Staying safe on public Wi-Fi

You can use public Wi-Fi safely by making sure you are on the real network, keeping your traffic encrypted, and turning off the settings that make your device easy to reach. In practice, that means checking the network name with staff, sticking to HTTPS sites, keeping your devices updated, using a VPN, switching off auto-join and file sharing, and saving sensitive tasks for your mobile data. Most of these steps take a minute to set up, once.

Why public Wi-Fi is different

On your home network you know who else is connected. In a cafe, hotel, airport or co-working space you do not. You share the same local network with strangers, and you trust whoever set up the router. Most websites now encrypt their connections, which has made public Wi-Fi much safer than it once was, but some real risks remain.

The main risks

• Fake hotspots: anyone can set up a network called "Airport Free WiFi" or copy the name of a real cafe's network. This is often called an evil twin. If you join it, the person running it can see where your traffic goes and may try to show you fake login pages.
• Unencrypted connections: sites and apps that do not use encryption send data in a form others on the network can read. This is less common than it was, but it still happens, especially with older apps.
• Sharing settings: file sharing, network discovery and similar settings are fine at home, but on a public network they can make your device visible to everyone else connected.
• Fake sign-in pages: the pages many hotspots show before you get online can be imitated to collect email addresses, passwords or card details.

Before you connect

Ask staff for the exact network name and password, or check a sign at the counter. If you see two networks with almost the same name, ask which one is real.

A network password keeps out casual passers-by, but everyone who has the password shares the same network, so it does not make the connection private. Treat a password-protected cafe network with the same care as an open one.

Be wary of a hotspot sign-in page that asks for more than it should. Unless you are knowingly paying for access, a hotspot has no reason to ask for card details, and no hotspot needs the password to another account, such as your email.

Settings to change once

• Turn off auto-join for public networks, so your device does not connect to a familiar-sounding name without asking you.
• Forget networks you no longer use. Your device remembers the names it has joined, and a fake hotspot can copy one of them.
• Turn off file sharing and printer sharing, and set AirDrop or nearby sharing to contacts only or off.
• On Windows, set public networks to the Public profile, which hides your device from others on the network.
• Keep your firewall switched on.
• Install updates for your operating system, browser and apps. Many updates fix security flaws that could be exploited over a network.

While you are connected

Check for HTTPS. Your browser shows a padlock or a similar sign for encrypted sites, and most browsers can be set to an HTTPS-only mode that warns you before loading a page without encryption.

Use a VPN. A VPN encrypts everything that leaves your device before it reaches the local network, including traffic from apps and the DNS lookups that reveal which sites you visit. That protects your traffic even if the network is not what it claims to be. Turn on the VPN's kill switch, so traffic stops instead of going out unprotected if the connection drops.

Turn on two-factor authentication for your important accounts, especially email, banking and cloud storage. If a password is captured on a fake login page, a second factor makes it much harder to use.

Take warnings seriously. If your browser says a site's certificate is not valid, do not click past the warning on public Wi-Fi. Disconnect and use a different network.

Use your phone for sensitive tasks

Mobile data is usually a safer choice than public Wi-Fi for sensitive tasks such as banking, paying bills or changing passwords, because your connection goes straight to your mobile network rather than through a shared router. If you need your laptop online, use your phone as a personal hotspot, protected by a strong password. That keeps you off the shared network entirely.

A quick routine

• Confirm the network name with staff before you join.
• Set auto-join, sharing and firewall settings once and leave them set.
• Switch on your VPN before you open apps or start browsing.
• Stick to HTTPS sites and stop at certificate warnings.
• Save banking and payments for mobile data, or wait until you are home.
• Disconnect and forget the network when you leave.