Free Wi-Fi is everywhere: the coffee shop on the corner, the hotel lobby, the airport gate and the train you take to work. It is convenient, but every one of those networks is shared with strangers and run by someone you have never met.
The good news is that staying safe on public Wi-Fi does not require expert knowledge. Once you understand the handful of attacks that actually happen on open networks, a few settings changes and good habits remove most of the risk. This guide explains those attacks, where HTTPS helps and where it does not, and which settings to change on each operating system.
Key takeaways
- On public Wi-Fi, assume that anyone nearby can see your traffic and that the network itself may be hostile.
- Evil twin hotspots, packet sniffing, session hijacking and fake captive portals are the most common real-world threats.
- HTTPS encrypts the content of most websites, but it does not hide which sites you visit, protect app traffic that skips it, or stop you from typing a password into a fake page.
- A VPN encrypts everything between your device and the VPN server, so the local network sees only one encrypted connection.
- Turn off auto-join and file sharing, mark the network as public, keep your system updated and use multi-factor authentication.
Why public Wi-Fi is risky
At home you control the router and know every device on the network. On a public hotspot you control nothing. Several things make these networks a natural target:
- They are shared. Dozens or hundreds of people connect to the same network, and on many hotspots the devices can talk to each other directly.
- They are often open or use a shared password. A password printed on a café chalkboard gives everyone the same key. On older WPA2-Personal networks, anyone who knows the password and captures your connection handshake can decrypt your traffic on that network.
- Nobody audits them. The hotspot may run outdated firmware, have default admin credentials or be managed by a third party the venue never checks.
- Your device trusts names, not networks. Phones and laptops reconnect automatically to any network name (SSID) they have seen before, which is exactly what attackers exploit.
The most common public Wi-Fi attacks
In practice, a small number of techniques account for most of the danger.
Evil twin hotspots
An evil twin is a rogue access point that copies the name of a legitimate network, for example "Airport_Free_WiFi" or "Hotel-Guest". If the fake signal is stronger than the real one, nearby devices happily connect to it, especially devices that have joined a network with that name before.
Once you are connected to an evil twin, the attacker is your internet gateway. They can see every unencrypted request, redirect you to look-alike login pages, tamper with downloads and answer your DNS queries with whatever addresses they like.
Packet sniffing
Wi-Fi is radio. On an open network with no encryption, anyone in range with a laptop and freely available software can capture the frames flying through the air. Even on a password-protected network, the local operator (or anyone who has compromised the router) sees all traffic that passes through it. Sniffing reveals unencrypted pages, the hostnames you connect to, DNS lookups and data from apps that still use plain-text protocols.
Session hijacking
When you log in to a website, it gives your browser a session cookie so you do not have to enter your password on every page. If an attacker obtains that cookie, they can often use your account without knowing your password at all. Modern sites mark cookies as secure and send them only over HTTPS, which has made classic cookie theft much harder. But not every site or app is configured properly, and a single unencrypted request can leak a session token.
Man-in-the-middle and SSL stripping
An attacker who controls the network path can try to intercept connections as they are set up. SSL stripping catches the very first unencrypted request to a site (for example when you type a domain name without "https://") and keeps you on an unencrypted version while the attacker talks HTTPS to the real server. Browsers now resist this through HSTS, which tells them to use HTTPS for a domain even on the first request, but the protection is only as good as the site's configuration.
Malicious captive portals
A captive portal is the login or "accept terms" page that appears when you first join a hotel or airport network. Fake ones may ask you to "log in with your e-mail account", request card details for "premium access", or prompt you to install a "security certificate" or "connection helper". Any of these can hand the attacker your credentials or full control over your device.
Attacks on your device itself
On networks without client isolation, other users can reach your laptop directly. If file sharing, network discovery, remote desktop or an old unpatched service is enabled, they can probe it just as they would probe a server on the internet.
Captive portals: how to handle them safely
Captive portals work by intercepting your first web request and redirecting it to a login page, which is also why they are so easy to fake.
- Know what to expect. A hotel typically asks for a room number and surname, or an access code from reception. A café usually needs a click on "Accept". Be suspicious of anything more.
- Never enter your main e-mail password or social media credentials into a portal, and never install software or certificates it offers.
- Connect your VPN immediately after logging in. The VPN usually cannot connect until the portal is accepted, so start it straight afterwards, before opening anything else.
Tip: If the portal page does not appear, open a browser and type a plain, non-sensitive web address that starts with http:// rather than https://; the portal usually intercepts it and redirects you to the login page. Many devices also show a "Sign in to network" notification you can tap. Avoid typing sensitive domains into the address bar before you are through the portal.
What HTTPS protects, and what it does not
HTTPS has made open networks far less dangerous than they were a decade ago, and you should always look for it. But "everything is HTTPS now" does not mean public Wi-Fi is safe.
| What an observer on the Wi-Fi can see | HTTPS only | HTTPS + VPN |
|---|---|---|
| Contents of pages, forms and passwords on HTTPS sites | Hidden | Hidden |
| Domain names you visit (via DNS and the TLS SNI field) | Usually visible | Hidden from local network |
| Traffic from apps or devices that do not use encryption | Visible | Hidden from local network |
| Timing and volume of your traffic | Visible per site | Visible only as one encrypted stream |
| Your DNS queries | Visible unless encrypted DNS is on | Sent through the tunnel |
| Protection from typing credentials into a fake login page | No | No (your judgement still matters) |
| Your device exposed to other users on the same network | Yes | Reduced with a kill switch and firewall, but keep sharing off |
In short, HTTPS protects the content of each connection to a website. It does not protect the rest of your device's traffic, it leaves domain names exposed, and it cannot save you from typing your password into an attacker's page.
How a VPN protects you on public Wi-Fi
A VPN creates an encrypted tunnel between your device and a VPN server. Everything your device sends, not just browser traffic, goes into that tunnel before it touches the local network. The café router, the person with a sniffer in the corner and even an evil twin hotspot see only a single encrypted connection to a VPN server. They cannot read it, modify it without detection, or see which sites and services you use. If you want the background on how this works, our article on why you should use a VPN covers the basics.
What to look for in a VPN for public Wi-Fi
- Modern protocols. WireGuard, OpenVPN with AES-256-GCM and IKEv2/IPsec are all strong choices. Our guide to VPN protocols explains the differences.
- Auto-connect on untrusted networks. The best protection is the one you do not have to remember. PD-Proxy's Wi-Fi Protection connects the VPN automatically when you join a network you have not marked as trusted.
- A kill switch. If the VPN connection drops, a kill switch blocks traffic until it reconnects, so nothing slips out unprotected.
- Private DNS. Your DNS lookups should go through the tunnel to the provider's resolver rather than to whatever the hotspot hands out.
- A stealth or obfuscated mode. Some hotel and airport networks block VPN protocols. A mode that runs over TCP port 443 looks like ordinary HTTPS and usually gets through.
After connecting, it is worth confirming that the tunnel is actually working. Check that your visible IP address has changed to the VPN server's, and run a DNS and WebRTC leak test once on each new device.
A VPN is not a force field. It protects your data in transit on the local network. It does not stop phishing, malware you choose to download, or weak and reused passwords. Combine it with the habits below.
Settings checklist for each operating system
Spend ten minutes on these settings once. Menu names vary slightly between versions.
Windows
- When joining a hotspot, set the network profile to Public (Settings > Network & internet > Wi-Fi > the network > Network profile type). This disables network discovery and file and printer sharing on that network.
- Keep Windows Firewall (Windows Security > Firewall & network protection) switched on for public networks.
- Untick Connect automatically for hotspots you do not use regularly, and remove old ones under Manage known networks.
- Turn on Random hardware addresses to make it harder to track your laptop between hotspots.
macOS
- Enable the firewall (System Settings > Network > Firewall) and consider turning on stealth mode in its options.
- Turn off File Sharing, Screen Sharing and Remote Login under System Settings > General > Sharing.
- Disable Auto-Join for public networks in the Wi-Fi details, and remove networks you no longer need.
- Set AirDrop to Contacts Only or Receiving Off while travelling.
Android
- Open the network's settings and switch off automatic reconnection for hotspots you will not revisit; forget old saved networks.
- Keep Use randomised MAC (Privacy setting) enabled for public networks.
- Consider setting Private DNS to a trusted provider, and use the VPN app's always-on option with "block connections without VPN" where available.
- Turn off Nearby Share or Quick Share visibility for everyone when you are in public.
iOS and iPadOS
- Tap the (i) next to a public network and turn off Auto-Join; use Forget This Network for hotspots you are done with.
- Keep Private Wi-Fi Address enabled (on current versions it can be set to Rotating or Fixed).
- Set Settings > General > AirDrop to Contacts Only or Receiving Off.
- Pay attention to the "Weak Security" warning under the network name, which indicates an open or outdated network.
For more phone-specific advice, see our guide to mobile VPNs and smartphone privacy.
Everyday habits that make the biggest difference
- Ask staff for the exact network name and password instead of guessing from the list.
- Prefer WPA2 or WPA3-protected hotspots over open ones, and your phone's personal hotspot over both when you have enough mobile data.
- Connect your VPN straight after the captive portal, before opening e-mail, banking or work apps.
- Check for the padlock and the correct domain before typing a password; do not bypass browser certificate warnings.
- Use a password manager: it will refuse to autofill credentials on a look-alike domain, which is an excellent phishing alarm.
- Enable multi-factor authentication, ideally with an authenticator app or security key rather than SMS.
- Keep your operating system, browser and apps updated before you travel.
- Do not accept software updates, certificates or "Wi-Fi helper" apps offered by a hotspot.
- Log out of sensitive accounts on shared devices and forget the network when you leave.
What to do if you think you were compromised
If you entered a password on a suspicious portal, clicked through a certificate warning or saw an unfamiliar login alert, act quickly, in this order:
- Disconnect from the suspicious network and switch to mobile data or a network you trust.
- Change the affected passwords from a device you trust, starting with your primary e-mail account, because it can be used to reset everything else. If you reused that password anywhere, change it there too.
- Sign out of all sessions. Most major services have a "sign out of all devices" option in their security settings, which invalidates any stolen session cookies.
- Turn on or review multi-factor authentication and check that no unfamiliar recovery e-mail, phone number or app password has been added.
- Review recent activity: login history, mail forwarding rules, connected apps, and bank or card transactions.
- Check your device. Remove any profiles, certificates or apps you installed from the hotspot. On iOS, look in Settings > General > VPN & Device Management; on Android and Windows, check installed apps and trusted certificates. Run a reputable security scan.
- Contact your bank if you entered card details, and ask for the card to be replaced.
- Tell your employer's IT team if work accounts or devices were involved.
Frequently asked questions
Is hotel Wi-Fi safer than café Wi-Fi?
Not necessarily. A room number or access code keeps out passers-by, but every guest shares the same network, often managed by a third party. Treat hotel Wi-Fi as public.
Does a password-protected Wi-Fi network mean my traffic is private?
Only partly. The password encrypts the radio link, but everyone who knows the password is on the same network, and the operator of the router sees everything that passes through it. On WPA2-Personal, someone with the password can also decrypt other users' traffic in some circumstances. WPA3 improves this, but it does not protect you from the network operator or a malicious hotspot.
Can I use online banking on public Wi-Fi?
Banking sites and apps use strong encryption, so the risk is lower than many people assume. The real dangers are fake login pages and evil twin hotspots. If you must bank on public Wi-Fi, use the bank's official app, connect your VPN first and never click through a certificate warning. Using mobile data is an even simpler option.
Is my phone's personal hotspot safer than public Wi-Fi?
Yes. A personal hotspot is a private network you control, protected with your own password, and the traffic travels over your mobile carrier's encrypted connection. It is one of the best alternatives when you do not trust the local network.
Will a free VPN protect me on public Wi-Fi?
A reputable free plan encrypts your traffic just like a paid one. PD-Proxy's free plan gives you 1 GB per day, enough for e-mail and browsing on the go. For heavier use, Premium adds unlimited bandwidth, all server locations and up to five devices.
Conclusion
Public Wi-Fi is not something to fear, but it deserves respect. Most attacks rely on predictable behaviour: auto-joining familiar names, clicking through warnings and apps that skip encryption. Turn off auto-join, mark hotspots as public, switch off sharing, keep MFA on and let a VPN encrypt everything the moment you are online. With those few steps in place, you can work from the airport gate with the same confidence you have at home.
Ready to protect yourself on the go? Download the PD-Proxy app for your device, or create a free account to get started in minutes.
