Public Wi-Fi is not as dangerous as it was in the early web era, but it is not the same as a trusted home network either. Modern HTTPS has reduced the classic snooping problem, while fake hotspots and exposed devices still deserve attention.
Does this affect you?
Use this before joining open or password-free Wi-Fi at coffee shops, airports, hotels, libraries, stores, conferences, and similar public places.
Understand what is actually still risky
The threat has changed more than it has disappeared.
- Casual traffic reading is much harder now. Most major websites and apps use HTTPS, so someone nearby on the same Wi-Fi usually cannot read the contents of properly encrypted traffic.
- Fake hotspots are still a realistic problem. A network named Airport_Free_WiFi or Cafe_Guest may be created by someone nearby, so confirm the exact network name with staff.
- Some older apps and services may still send information without strong encryption. Old email settings, older companion apps, and unusual software are more likely to be weak spots.
- Man-in-the-middle attacks are harder because HTTPS triggers certificate warnings, but a malicious network can still try to intercept or redirect traffic. Never ignore certificate or security warnings.
- Device exposure is separate from web encryption. On open networks without client isolation, other devices may see or attempt to connect to yours if file sharing or firewall settings are loose.
For normal browsing, public Wi-Fi is often reasonable today. The bigger caution belongs around logins, payments, work systems, banking, and tax information.
What to actually do about it
Use a practical checklist instead of avoiding every public network.
- Ask staff for the exact network name before joining, especially in airports, hotels, and busy cafes.
- Check for HTTPS and avoid entering passwords or payment details on pages marked Not Secure.
- Turn off file sharing and choose Public network mode on Windows when prompted for a new network.
- Use a VPN for an extra layer, especially on unfamiliar networks or for sensitive tasks. It encrypts traffic through a private tunnel and reduces what the local network can observe.
- For your most sensitive logins, use cellular data or your own mobile hotspot if you prefer the simplest low-risk choice.
More control
HTTPS changed the baseline
Years ago, many sites transmitted login and browsing data over HTTP. Browser pressure and universal HTTPS adoption dramatically reduced that particular public Wi-Fi risk.
A VPN is useful, not magic
On modern websites, a VPN is often more about privacy from the network operator and extra assurance than a strict requirement for reading news or maps. It still cannot protect you from phishing pages or bad downloads.
Travelers are easy targets
Spoofed Wi-Fi works best where people are rushed and unfamiliar with the venue. Confirming the network name is one of the highest-value checks you can do.
Sources
- CISA – Cybersecurity Tips for Traveling (2025)
- FTC Consumer Advice – Public Wi-Fi Networks (2025)
- Google Safety Center – Wi-Fi Safety (2025)