The Real Dangers of Public Wi-Fi (And How to Stay Safe)

The free Wi-Fi at your favourite café seems harmless. So does the airport lounge connection or the hotel network you use while travelling. But public Wi-Fi networks are among the most dangerous environments for your digital security — and most people have no idea what they are exposing themselves to every time they connect.

Why Public Wi-Fi Is Inherently Risky

Most public Wi-Fi networks share two critical characteristics that make them dangerous:

1. Open or weakly authenticated access — Anyone can connect. There is no vetting of who else is on the same network.
2. Shared broadcast domain — All devices on the same Wi-Fi network can potentially "see" each other's traffic at the network layer, depending on the network's configuration.

This combination creates a fertile environment for a range of attacks, from passive eavesdropping to active interception.

The Main Threats on Public Wi-Fi

1. Evil Twin Attacks

This is one of the most common and effective attacks on public Wi-Fi. An attacker sets up a rogue access point with the same name (SSID) as the legitimate network — "Airport Free WiFi," "Starbucks," or "Hotel_Guest." Your device, which automatically connects to known networks, may join the attacker's hotspot without any warning.

Once connected through the evil twin, all your traffic passes through the attacker's machine. They can see everything you send and receive — including credentials if the sites you visit do not properly enforce HTTPS.

2. Man-in-the-Middle (MitM) Attacks

In a MitM attack, the attacker positions themselves between your device and the legitimate network gateway. Your traffic flows through them, allowing them to read, modify, or inject data. Techniques like ARP spoofing allow attackers to redirect traffic even on networks that appear legitimate.

A successful MitM attack can:

• Steal session cookies, allowing attackers to hijack your accounts without needing your password
• Inject malicious content into web pages you visit
• Strip HTTPS from connections (SSL stripping) if your browser does not enforce HSTS
• Capture credentials submitted on non-HTTPS forms

3. Packet Sniffing

On networks without proper isolation, a device in "promiscuous mode" can capture all network traffic passing through the shared medium. Sophisticated attackers use tools like Wireshark to capture and analyse these packets in real time.

While modern HTTPS encryption protects the content of most web traffic, metadata remains visible: which domains you connect to, when, and how frequently — enough to build a meaningful profile of your activity.

4. Malware Distribution

Some attackers compromise the Wi-Fi network itself — either the router or the network's DNS server. From this position, they can redirect users to fake versions of legitimate sites designed to install malware or steal credentials. In 2022, a series of attacks at European hotel chains compromised their guest networks to deliver malware via fake Windows update prompts.

5. Session Hijacking

Many websites issue session tokens after you log in. If an attacker can capture this token (from unencrypted HTTP traffic or via cookie theft), they can use it to impersonate you on that site without knowing your password. They do not need to steal your credentials — just the session cookie that proves you already authenticated.

What HTTPS Does (and Does Not) Protect

You may feel safer because the site you are visiting shows a padlock and uses HTTPS. HTTPS encrypts the content of your connection — the data you send and receive. An attacker who intercepts your traffic can see that you connected to "bank.com" but cannot see what you typed or what the bank sent back.

However, HTTPS does not protect:

• The domain names you visit (visible in DNS queries, though DNS-over-HTTPS mitigates this)
• The timing and size of requests (useful for traffic analysis)
• Your IP address (always visible to network observers)
• Connections to sites that still use HTTP (increasingly rare but not zero)

How to Protect Yourself on Public Wi-Fi

Use a VPN — Always

A VPN (Virtual Private Network) creates an encrypted tunnel from your device to the VPN server before any traffic reaches the public internet. An attacker who intercepts your traffic on public Wi-Fi sees only the encrypted VPN tunnel — indecipherable without the encryption keys.

With a VPN active, even a successful evil twin attack reveals nothing useful to the attacker. This is the single most effective protection for public Wi-Fi use.

See our VPN comparison guide for trusted options.

Forget Networks When You Leave

Configure your device not to auto-reconnect to previously used Wi-Fi networks, especially open ones. An evil twin attack relies on your device automatically joining a network it "remembers." On iPhone: Settings → Wi-Fi → tap the network → "Forget This Network." On Android, the option is in Wi-Fi settings per network.

Use HTTPS-Only Mode

Modern browsers offer an HTTPS-only mode that prevents any connection to HTTP sites. In Chrome, go to Settings → Privacy and Security → Security → Advanced → "Always use secure connections." In Firefox, go to Settings → Privacy & Security → HTTPS-Only Mode.

Disable File Sharing and AirDrop

On macOS and Windows, turn off file sharing and network discovery when on public networks. On iPhone, set AirDrop to "Contacts Only" or "No one" in public.

Use Your Phone's Hotspot Instead

When security matters — banking, work email, sensitive documents — use your mobile data connection as a personal hotspot rather than connecting to public Wi-Fi. Mobile connections are encrypted by default and not shared with strangers.

Enable Two-Factor Authentication

Even if an attacker steals your session cookie or password on public Wi-Fi, 2FA prevents them from logging into new sessions on your accounts. Enable it on all important accounts, especially email, banking, and work tools.

Is Hotel Wi-Fi Safer Than Café Wi-Fi?

Not necessarily. Hotel networks are often larger and more complex, which actually creates more attack surface. Hotel networks have been targeted in high-profile campaigns specifically because business travellers use them to access sensitive corporate systems. A password-protected hotel network is not meaningfully safer than an open café network — anyone who can obtain the password (which is often publicly displayed) has access.

The Bottom Line

Public Wi-Fi is convenient, ubiquitous, and genuinely useful. The goal is not to avoid it entirely but to use it safely. With a VPN active and HTTPS-only mode enabled, the risk of using public Wi-Fi drops dramatically. Without these protections, connecting to a café network is like having a conversation in a crowded room where anyone might be listening.

Invest five minutes setting up a reliable VPN before your next trip. It is one of the best investments you can make in your digital security.