to that site are not sitting in plain text. But not everything on your phone uses HTTPS. Some apps, background services, and older sites still send data unencrypted, and even with HTTPS, an observer can see which domains you visit.

2. The fake hotspot

This is the trick worth knowing by name: the "evil twin." An attacker sets up a hotspot called "Cafe_WiFi" right next to the real "Cafe WiFi" and waits. Your phone picks the stronger signal, you connect, and now all your traffic routes through their equipment. A fake hotspot can also serve a fake login page asking for an email address or social login — harvested the moment you type it in.

The defence is boring and effective: ask staff for the exact network name. Two networks with nearly identical names is a red flag. A legitimate network will never ask you to install software or enter card details to get online.

3. Session hijacking

When you log in to a site, the site gives your browser a session cookie — a token that says "this person is logged in." If an attacker on the same network grabs that cookie, they can paste it into their own browser and act as you, without ever knowing your password. Modern sites mark cookies as secure and use HTTPS, which makes this much harder than it used to be — but sloppy sites and apps still exist, and this is the attack that two-factor authentication is built to survive.

4. Man-in-the-middle attacks

A related move: the attacker positions themselves between your device and the internet, relaying your traffic while reading or altering it. On a home network this is hard. On a public network, the attacker is already in the middle by design — they share the same router you do. DNS spoofing is one version of this: you type a real address and land on a convincing fake.

5. Malware over the local network

Less common, more damaging. If your device shares files or has network discovery switched on, other devices on the same network can sometimes see it. Keep file sharing off when you are out, and treat your laptop's "public network" profile as the default — Windows and macOS both have a setting for exactly this.

What HTTPS does — and does not — protect

HTTPS is doing real work here, and it deserves credit. When you see the padlock, the content of your connection to that site is encrypted, and your browser checks the site's certificate. That kills casual snooping on that site.

What it does not do: hide which sites you visit (the domain is still visible), protect apps that do not use encryption, or help if you land on a lookalike domain. A padlock on "coffeeshop-wifi-login.com" means your connection to that fake page is encrypted — it says nothing about whether the page is honest.

The habits that actually keep you safe

You do not need all of these. You need most of them, and the first two do the heavy lifting.

Use a VPN on networks you do not control

A VPN encrypts everything leaving your device — browser, apps, background services — and sends it through a server you chose. On a public network, that closes the main gap: even if someone is listening, they see encrypted traffic to one server and nothing else. Pick a VPN with a kill switch, which cuts your internet the moment the VPN connection drops. Without one, a dropped connection silently sends your traffic out in the open. Our guide to what VPNs actually do covers how to choose one, and our kill switch explainer covers why that one feature matters.

Turn off auto-join, and forget networks after use

Your phone remembers every network it has joined and reconnects automatically. That is convenient at home and a liability everywhere else: your phone can join a fake network copying a familiar name before you notice. Turn off auto-join for public networks, and forget them when you leave. It takes ten seconds.

Keep two-factor authentication on everywhere it matters

Even if a password is intercepted, 2FA means the attacker still cannot get in without the second factor. Email, banking, cloud storage, social accounts — all of them. Our step-by-step guide to setting up 2FA on every major app takes about fifteen minutes and is the best security return on time you will ever get.

Save sensitive logins for a trusted network

Banking, tax portals, work systems with client data: do these on mobile data or your home network. Mobile data is encrypted by the carrier and far harder to intercept than open WiFi. If you must do something sensitive on public WiFi, use your phone's hotspot instead of the cafe network.

Keep your software updated

Updates patch the exact flaws attackers use — including WiFi and browser vulnerabilities. The number of people running a two-year-old browser on a public network is higher than anyone wants to admit. Turn on automatic updates and stop postponing them.

Check the network name, every time

It bears repeating because it is the cheapest defence there is. Ask. If the staff look confused, that is also information.

What about the login page itself?

Many public networks show a captive portal — a login page that appears before you get internet access. It asks you to accept terms, enter an email address, or sometimes watch an ad. A real captive portal is run by the venue. A fake one is run by the person next to you.

The rule is simple: a captive portal should only ask for an email address or a terms checkbox. If it asks for a social media login, a password, payment details, or asks you to download an app or a certificate, stop. Close the page, disconnect, and ask staff whether that is their real login screen. A venue's WiFi page has no legitimate reason to need your Facebook password.

A quick checklist before you connect

• Confirm the exact network name with staff
• Turn on your VPN before opening anything
• Check for HTTPS and the correct domain on login pages
• Do not install anything a WiFi login page asks you to install
• Turn off file sharing and network discovery
• Forget the network when you leave

Public WiFi is not a minefield. It is a shared space with a few known risks and a short list of habits that handle them. Set up the VPN and 2FA once, keep auto-join off, and the rest is just paying attention for ten seconds before you connect.