Public Wi-Fi is convenient—and still dangerous. The good news: a VPN plus a few smart habits shuts down most of the risk.

Why public Wi-Fi is still risky

Free networks are everywhere (cafés, hotels, airports, libraries), but they’re often untrusted, misconfigured, or actively abused. Modern HTTPS helps, yet there are still seven common traps—and simple ways to avoid them.

Helpful background:

NCSC (UK): https://www.ncsc.gov.uk/guidance/using-public-wi-fi-safely
EFF: https://ssd.eff.org/

1) Evil-twin hotspots

What: An attacker clones the SSID (e.g., “Airport Free Wi-Fi”) so your device connects to them.
Why it works: Devices auto-reconnect to familiar SSIDs.
Defend: Verify the official SSID, disable auto-join on public networks, and auto-connect your VPN on untrusted Wi-Fi.

2) Captive-portal hijacking

What: Fake splash pages push malware or shady root certificates.
Defend: Never install unknown certificates/profiles. Get online through the portal, then enable your VPN and keep it on.

3) ARP spoofing & local MITM

What: A local attacker impersonates the gateway to intercept traffic.
Why VPN helps: A VPN encrypts every packet to the VPN server, making captures useless.
Defend: Use a kill switch (block internet without VPN) and HTTPS-Only mode where possible.

4) Rogue DNS / DNS poisoning

What: The network forces malicious DNS that returns fake IPs.
Why VPN helps: Good VPNs tunnel DNS to private resolvers (or DoH/DoT).
Defend: Use VPN private DNS and verify with a DNS leak test: https://www.dnsleaktest.com/

5) Session hijacking (cookies/tokens)

What: If session cookies leak, attackers can impersonate you.
Defend: Keep the VPN on, use MFA, and avoid sensitive logins on sketchy Wi-Fi when you can wait.

6) Transparent proxies & SSL inspection

What: Some networks log/alter traffic or perform TLS inspection using a root CA they control.
Defend: A VPN wraps traffic so proxies can’t see inside. Don’t install unknown root CAs; if required, use your mobile hotspot.

7) Malware via local sharing / fake updates

What: LAN “sharing” prompts, fake updates, or malicious downloads through captive pages.
Defend: Disable local sharing (AirDrop/Nearby Share) on public Wi-Fi and only update via official stores.

10-minute café checklist

Turn off auto-join for public SSIDs.
Verify the SSID with staff/signage.
Pass the portal → enable VPN and leave it on.
Enable kill switch + auto-connect on untrusted Wi-Fi.
Use HTTPS-Only mode.
Test DNS leaks: https://www.dnsleaktest.com/
Keep OS & apps updated; use MFA.
Prefer privacy browsers; Brave’s WebRTC controls: https://support.brave.com/hc/en-us/articles/360058973371-How-do-I-prevent-WebRTC-leakage
Don’t install portal certificates.
If it feels off, tether or leave the network.

Bottom line

Public Wi-Fi is survivable. A VPN neutralizes most LAN-level attacks and DNS tampering, while good hygiene (MFA, updates, verified SSIDs) handles the rest.

Public Wi-Fi in 2025: 7 Traps—and How a VPN Actually Helps