Public Wi-Fi Safety: Plain-English Steps to Stay Safe

Free Wi-Fi in cafés, hotels, trains and airports is handy, but you do not know who runs it or who else is connected. Public Wi-Fi is much safer than it was ten years ago, because most websites and apps now scramble (encrypt) what you send. The risks that remain are mostly about fake networks, fake login pages and devices that are out of date or set to share too much. This guide explains, in plain English, how to connect safely, what to avoid, how to spot trouble and what to do if something goes wrong. It is written for anyone who uses free Wi-Fi away from home, including older people, families and people running a very small business on the move.

Key takeaways

Check the network name with staff. Criminals can set up a hotspot with a name like "Free Cafe WiFi". Ask which network is the real one.
Look for the padlock and "https". It means the connection to that website is encrypted. It does not prove the website is honest.
Use your mobile data for banking. For anything sensitive, your phone's own connection is a safer choice than a hotspot you do not control.
Keep devices updated and protected. Updates, a firewall and 2-step verification do most of the work wherever you connect.
Forget networks when you leave. Stop your phone or laptop joining public networks automatically in future.

How risky is public Wi-Fi today?

The US Federal Trade Commission (FTC) says public Wi-Fi used to be risky because most websites did not encrypt data, but that most websites now do, so using public Wi-Fi is usually safe. That is a useful correction to older advice that told people never to use it at all.

"Usually safe" is not "always safe". These are the risks that still matter:

Risk	What it means in plain English	What protects you
Fake hotspot (sometimes called an "evil twin")	Someone nearby creates a network with a believable name so you connect to them instead of the venue.	Confirm the exact network name with staff. Prefer well-known providers.
Fake login or sign-in page	A page that asks for your email password, bank details or card number "to get online".	Never give account passwords or bank details to join Wi-Fi. Leave and use mobile data.
Unencrypted websites	A few sites still send information without scrambling it, so others on the network could read it.	Only type personal details where you see the padlock and "https".
Scam websites with a padlock	The FTC warns that scammers encrypt fake sites too. The padlock protects data on the way, not from the people running the site.	Type addresses yourself or use bookmarks and official apps.
Out-of-date devices	Old software has known holes that others on the same network could try to use.	Automatic updates, firewall and security software on.
Sharing turned on	File sharing, printer sharing or AirDrop-style features left open to everyone nearby.	Turn sharing off in public places.
Tracking	Your device's network address can be used to recognise it across visits.	Private or random Wi-Fi address settings on phones and laptops.

For organisations, see the Wi-Fi Security Guide.

Before you connect

A few minutes of preparation at home makes public Wi-Fi much safer.

Turn on automatic updates: the FTC advises keeping security software, operating system and browser up to date on both computers and phones, and turning on automatic updates.
Check your protection: the Northern Ireland Cyber Security Centre recommends having up-to-date antivirus and firewall protection before using a hotspot. Windows and macOS include a firewall; make sure it is switched on.
Turn on 2-step verification: for email, banking and social media. Even if a password is stolen, the criminal still needs the second step. See the Two-Factor Authentication for Everyone Guide.
Use a password manager: it fills in passwords only on the real website, which helps you notice a fake login page. See the Password Managers Explained for Everyone Guide.
Check your mobile data allowance: many phone plans now include enough data to use your own connection, or to share it with a laptop using your phone's personal hotspot feature, which you protect with your own password.

Connect safely, step by step

Ask staff for the exact network name: look for a sign or ask at the counter. If two networks look alike, ask which one is correct. The Northern Ireland Cyber Security Centre suggests using well-known commercial hotspot providers where possible.
Prefer networks with a password: on Android, networks that need a password show a lock icon in the Wi-Fi list, as Google's help pages explain. A password shared with every customer does not make you private from them, but it does keep out casual passers-by.
Be careful on the sign-in page: many hotspots open a page asking you to accept terms or enter an email address. That is normal. Asking for your email password, your bank details or a payment you did not expect is not. Close it.
Choose "public" if your laptop asks: Windows asks whether a network is public or private. Choose public in cafés, hotels and stations, because it hides your computer from other devices on the network. Settings names change between versions, so check your device's help pages.
Check the padlock before typing anything personal: the FTC says to look for a lock symbol or "https" in the address bar, which also works on phone browsers. Most phone apps use encryption too, though it is harder to check.
Save banking for mobile data: the Northern Ireland Cyber Security Centre advises avoiding online banking and other sensitive tasks on public Wi-Fi, and using your own mobile data where possible.
Forget the network when you leave: Android and iPhone automatically rejoin networks you have used before. On Android, Google says to press and hold the saved network in Settings, Network and internet, Internet, then choose Forget. On iPhone, tap the info button next to the network and choose Forget This Network.

Settings to check on your phone and laptop

Menus change after updates, so use these as a guide to what to look for.

Device	Setting	What to choose
iPhone, iPad, Mac	Private Wi-Fi Address (Settings, Wi-Fi, info button next to the network)	Leave it on. Apple says Rotating changes the address every two weeks and is the default on networks with weak or no security.
Android	Saved networks (Settings, Network and internet, Internet)	Forget public networks after use so the phone does not rejoin them automatically.
Windows laptop	Network profile type	Public network for any café, hotel or travel Wi-Fi.
All devices	File, printer and nearby sharing	Off, or limited to contacts only, while out.
All devices	Automatic updates	On.

Apple's Private Wi-Fi Address feature gives your device a different network address for each Wi-Fi network, which makes it harder for network operators and observers to track you over time. Apple recommends leaving it on.

Do you need a VPN?

A VPN (virtual private network) is an app that sends all your internet traffic through an encrypted tunnel to the VPN company's servers. On public Wi-Fi it hides which websites you visit from the hotspot owner and others on the network.

When it helps: if you often work from cafés or hotels, or your employer provides one for work. Use the work VPN whenever you handle work data. See the Remote Working Security for Staff Guide.
When it adds little: for occasional browsing of sites that already show the padlock, a VPN adds a smaller benefit than updates, 2-step verification and careful clicking.
The trade-off: a VPN company can see your traffic instead of the café. Choose a well-established provider with a clear privacy policy, and be wary of free VPN apps whose business model is unclear.
What it does not do: a VPN will not stop you entering details on a scam website.

Your phone's own mobile data, or sharing it with your laptop, is often the simplest alternative.

Signs something is wrong

The sign-in page wants too much: your email password, bank card, or a download "to get online".
Security warnings on familiar sites: your browser says the connection is not private or the certificate is invalid on a site that normally works. Do not click past it. Disconnect.
A login page appears unexpectedly: for example a "sign in to your email" page when you only opened the hotspot.
Two networks with almost the same name: ask staff which is real, or do not connect.
Alerts afterwards: new sign-in emails, password reset messages or payments you do not recognise.

What to do if it happens

Disconnect: turn off Wi-Fi and switch to mobile data.
Change passwords: from a trusted connection, change the password of any account you typed into a suspicious page, starting with email, then any account that used the same password.
Turn on 2-step verification: if it was not already on.
Call your bank: if you entered card or banking details, use the number on the back of your card.
Forget the network: so your device does not rejoin it.
Report it: tell the venue about a fake network, and report fraud as below.

Where to get help

UK, reporting crime: in England, Wales and Northern Ireland, report fraud and cyber crime to Report Fraud at reportfraud.police.uk or 0300 123 2040, as the NCSC explains. In Scotland, call Police Scotland on 101.
UK, scam websites: the NCSC has a form to report suspicious websites, linked from the same page.
UK, guidance: the Northern Ireland Cyber Security Centre covers public Wi-Fi alongside home networks.
US: report scams to the FTC at ReportFraud.ftc.gov, and cyber crime to the FBI at IC3.

Common failure patterns

Joining the first network with the venue's name: without checking, you may be on someone else's hotspot.
Treating the padlock as proof of honesty: scam sites have padlocks too.
Entering account passwords on a hotspot sign-in page: real hotspots do not need your email or bank password.
Clicking past certificate warnings: on public Wi-Fi this is exactly the warning that matters.
Leaving devices to auto-join public networks: your phone may connect to a look-alike network later without you noticing.
Skipping updates while travelling: old software is the easiest target on a shared network. See the Travel Cybersecurity Guide.

Practitioner checklist

Before you go out, turn on automatic updates and check your firewall is on.
Turn on 2-step verification for email, banking and social media.
Ask staff for the exact Wi-Fi name and prefer well-known providers.
Choose "public" if your laptop asks what type of network it is.
Never give your email password or bank details on a Wi-Fi sign-in page.
Check for the padlock and "https" before typing anything personal.
Use mobile data, not public Wi-Fi, for banking and payments.
Do not click past browser security warnings.
Turn off file and nearby sharing while out.
Forget the network when you leave.

Public Wi-Fi Safety Guide: Plain-English Steps to Stay Safe