Public Wi-Fi and Your Phone: What Actually Puts You at Risk
A step-by-step public Wi-Fi guide — fake hotspots, captive portal sign-in pages, silent auto-join, the settings to change before you travel, and what a VPN really covers.
Most advice about public Wi-Fi is a decade out of date. The old warning — that anyone nearby can read what you are doing — has largely been solved by encryption that now covers almost the entire web. The risks that remain are different ones, and they are worth knowing precisely, because they are the ones a bit of care actually prevents.
Advertisement
| Before you start | Short answer |
|---|---|
| Can someone on the same Wi-Fi read my messages? | Almost never. Messaging apps and websites are encrypted end to end or in transit. The realistic risks are elsewhere. |
| What is the actual danger? | A fake hotspot you connect to, a fake login page it shows you, and your phone auto-joining networks without asking. |
| Does a VPN fix everything? | No. It hides your traffic from the network. It does nothing about a convincing fake login page or a malicious file you install. |
Advertisement
Step 1 — Understand what changed, and what did not
Years ago, traffic on an open network was often readable by anyone in range. Today the overwhelming majority of websites and apps use encrypted connections, so what a neighbour on the same network sees is mostly which services you connected to, not what you said or did.
That is a real improvement, and it means the old blanket warning is no longer the useful one. Three risks were never fixed by encryption, and those are the ones this guide covers.
Advertisement
Step 2 — Know the three risks that remain
Step 3 — Change four settings before you travel
These take about two minutes in total and remove most of the exposure described above.
- Turn off automatic joining of open networks. On iPhone this sits under Settings → Wi-Fi → Ask to Join Networks. On Android it is usually under Wi-Fi preferences, sometimes named "connect to open networks".
- Turn off Wi-Fi when you are not using it. A device with Wi-Fi off cannot be pulled onto anything.
- Turn off file and device sharing — AirDrop set to Contacts Only on iPhone, Nearby Share limited on Android, and network sharing off on a laptop.
- Check that your phone’s software is up to date before a trip. Network-facing fixes are a routine part of those updates.
Step 4 — Know what a VPN does and does not do
A VPN is genuinely useful and routinely oversold, so it is worth being precise about the boundary.
| A VPN does | A VPN does not |
|---|---|
| Encrypt your traffic between your device and the VPN server, so the network operator sees only that a connection exists. | Stop you typing your password into a convincing fake login page. |
| Hide which sites you are visiting from whoever runs the Wi-Fi. | Protect you from a file or app you choose to install. |
| Let you avoid a hostile or manipulated local network entirely. | Make you anonymous — you are still signed in to your own accounts. |
| Help on a network you have no reason to trust. | Remove the need to check that the hotspot is the real one. |
The practical position: a VPN is worth having on a network you did not choose, and it is not a substitute for the judgement in Steps 2 and 3.
Step 5 — What not to do on a network you do not control
- Do not enter card details on a Wi-Fi sign-in page, for any reason given.
- Do not install an app or certificate a network asks you to install. A certificate in particular can let the network read traffic that would otherwise be private.
- Do not dismiss a security warning to get a page to load. That warning is the one part of the system doing its job.
- Do not use a password on a captive portal that you use anywhere else.
- Prefer mobile data for anything financial. It costs a few megabytes and removes the question entirely.
Step 6 — Clean up when you leave
The last step is the one almost nobody does, and it is what stops the same network name pulling your phone in somewhere else six months later.
- Forget the network in your Wi-Fi settings rather than just disconnecting.
- Turn Wi-Fi off until you are somewhere you trust.
- Review your saved networks occasionally and remove hotel, airport and café entries you will never use again.
Common questions
The six steps in one place
- The old sniffing risk is largely solved; the remaining ones are different.
- Three real risks: a fake hotspot, a fake sign-in page, and silent auto-join.
- Four settings before you travel — auto-join off, Wi-Fi off when unused, sharing off, software updated.
- A VPN hides your traffic, and does nothing about a fake login page.
- Never enter card details on a Wi-Fi sign-in page, or install what a network asks you to install.
- Forget the network when you leave, so your phone does not rejoin its name elsewhere.
