Airport lounges, hotel lobbies, coffee shops, libraries — free WiFi is everywhere, and most people connect without a second thought. The problem: public WiFi networks are shared with strangers, often unencrypted, and sometimes operated by people whose interests don’t align with yours. Using public WiFi safely doesn’t mean avoiding it entirely — it means applying a small number of habits that eliminate the most serious risks while keeping the convenience. We go deeper on the whole subject in our Complete Guide to Online Security and Privacy.
The difference between connecting carelessly and connecting correctly takes about 60 seconds per session.
The VPN — the single most effective protection
A VPN encrypts all traffic between your device and the VPN server before it leaves your device. Anyone observing the public WiFi network — the operator, other users, passive eavesdroppers — sees only encrypted noise rather than your actual traffic. Without a VPN, HTTPS protects the content of individual websites but doesn’t hide which websites you’re visiting, and unencrypted HTTP traffic is fully readable by anyone on the network.
The correct connection sequence: join the public WiFi network → open the VPN app → connect to a server → then open your browser, email, or any other app. Reversing this — connecting to WiFi, opening apps, then connecting the VPN — means some traffic has already been transmitted unprotected. The VPN must be the first connection established after joining the network.
Choose a VPN provider with a no-logs policy that has been independently audited — Mullvad, ProtonVPN, and ExpressVPN are the established choices. Free VPN services are almost universally problematic: most monetise user data in ways that defeat the privacy purpose, and some have been documented actively selling user traffic logs. The cost of a reputable VPN (~$5–10/month) is the cost of using public WiFi safely and consistently. Our guide on setting up a VPN covers provider selection and configuration in detail.
Verifying the network before connecting
Evil twin attacks — where an attacker sets up a fake access point with a name identical or similar to the legitimate one — are the most direct threat. Connecting to an evil twin provides the attacker with full visibility of all your network traffic. The attack is trivial to execute with inexpensive hardware.
Before connecting: ask a staff member for the exact network name (SSID) rather than guessing which available network is correct. A coffee shop with multiple visible networks — “Starbucks WiFi,” “STARBUCKS_SECURE,” “Starbucks Free WiFi” — creates the ambiguity an evil twin exploits. If asking isn’t practical, look for posted WiFi credentials on a sign or receipt. Two seconds verifying the SSID is the difference between the legitimate network and an attacker’s access point.
Captive portal caution: a legitimate captive portal (the page asking you to accept terms or enter a code) is normal. What’s suspicious: a portal asking for payment card information on a supposedly free network, or requesting credentials from personal accounts. Submit only the minimum required — email address for newsletter-gated WiFi is common and low-risk. After clearing the portal, connect your VPN immediately — most VPNs can’t connect until captive portal authentication is complete.
What to do and what to avoid
Safe to do on public WiFi with a VPN active: general web browsing, streaming, social media, reading news, light email, video calls through apps that use their own encryption (Signal, WhatsApp, Zoom). The VPN handles network-level exposure, and application-level encryption provides a redundant layer.
Better to avoid or defer to a private connection: completing financial transactions, entering new payment card details, logging into accounts you’ve never logged into on this device (may trigger security alerts), accessing sensitive work systems that explicitly prohibit public network access.
File and printer sharing should be disabled before connecting to any public network:
- Windows: Settings → Network & Internet → WiFi → the connected network → set network profile to “Public” — this disables network discovery and file sharing automatically without affecting internet access
- Mac: System Settings → Network → the connected network → Details → set location to a profile with sharing disabled
The “Public” network profile in Windows is worth confirming every time, because Windows sometimes incorrectly identifies a hotel or enterprise guest WiFi as a “Private” or “Domain” network based on its DHCP configuration — which re-enables the more permissive sharing rules that allow inbound connection attempts from other devices on the same network.
Mobile devices — the auto-reconnect problem
Mobile devices automatically reconnect to previously-joined networks without explicit user confirmation. A phone that previously connected to “Hotel WiFi” at one property will automatically connect to any network broadcasting “Hotel WiFi” — including a nearby evil twin with the same name.
After using a public WiFi network: use “Forget network” rather than just disconnecting. This removes the credential from the auto-join list entirely, preventing future automatic reconnection to any network broadcasting the same name.
- iPhone: Settings → WiFi → the network → “Forget This Network”
- Android: WiFi settings → the network → Forget
If you can’t forget immediately: at minimum, toggle “Auto-Join” off (iPhone) or “Auto-connect” off (Android) for the network before leaving.
Mobile hotspot is the most private alternative for sensitive activities. Your phone’s mobile data connection is a private point-to-point connection between your device and the carrier — it doesn’t share a medium with other users in the same physical space the way public WiFi does. For brief sensitive tasks (financial account access, work systems), using your phone as a hotspot eliminates the public WiFi safety problem entirely by removing the shared network from the equation.
HTTPS alone vs VPN — what each protects
A common misconception: “I only visit HTTPS sites, so I’m safe on public WiFi.” HTTPS encrypts traffic content between the browser and the web server but doesn’t hide which domains you’re visiting. DNS queries — the lookups that resolve domain names to IP addresses — travel unencrypted without additional configuration, making your browsing destinations visible even when traffic content is encrypted.
Enable DNS over HTTPS in your browser as a partial fix when no VPN is available:
- Chrome: Settings → Privacy and security → Security → Use secure DNS
- Firefox: Settings → Privacy & Security → DNS over HTTPS
DNS over HTTPS encrypts domain lookups, hiding browsing destinations from local network observers. It’s not a substitute for a VPN (which encrypts all traffic, not just DNS), but it fills a specific gap that HTTPS alone doesn’t address.
High-risk environments and high-risk individuals
Airports, conference centres, and hotel networks at major industry events are specifically targeted because of the concentration of business travellers with valuable accounts. Apply the standard practices above at heightened diligence: VPN connected before any app opens, SSID verified with staff, file sharing disabled, “Forget network” used at departure.
Corporate travellers: many organisations prohibit using public WiFi for corporate access entirely — not because the security measures can’t be applied, but because VPN failure windows and device-specific vulnerabilities make an absolute rule simpler than case-by-case risk assessment. If your employer’s policy permits public WiFi with a VPN, treat that as a minimum floor, not a maximum ceiling — add the device-level protections above on top of the employer-mandated VPN.
For journalists, activists, lawyers, and others with specific threat profiles where network-level surveillance by sophisticated adversaries is a genuine concern: the Tor Browser over a VPN (connect to VPN first, then use Tor) provides layered protection that makes traffic analysis significantly more difficult. Our guide on private browsing mode covers when private browsing is sufficient versus when additional tools are warranted. For the technical background on WiFi eavesdropping techniques, the EFF’s security resources provide technically accurate threat descriptions without vendor promotion.
Using public WiFi safely ultimately requires two things working together: a VPN that encrypts your traffic before it touches the shared network, and the habit of verifying the SSID before connecting. Everything else in this guide — file sharing settings, DNS over HTTPS, auto-join control — adds layers on top of that foundation. With those two habits in place, public WiFi provides the convenience it promises without the security exposure that default connection behaviour creates.
Windows Defender Firewall on public networks
Windows Defender Firewall is set to the more restrictive “Public network” profile automatically when Windows detects a public network type. Confirm this is active: Control Panel → Windows Defender Firewall → confirm “Public networks” shows as “Connected” with the firewall active. For Windows machines where the network profile was incorrectly set to “Private” or “Domain” on a public network — which can happen if you accepted default settings on a hotel WiFi previously — resetting it to “Public” re-enables the restrictive firewall rules that block inbound connection attempts from other devices on the shared network.
The 60-second public WiFi connection routine
For users who want this as a practical checklist rather than a guide to read:
- Ask staff for the exact WiFi name (or check the posted sign/receipt)
- Connect to that specific network
- Open your VPN app → connect to a server before opening any other app
- Confirm Windows network profile is set to “Public” if on Windows
- Browse normally — the VPN handles network-level security
- When done: “Forget network” on mobile devices to prevent future auto-reconnect
This routine takes roughly 60 seconds more than connecting carelessly. Against that 60-second cost: protection against eavesdropping, evil twin attacks, and persistent auto-reconnect vulnerabilities. The investment is small; the protection it provides against the most common public WiFi threats is comprehensive for the vast majority of use cases.
Using public WiFi on managed corporate devices
Managed corporate devices (enrolled in MDM through Microsoft Intune, Jamf, or similar) may have WiFi security policies already configured that affect how public networks behave:
- Always-on VPN configurations that connect automatically when non-trusted networks are detected
- Certificate-based WiFi authentication that prevents connecting to networks without valid certificates
- Blocked network profile changes that prevent users from changing the network type from Private to Public
If a corporate device has an always-on VPN policy configured by IT, the VPN may connect automatically when you join a public WiFi network — you don’t need to manually open the VPN app in that scenario. Verify with IT whether this applies to your device: asking whether “always-on VPN” is configured is a reasonable question that IT teams expect and can answer definitively. If it is configured, the connection sequence simplifies to: join the WiFi network and wait for the VPN to connect automatically before proceeding.
Public WiFi safety is ultimately about recognising that the convenience of shared infrastructure comes with shared risk — and that shared risk can be managed with appropriate tools and habits at minimal friction cost. A VPN, verified SSID, and the “Forget network” habit after use are the three actions that address the three principal threats (traffic eavesdropping, evil twin attacks, and auto-reconnect vulnerabilities) that make public WiFi meaningfully riskier than home or cellular connections. If this sounds familiar, Biometric Data Privacy is worth a look.
