How to Stay Safe on Public Wi-Fi: 9 Simple Rules

Originally published on CodingCush.

Public Wi-Fi is safer than it used to be, because most websites now encrypt what you send. It is not, however, completely safe. The real risks today are fake networks with friendly names, snoops on badly run hotspots, and your own device happily rejoining networks it should have forgotten. Nine simple rules, none of them technical, will protect you in coffee shops, airports, hotels and trains.

Why Public Wi-Fi Deserves a Little Respect

At home, you know who runs the network and who else is on it. In a cafe, you know neither. Everyone connected to that hotspot is, in a small way, sharing a room with your device. Most of those people are just drinking coffee. But the setup makes a few classic tricks possible: a criminal creates a hotspot called "Airport Free Wi-Fi" and waits for phones to join, or sits on a real network and tries to peek at traffic from older or badly configured sites. The good news is that these tricks mostly fail against a device with sensible settings, which is exactly what the rules below give you.

This guidance matches what official bodies tell the public. CISA, the United States cyber defense agency, shares practical habits on its Secure Our World pages on cisa.gov, and the rules below follow the same spirit: simple steps, big effect.

The website of CISA (cisa.gov), America's Cyber Defense Agency, whose cybersecurity best practice guidance these public Wi-Fi rules follow.

What a Snooper on the Same Network Can and Cannot See

It helps to know exactly what the person at the next table could theoretically observe. They can usually see that your device is connected, the names of websites you visit, and how much data you move. On properly encrypted pages (HTTPS), they cannot read the content: not your messages, not your passwords, not your card numbers. On old unencrypted pages, everything is readable, which is why such pages should never receive a password from you. They also cannot magically reach inside your phone; the popular trick is not direct hacking but deception, a fake network or fake login page hoping you hand over the goods yourself.

One more modern wrinkle: the sign-in page that pops up when you join a hotspot is called a captive portal. Treat it as a stranger. Never type your email password, bank login or social media credentials into a Wi-Fi portal page; a legitimate one only needs a room number, a simple code from the counter, or a plain tap to accept the terms. If a portal asks for more than that, walk away from the network and use your mobile data instead.

The 9 Rules

Rule 1: Confirm the exact network name before you join

Ask the staff, or read the sign at the counter. If two similar names appear, one of them may be a trap with better signal strength. Thirty seconds of checking defeats the oldest trick in the book.

Rule 2: Prefer your mobile data for banking and payments

Your phone connection is a private road; public Wi-Fi is a shared bus. For banking, shopping checkouts and anything involving money, switch Wi-Fi off and use mobile data. Save the cafe network for news, maps and videos.

Rule 3: Use a VPN when you must work on public Wi-Fi

A VPN wraps all your traffic in encryption, so even a snooper on the same network sees only scrambled data. Our explainer on what a VPN is and whether you need one helps you choose sensibly, including why free VPN apps deserve suspicion of their own.

Rule 4: Look for the padlock, every time

Only type passwords or card details on pages showing https and the padlock icon. If the browser warns that a site is not secure, believe it and leave. No login is worth that gamble.

Rule 5: Turn off auto-join and forget networks afterwards

Phones love rejoining networks they remember, including lookalike traps using the same name. Switch off auto-join for public networks, and when you leave, choose "forget this network" so tomorrow's connection is a decision, not an accident. Apple explains its own Wi-Fi privacy features, including rotating private addresses, in its Support guidance on privacy information for Wi-Fi networks.

Rule 6: Switch off sharing while you are out

File sharing, printer sharing and features like AirDrop set to "everyone" are for home. On a laptop, choose the Public network profile when Windows asks, which tightens the built-in firewall automatically. Our guide on what a firewall is and how it protects you explains what that profile changes.

Rule 7: Keep two-factor authentication on for important accounts

If a password ever does leak, a second step (a code or a tap on your phone) keeps the account yours. Email, banking and social accounts deserve this protection most, on public Wi-Fi and everywhere else.

Rule 8: Update before you travel, not on the cafe network

Install system and app updates at home, where the connection is trusted. Updates close the holes that network attacks rely on, and downloading them on a strange hotspot adds risk for no benefit.

Rule 9: Log out when you finish

Do not stay permanently signed in to sensitive accounts on a shared connection. Log out, close the tab, and let the session end properly. This pairs well with the wider habits in our guide on how to protect your phone from hackers, because the phone is the device most of us carry onto public networks.

A Quick Risk Table: What Is OK and What Can Wait

One Last Upgrade: Carry Your Own Connection

If you travel often for work, the cleanest escape from public Wi-Fi worries is to stop depending on it. The hotspot feature on your own phone turns your mobile connection into a private network for your laptop, with a password only you know. A travel eSIM or a local data plan usually costs less than one airport coffee per day of a trip, and it removes fake hotspots, captive portals and fellow-traveller snooping from your life entirely. Public Wi-Fi then becomes what it should always have been: a backup for casual browsing, never the network your important accounts depend on.

Frequently Asked Questions

Is public Wi-Fi safe now that most sites use HTTPS?

Safer, yes; completely safe, no. HTTPS protects the content of your visit to proper websites, but fake hotspots, captive login pages that harvest details, and your own device settings still create risks. The nine rules close those remaining gaps.

Can someone see my passwords on public Wi-Fi?

On a correctly encrypted (HTTPS) page, no: they would see scrambled data. The danger is a fake page or a fake network convincing you to type the password somewhere unprotected, which is why confirming the network name and watching for the padlock matter.

Is hotel Wi-Fi safer than cafe Wi-Fi?

Not especially. A password on the door does not make the network private, because every guest shares it. Treat hotel Wi-Fi exactly like cafe Wi-Fi and follow the same rules.

Does a VPN make public Wi-Fi completely safe?

It makes the connection itself far safer by encrypting everything, but it cannot stop you logging in to a fake website or downloading a bad file. Think of it as a strong lock, not a bodyguard.

The Short Version

Confirm the network name, keep money matters on mobile data, use a VPN for work, demand the padlock, and tell your phone to forget public networks when you leave. Add updates, two-factor authentication and the public firewall profile, and public Wi-Fi becomes what it should be: a convenience, not a risk. Nine small habits, zero cost, and you can enjoy the coffee in peace.