Public Wi-Fi is convenient and is not automatically dangerous. Modern websites use HTTPS to encrypt much of the information exchanged with them. The remaining risks depend on the network, your device settings, the sites you visit, and whether you are tricked into giving information to an attacker. A few practical habits can reduce risk without making ordinary browsing complicated.
Before connecting
- Update your operating system, browser, and security software while on a trusted connection.
- Turn off automatic connection to open hotspots if your device keeps joining networks without asking.
- Disable file sharing and network discovery on unfamiliar networks, or mark the network as public in your operating system.
- Ask staff for the exact network name. A fake hotspot can use a name that differs by only one character.
- Use a device screen lock and multifactor authentication on important accounts.
Confirm the network and sign-in page
Hotels, airports, and cafés may redirect you to a captive portal before allowing internet access. Check that the page matches the venue and the information requested is reasonable. A Wi-Fi portal should not need your email password, payment account password, or an installation of an unknown certificate or app. If a page asks you to bypass a browser certificate warning, stop instead of proceeding.
While browsing
Check that sensitive websites use HTTPS and do not ignore certificate warnings. HTTPS protects content in transit between your browser and the website, but does not make a fraudulent website legitimate. Verify the domain before entering credentials. Avoid installing unknown software or opening unexpected attachments just because a network login page recommends them.
A network operator may still observe connection metadata such as timing, traffic volume, and sometimes the services being contacted. DNS visibility depends on the resolver and configuration. A trusted VPN can encrypt traffic between your device and the VPN server, but it transfers some trust to the VPN provider and does not prevent phishing or malware.
Banking and sensitive tasks
If you need to access a financial or work account, use the official app or enter the known website address yourself. Use multifactor authentication and avoid approving login prompts you did not initiate. For highly sensitive activity, mobile data or a trusted personal hotspot may be a simpler choice than a network you cannot verify.
After leaving the network
- Disconnect and choose “Forget this network” if you do not expect to use it again.
- Restore sharing settings to the level you normally use.
- Review account security notifications if anything looked unusual.
- Change a password if you entered it into a suspicious page or believe it was exposed—not simply because you used ordinary HTTPS browsing on public Wi-Fi.
Common questions
Can someone on public Wi-Fi read every website I visit?
Not normally the contents of correctly configured HTTPS pages. Metadata and some network details may still be visible, and unencrypted traffic has fewer protections.
Should I always use a VPN on public Wi-Fi?
A reputable VPN can add protection, especially on a network you do not trust, but keep HTTPS, updates, and account security enabled too.
Is a hotspot with a familiar name safe?
Not necessarily. Attackers can copy a legitimate network name. Confirm the network with staff and watch for suspicious login prompts.
Related KiwiVPN guides
Read What a VPN changes, How to secure your home Wi-Fi, and How to spot phishing.
Further reading
Browse all KiwiVPN guides or return to the public IP checker.