Public WiFi risks and dangers

Many “public WiFi dangers” lists are outdated. Here are the risks that still matter, what each looks like, and what to do.

Short answer

The main public WiFi risks today are lookalike (evil-twin) networks, fake sign-in pages, DNS tampering, hidden proxies, apps that don’t encrypt, auto-join to old network names and open file sharing. Most are avoided by joining the exact network, using HTTPS, never ignoring certificate warnings and checking the network before anything sensitive.

The 7 risks, and what to do

1. Evil-twin network	A copy of a trusted name (CISA). Do: confirm the exact name with staff.
2. Fake sign-in page	A captive portal that asks for passwords or a card. Do: check the page address; free WiFi never needs your bank login.
3. DNS tampering	The network answers address lookups with unexpected addresses. Do: compare DNS answers with a trusted resolver; heed certificate warnings.
4. Hidden proxy	Traffic is relayed through a middle server. Do: look for an unexpected proxy before signing in to accounts.
5. Unencrypted pages and apps	Plain http pages can be read or changed on the way. Do: use HTTPS; avoid typing anything on http pages.
6. Auto-join	Your phone silently joins any network with a saved name. Do: turn off Auto-Join and forget networks you’re done with.
7. Sharing left on	File sharing or AirDrop open to everyone. Do: limit sharing to contacts on public networks.

Risks that are smaller than people think

“Someone can read everything I do.” Not on encrypted sites and apps. They can see which services you connect to, not the content (FTC).
“Joining WiFi lets someone into my phone.” Joining a network doesn’t hand over control. Keep your phone updated and don’t install profiles or apps a hotspot asks for.

The quick routine

Confirm the exact network name with staff, a sign or the venue’s website. Similar names are not the same network.
Complete any sign-in page only if its address belongs to the venue or its WiFi provider. Never type a card number for “free” WiFi.
Check the network: sign-in finished, DNS answers match trusted DNS, certificates valid, no unexpected proxy.
Use apps and HTTPS sites. Stop if a site you know shows a certificate warning.
Turn off Auto-Join for networks you won’t use again.

Frequently asked questions

What is the biggest risk of public WiFi?

Being tricked rather than being “hacked”: joining a lookalike network or entering details into a fake page. Both are avoided by checking the network name and the page address.

Can public WiFi give my phone a virus?

Simply joining a network doesn’t install anything. Malware usually needs you to install something, so decline any profile, certificate or app a WiFi page tells you to install.

Do I need a VPN on public WiFi?

Not for every task. The UK NCSC calls VPNs one way to protect data across untrusted networks. Use one for work or sensitive tasks, or use mobile data.

Sources

Last checked: 2026-10-14. SentryFi is not affiliated with the venues, brands or providers named on this page.