Key Takeaways
Why Public Wi-Fi Is Riskier Than It Looks
Grabbing Wi-Fi at a coffee shop, airport, or hotel feels routine — and that familiarity is exactly what makes it dangerous. Most users assume that because a network has a recognisable name or requires a password, it's reasonably safe. In practice, public Wi-Fi environments are among the easiest places for an attacker to observe, redirect, or interfere with your internet traffic.
The threats aren't theoretical. Network-level attacks on public Wi-Fi have been documented across security research for years, and the underlying vulnerabilities — open encryption, shared infrastructure, and user complacency — haven't gone away. Understanding what's actually at risk helps you make smarter decisions about what you do (and don't do) when you connect.
For context on how these risks compare to your home setup, see our guide to home network security vulnerabilities.
Unencrypted traffic on open networks
Many public Wi-Fi networks — particularly those without a password — transmit data without encryption. This means anyone on the same network running packet-capture software can potentially read unencrypted data passing between your device and the router. While most modern websites use HTTPS to encrypt the content of web requests, metadata such as which sites you're visiting, connection timestamps, and DNS queries may still be visible.
Even password-protected public networks often use a shared key, meaning every user on the network holds the same credential. That shared key can be used to decrypt other users' traffic in certain Wi-Fi security configurations, particularly older WEP or WPA networks.
On shared-key networks, your traffic may be visible to every other user in the room.
Evil twin and rogue hotspot attacks
One of the most effective public Wi-Fi attacks involves an attacker creating a hotspot with a name that mimics a legitimate network — for example, "AirportFreeWiFi" instead of the airport's actual network. Devices that auto-connect to familiar-looking SSIDs (the technical name for a network's name) can join these rogue networks without any user action.
Once connected, all traffic flows through the attacker's equipment. They can monitor unencrypted requests, intercept credentials on non-HTTPS pages, and in some cases serve modified content. Because the network appears functional, users rarely notice anything is wrong.
A convincing fake hotspot is invisible to most users — your device may connect automatically.
Session hijacking and cookie theft
When you log in to a website, your browser stores a session cookie — a small token that keeps you authenticated without requiring a password on every page load. On an unprotected or partially protected network, an attacker can sometimes capture this cookie and use it to impersonate you on that service, without ever needing your password.
This technique, known as session hijacking, is effective even on sites using HTTPS if the cookie is transmitted insecurely or if the attacker can manipulate the connection at the network layer. Services that still allow HTTP fallbacks are particularly vulnerable.
Stealing your session cookie can give an attacker access to your accounts without your password.
DNS manipulation and traffic redirection
When you type a web address, your device uses the Domain Name System (DNS) to translate that address into a server IP. On a public network, the DNS server you're directed to is typically controlled by the network operator. A malicious operator — or an attacker who has compromised the router — can manipulate DNS responses to redirect you to a lookalike site designed to harvest your credentials.
This type of attack is difficult to detect because the fake site may look identical to the real one. Using a trusted, encrypted DNS service (such as DNS-over-HTTPS) can reduce this risk, as can a reputable VPN that handles DNS resolution separately.
DNS manipulation can send you to a convincing fake site before your browser loads a single pixel.
Auto-connect and device fingerprinting
Most phones and laptops remember networks they've connected to and will automatically rejoin them when in range. This feature is convenient at home but becomes a liability in public. Your device broadcasts the names of saved networks as it searches — a passive listener can capture these probe requests to build a profile of where you've been and, in some cases, trick your device into connecting to a rogue network masquerading as one it knows.
Disabling auto-connect for public networks, periodically clearing your list of saved networks, and turning off Wi-Fi when not in use are simple steps that meaningfully reduce passive exposure. Many devices also allow you to enable "randomized MAC address" settings, which help prevent your device from being uniquely identified across different locations.
Your device advertises every network it's ever joined — even when you're not actively connecting.
File sharing and local network exposure
Many operating systems enable file sharing, AirDrop, or network discovery features by default. These settings make sense on a trusted home network but create unnecessary exposure on public Wi-Fi, where other connected users are strangers. A device that announces itself as discoverable can become a target for unsolicited file transfers, network scanning, or exploitation of sharing-protocol vulnerabilities.
Before connecting to any public network, check that file and printer sharing is disabled, AirDrop or equivalent is set to "contacts only" or off, and that your device's firewall is active. Most operating systems offer a "public network" profile that applies these restrictions automatically when selected.
Leaving file sharing active on public Wi-Fi effectively opens a door to every stranger on the network.
Reducing Your Exposure on Untrusted Networks
No single measure eliminates all risk on public Wi-Fi, but a layered approach makes opportunistic attacks much harder to pull off. The goal isn't perfection — it's raising the cost of targeting you above what most attackers are willing to invest.
Use a VPN as your first line of defence
A reputable VPN (Virtual Private Network) encrypts all traffic between your device and the VPN server, making most local network interception attacks ineffective. Enable your VPN before joining any public network, and keep it active for the duration of your session. Look for a VPN that uses modern encryption protocols and has a clear, independently audited no-logs policy.
For a broader look at your overall connectivity posture, our home network audit checklist covers twelve areas worth reviewing even if you only ever use your own router. And if you're interested in how browser tools factor in, browser extensions and privacy risks is worth a read before your next install.