How to Stay Safe on Public Wi-Fi: 10 Steps for Laptop and Phone

To stay safe on public Wi-Fi, confirm the exact network name with staff, stick to websites and apps that use encryption (HTTPS), turn off file sharing and automatic connections, keep your devices updated and use a reputable VPN or your phone’s hotspot for anything sensitive. Modern encryption has made cafe and airport Wi-Fi far less risky than it used to be, but fake hotspots, snooping on the local network and phishing login pages are still real problems. The ten steps below cover both laptops and phones, with the settings you need.

Why public Wi-Fi is riskier than your home network

On your home network you control who connects. On a public network, anyone in range can join, and you usually cannot tell who runs the router. The main risks are:

Evil twin hotspots: a fake network with a convincing name such as “Airport_Free_WiFi” that lets the owner watch or redirect your traffic.
Open networks: networks without a password do not encrypt the connection between your device and the router, so unencrypted traffic can be read by others nearby.
Local network exposure: other devices on the same network can see shared folders, printers or services your laptop advertises.
Fake login pages: captive portals that ask for an email password or card details they have no reason to need.

Ten practical steps

Confirm the network name. Ask staff for the exact name and password, or check a sign at the counter. If you see two similar names, do not guess. Be wary of networks that have no password in a place that normally uses one.
Choose “Public” on Windows. When Windows asks, pick a public network profile. To check later, go to Settings > Network & internet > Wi-Fi > the network’s properties and set Network profile type to Public. This hides your PC from other devices on the network.
Turn off sharing on a Mac. Open System Settings > General > Sharing and switch off File Sharing, Screen Sharing and anything else you do not need while out. Set AirDrop to Contacts Only or Receiving Off.
Keep the firewall on. Windows Defender Firewall is on by default; leave it that way. On a Mac, go to System Settings > Network > Firewall and turn it on.
Look for HTTPS and use apps from official stores. Most sites now encrypt traffic, shown by a padlock or the absence of a “Not secure” warning in the address bar. Never type passwords or card numbers on a page your browser marks as not secure. Banking and shopping apps from official app stores encrypt their traffic too.
Use a reputable VPN for extra protection. A VPN encrypts everything between your device and the VPN provider, which protects you on open networks and from a dishonest hotspot owner. Pick a well-known paid service or one built into your security suite, and avoid unknown free VPN apps that may collect and sell your data.
Use your phone’s hotspot for sensitive tasks. Your mobile data connection is generally safer than a shared network. For banking, tax returns or work logins, a personal hotspot protected with a strong password is often the simplest option.
Stop automatic connections. On iPhone, open Settings > Wi-Fi, tap the info icon next to a network and turn off Auto-Join. On Android, open Settings > Network & internet (or Connections) > Wi-Fi, tap the network and turn off auto-connect, or choose Forget. On Windows and Mac, remove old public networks from your saved list so your device does not join a lookalike later.
Turn on two-step verification. If a password is ever stolen, a second step such as an authenticator app or passkey stops most account takeovers. Set it up at home for email, banking, cloud storage and social accounts.
Keep everything updated. Install system, browser and app updates before you travel. Updates close security holes that attackers on a shared network could otherwise use.

Captive portals and login pages: what is normal

Many hotels, airports and cafes show a sign-in page before you get internet access. It is normal for it to ask you to accept terms, enter a room number and last name, or give an email address. Be cautious if a portal asks for:

Your Google, Microsoft or Apple account password
Card details for a network that is supposed to be free
Permission to install an app, profile or “security certificate”

If something feels off, close the page and use your phone’s hotspot instead.

Phone-specific tips

Keep private Wi-Fi addresses on. iPhones and recent Android phones use a random hardware (MAC) address for each network, which makes it harder to track you between locations. It is usually on by default; check in the network’s settings.
Turn off Wi-Fi when you do not need it. This prevents your phone from quietly joining networks in busy places.
Be careful with app downloads prompted by a network. No legitimate cafe needs you to sideload an app. If you think your phone picked up something unwanted, these steps to remove malware from an Android phone walk through the cleanup.

Laptop-specific tips

Lock your screen when you step away (Windows key + L on Windows, Control + Command + Q on a Mac).
Turn on disk encryption. Use BitLocker or Device Encryption on Windows and FileVault on a Mac, so a stolen laptop does not expose your files.
Avoid unknown USB charging stations and flash drives. Use your own charger plugged into a wall outlet.
Keep the browser lean. Remove extensions you no longer use, since a malicious extension can read pages regardless of how secure the network is. If you are choosing a travel or school machine, a comparison of Chromebooks and cheap Windows laptops covers how each handles updates and security.

Common mistakes to avoid

Assuming a password-protected network is private. If the password is printed on the wall, everyone in the room shares it.
Ignoring browser certificate warnings. If your browser says a connection is not private, stop and leave the page.
Leaving file sharing and AirDrop wide open after a work session.
Handing out your real phone number for Wi-Fi sign-ups. A virtual phone number can cut down on spam if a portal insists on one.

Quick answers

Is it safe to do online banking on public Wi-Fi?

Banking apps and websites encrypt your connection, so the risk is lower than it once was. Still, a fake hotspot or phishing page can trick you, so the safer choice is your phone’s mobile data or a hotspot, or a reputable VPN if you must use public Wi-Fi.

Do I need a VPN if a site already uses HTTPS?

HTTPS protects the content of what you send to that site. A VPN adds protection for the rest of your traffic, hides which sites you visit from the local network and helps on open networks. It is a useful extra layer, not a requirement for every visit.

Can someone hack my phone just because I joined public Wi-Fi?

On an up-to-date phone, simply joining a network is very unlikely to lead to a takeover. The bigger risks are entering details on a fake page or installing something the network prompts you to download. Keep your software updated and do not install apps or profiles from a Wi-Fi page.

How do I know if I connected to a fake hotspot?

Warning signs include a duplicate network name, no password where there normally is one, certificate warnings in your browser and login pages asking for account passwords. If you notice any of these, disconnect, forget the network and change any password you entered.