Public Wi-Fi at coffee shops, airports, and hotels is convenient — and risky. Here's what attackers can realistically intercept on an open network, what HTTPS protects, and why a VPN is still the safest option.
Public Wi-Fi networks — at coffee shops, airports, hotels, libraries, and restaurants — are among the most convenient and most misunderstood security risks in everyday life. The threat model has changed significantly over the past decade: the rise of HTTPS has made many classic public Wi-Fi attacks much harder to execute. But the risk hasn't disappeared, and understanding exactly what is and isn't protected helps you make smarter decisions about when and how to use public networks.
What attackers can realistically do on public Wi-Fi today: a passive eavesdropper on the same network can see unencrypted HTTP traffic (increasingly rare but still exists on some older sites); DNS queries (which sites you're visiting, even if the content is encrypted); and metadata about your connections (timing, volume, which servers you're connecting to). An active attacker who controls the access point — a rogue hotspot attack — can potentially intercept and modify traffic, serve fake login pages, and perform SSL stripping attacks on sites that don't enforce HTTPS strictly.
What HTTPS protects on public Wi-Fi: the content of your communications with any HTTPS site — your login credentials, the pages you view, the data you submit. When you log into your bank on public Wi-Fi over HTTPS, an eavesdropper cannot read your password or account information. This is a significant improvement from a decade ago, when most sites used HTTP and credentials were transmitted in plaintext. Today, over 95% of web traffic is encrypted with HTTPS.
What HTTPS doesn't protect: which sites you're visiting (visible through DNS queries and SNI headers); your IP address; and the metadata of your connections. It also doesn't protect against a rogue access point that intercepts your connection before it reaches the legitimate server. If you connect to 'Airport_Free_WiFi' and it's actually a hacker's hotspot, they can potentially intercept your traffic before it reaches the HTTPS layer — though modern browsers and HSTS (HTTP Strict Transport Security) make this harder than it used to be.
Practical risk assessment: the realistic threat on most public Wi-Fi networks is passive surveillance and metadata collection, not active credential theft. The coffee shop hacker intercepting your bank password is largely a myth in 2026 — HTTPS makes it very difficult. The real risks are: connecting to a rogue hotspot that mimics a legitimate network; using apps that don't use HTTPS for sensitive data (some older apps still don't); and having your browsing metadata collected and correlated.
Best practices for public Wi-Fi: use a VPN whenever possible — it encrypts all your traffic and hides your DNS queries from the network. Verify the network name with staff before connecting (rogue hotspots often use names like 'Starbucks_WiFi' or 'Airport_Free'). Avoid accessing highly sensitive accounts (banking, healthcare) on public Wi-Fi without a VPN. Keep your device's firewall enabled. Turn off automatic Wi-Fi connection in your device settings so your phone doesn't silently join networks you've previously used. Use your phone's cellular hotspot for sensitive work when a VPN isn't available.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.