Use public Wi-Fi with a practical safety routine

Verify what you are joining

A wireless network name is not proof of who operates it. An attacker can choose a familiar name, and a legitimate hotspot can still be poorly configured. Ask the venue for its actual network details and use its documented connection process. Be wary of a sign-in page demanding an unrelated email password or asking you to install a certificate or unknown application.

This routine uses existing device controls and HTTPS. A VPN can provide a useful encrypted path in some situations, but it changes who you trust and is not a substitute for verifying a website.

Reduce unnecessary exposure

1. Keep the operating system and browser updated before travelling. Use a strong screen lock and close applications you do not need during the session.
2. On Windows, use the appropriate public-network profile and keep the firewall enabled. Avoid exposing file sharing or administration services to other hotspot users.
3. Open important services through genuine apps or saved bookmarks. Check the domain and do not bypass certificate warnings to complete a login or payment.
4. Prefer your own mobile connection for a highly sensitive task when practical. If you use an existing approved VPN, confirm its connection status and understand any organisation requirements.

Verify the connection without overselling it

Check that the intended service uses a valid HTTPS connection. That protects the browser-to-service path, not every application or every local discovery protocol on the device. A padlock also does not establish that the site's operator is honest.

If a captive portal is required, complete only the venue's reasonable access steps. Return to the genuine service afterwards rather than entering account credentials into an unexpected redirected page.

Finish the session deliberately

Disconnect when finished, forget an unneeded hotspot and disable automatic joining for unfamiliar networks where your device supports it. Check that local sharing settings remain appropriate when you return to your normal network.

Recognise suspicious changes

Unexpected profile installation, certificate prompts or software downloads are reasons to stop and verify with the venue. Do not accept a major security change just because the network says it is necessary. A short, repeatable routine is more dependable than assuming every public network is unsafe or that one privacy tool makes every action safe.