Public Wi-Fi is not automatically hostile, but you do not control the network; minimise sensitive activity and verify the network before connecting.
Before joining
- Confirm the exact network name with the venue.
- Avoid lookalike networks.
- Disable automatic joining where practical.
- Keep the phone and browser updated.
While connected
- Prefer HTTPS and official apps.
- Avoid installing certificates, profiles or “security” apps offered by the network.
- Use mobile data for banking or high-risk account recovery when possible.
- Turn off file sharing and hotspot discovery features you do not need.
About VPNs
A reputable VPN can protect traffic between the phone and the VPN provider, but it does not make a fraudulent website safe and shifts trust to the VPN service. Free unknown VPN apps can create their own privacy risk.
Afterwards
- Forget the network if you do not need automatic reconnection.
- Check for unexpected sign-in alerts.
- Change a password if it was entered on a suspicious page.
If the network uses a sign-in page
A captive portal may appear before normal browsing. Confirm the venue and domain, provide only the minimum information required and never install a configuration profile or root certificate merely to gain access.
Decide what is safe enough for the network
Encryption reduces risk but does not make an untrusted hotspot suitable for every task.
- Verify the network name with the venue and disable automatic joining.
- Prefer mobile data for banking, password changes and recovery actions.
- Forget the network afterwards and review any certificate, VPN or profile the portal asked you to install.
Official sources
Facts checked: 26 July 2026. Menu paths, safety features, account procedures and network support can change. Recheck the current instructions for the exact device, software version, account and mobile provider before acting.
