Coffee shop and airport Wi-Fi warnings have been repeated so often they've become background noise — unfortunate, because part of the underlying risk is genuine, even if the most dramatic version ("hackers are watching everything you do") oversimplifies the modern picture.
What's Changed Since the Classic Warnings
Older public Wi-Fi warnings focused on unencrypted traffic being intercepted in transit. That specific risk has shrunk significantly because HTTPS encryption is now the default for the overwhelming majority of websites, meaning your traffic's content is encrypted end-to-end even on an open, unencrypted network. A browser padlock icon confirms this per-site.
Risks That Are Still Genuinely Real
- Rogue and fake hotspots, set up with a name resembling the venue's legitimate network. Anyone who connects has traffic routed through the attacker's equipment, opening the door to fake captive-portal login pages designed to harvest credentials.
- Malicious captive portals — the "sign in" page a public network shows before granting access can be spoofed to harvest whatever you enter.
- Unencrypted traffic that still exists on some older or poorly maintained sites, and some app traffic, which remains genuinely exposed on an open network.
- Local network exposure, where other connected devices can potentially reach yours if your device's file sharing or discovery settings are still configured for a "trusted" home network.
A realistic public Wi-Fi checklist
- Confirm the network name with staff rather than connecting to whatever looks closest in the list
- Set your device's network type to "Public" (Windows) rather than "Private," restricting file sharing automatically
- Check for HTTPS on any site handling sensitive information; most browsers now warn before submitting a form over an unencrypted connection
- Use a VPN for an added layer if you regularly handle sensitive information on public networks — particularly useful against rogue hotspots, though it requires trusting the VPN provider with your traffic
- Avoid highly sensitive transactions on public networks if you can reasonably wait for a trusted one
- Turn off Wi-Fi auto-connect for open networks, so your device doesn't silently join one you didn't verify
Does a VPN Make Public Wi-Fi Completely Safe?
A VPN meaningfully reduces network-level risk (rogue hotspots, local exposure, unencrypted-site interception) but doesn't protect against everything — a phishing site is just as convincing over a VPN, and malware already on your device behaves the same regardless of network. Treat it as one solid layer, not a single fix that eliminates the need for the other habits above.
A Balanced Takeaway
Public Wi-Fi today is considerably safer than it was a decade ago, mainly because of how widespread HTTPS has become. That doesn't mean the risk is zero — rogue hotspots, malicious captive portals, and the minority of still-unencrypted sites are real, current risks worth a few minutes of precaution on networks you don't fully trust.
Frequently Asked Questions
Is it safe to check email or browse social media on public Wi-Fi?
For sites using HTTPS, traffic content is encrypted even on an open network, covering the vast majority of everyday browsing. The bigger residual risks are rogue hotspots and fake captive-portal pages, which is why confirming the correct network name with staff is worth doing.
Do I need a VPN every time I use public Wi-Fi?
It's not strictly required for basic browsing given how common HTTPS has become, but it adds a meaningful extra layer against rogue hotspots and local network exposure, particularly useful if you regularly handle sensitive information away from trusted networks.
What is a rogue hotspot?
A Wi-Fi network set up by an attacker, often named to resemble a venue's legitimate network, designed to intercept traffic or present fake login pages to anyone who connects. Confirming the correct network name with staff is the most direct defense.