Suzanne Kantra/Techlicious generated by ChatGPT
Simply put
-
Stick to sites with HTTPS in the address bar, which encrypts traffic to and from your web browser.
-
Use a VPN to block “man-in-the-middle” attacks, where hackers intercept your traffic before you've reached your destination to steal passwords, credit card numbers, and emails.
-
Never install software or paste a command because a Wi-Fi login page told you to: hackers have been breaking into Wi-Fi equipment at places like hotels and conference centers to push malware and steal logins.
HTTPS now encrypts more than 95% of web traffic, according to Google, so someone sitting two tables over at a coffee shop can no longer casually read your email or your bank balance just by watching the network. That old warning about public Wi-Fi is mostly out of date. What's replaced it is narrower but more serious: attackers breaking into the Wi-Fi hardware itself at hotels and conference centers, and legitimate networks collecting more of your data than you'd expect just to let you online.
Here's what's still worth worrying about, and what isn't.
The 3 real risks of free public Wi-Fi
Honeypot and evil-twin hotspots
A honeypot is a fake hotspot set up with an innocuous-sounding name, like “Free Airport Wi-Fi,” built to capture the data of anyone who connects. An evil twin goes further: it copies the name and login page of a legitimate network, and your device may join it automatically if you've connected to a network with that name before. Phones and laptops routinely reconnect to familiar network names without asking, which is exactly what makes the trick work.
There's also a version of this attack that compromises real hotspots instead of faking one. In July 2026, security firm ReliaQuest reported that attackers had gained administrative control of Wi-Fi gateway equipment at hotels and conference centers in multiple U.S. cities, then used that access to redirect guest traffic to fraudulent Microsoft login pages. Microsoft found that guests on the affected networks were served fake browser and Windows update prompts, a social-engineering technique called ClickFix, that installed malware when clicked. That malware didn't stop at stealing credentials: it pulled browser session cookies and login tokens directly off infected devices, letting attackers into accounts like Microsoft 365 without ever seeing a password.
Don't click “install” or paste a command into a terminal window because a Wi-Fi login page told you to. Legitimate connectivity problems don't get fixed that way.
What HTTPS doesn't hide
HTTPS protects the content of your traffic, what you type and what a site sends back, but it doesn't hide where you're going. Two things about your connection still travel in plain text on most public Wi-Fi: your DNS lookup, which translates a site's name into its address, and the “SNI” field your browser sends when it first connects to a secure site. Both broadcast the domain, so someone on the same network can see you're on your bank's site or a health portal, even though they can't see what you type once you're there. A newer standard called Encrypted Client Hello closes that gap, but it's still rolling out unevenly and isn't yet supported in Safari, so the leak is live for a lot of iPhone and Mac users today.
A smaller, separate risk: some older apps and smart-home companion apps still send data over plain HTTP or don't properly verify they're talking to the real server, which an attacker on the same network could exploit. Browsers now block most old-fashioned unencrypted page elements automatically, so this is less common than it was a decade ago, but it hasn't disappeared.
Captive portals collecting more than a Wi-Fi password
Most public Wi-Fi login pages ask for something before they let you online: an email address, a phone number, or a Facebook or Google login. Retailers, malls, and other venues build guest Wi-Fi specifically to collect contact information for marketing and to sell ad placements on the login page itself. Nobody's hacking you here. The network is doing exactly what it was built to do, just not for your benefit.
There's no fix that avoids this entirely if you want the free Wi-Fi. Using a secondary email address for these logins, and skipping the “sign in with Facebook” shortcut, at least keeps the data from getting tied to your main accounts.
Is a personal hotspot safer than public Wi-Fi?
A personal hotspot is much safer than public Wi-Fi. When you tether to your phone's cellular connection, you're the only one on that network, which prevents you from encountering honeypots or evil twins. It also makes a far less attractive target for hackers than a hotel or conference network, since breaking into one person's hotspot doesn't hand over access to every other guest's traffic the way a shared gateway would.
To keep your phone's hotspot safe, set a strong password, rather than the default, and save it to your password manager.
5 ways to stay safe on public Wi-Fi
Know your network name (SSID) before connecting
Before connecting, confirm the network's actual name with an employee rather than trusting whatever shows up in your Wi-Fi list. Turn off automatic connection to open networks in your device settings, so you're always choosing the network on purpose rather than joining whatever your phone picks for you.
Xfinity's “xfinitywifi” hotspots are a legitimate service that runs off the routers of nearby Comcast subscribers. The same caution still applies: treat it like any other public network. Comcast customers who'd rather not share their router's bandwidth with other Xfinity users can turn that sharing off in their account's Wi-Fi settings.
Keep your connection secure with HTTPS
Stick to sites that use HTTPS, confirmed by the lock icon or “https” in your browser's address bar. It's the baseline protection, but as covered above it doesn't hide which sites you're visiting or secure apps that skip encryption. A VPN covers both.
Use a VPN
A VPN encrypts your entire connection, including your DNS requests, routing them through trusted servers before a compromised hotel gateway ever sees them.
Based on our testing, Surfshark is our Techlicious Top Pick for the best VPN overall: fast, covers unlimited devices, and affordable. NordVPN is the pick if you need rock-solid uptime for work travel, with post-quantum encryption built in as a hedge against future decryption risks. And the free tier of Proton VPN is a solid, no-cost option if you only need to protect one device. For the full comparison, see our guide to the best VPNs for protecting your privacy.
Turn on two-factor authentication, or better, passkeys
Enable two-factor authentication everywhere it's offered, so a stolen password or session alone isn't enough to get into your accounts. Where it's available, a passkey is an even stronger option: it can't be phished or stolen the way a password or a one-time code can, because there's no shared secret to intercept in the first place. Check out the pros and cons of each type of 2FA in our guide.
Disable file sharing
Larger, well-run public networks, major hotel chains and airports, typically turn on “client isolation,” which keeps connected devices from seeing each other. Plenty of smaller or poorly configured networks, a coffee shop, a rental's guest Wi-Fi, don't. On those, if your computer is set to share files, a stranger on the same network could potentially reach them. It's convenient at home; on public Wi-Fi it's just an open door you don't need. To disable sharing:
-
Windows 11: Settings > Network & Internet > Advanced network settings > Advanced sharing settings, then turn off “File and printer sharing” and “Network discovery” and save.
-
Mac: Apple menu > System Settings > General > Sharing. Below Content & Media, turn off File Sharing. Full steps are in Apple's support guide if your menu looks different.
Public Wi-Fi safety FAQ
Is public Wi-Fi still dangerous in 2026?
It's safer for casual browsing than it used to be, since HTTPS now covers most everyday traffic. What's still real: attackers compromising hotel and conference Wi-Fi hardware directly, your browsing history leaking through DNS and SNI even on HTTPS sites, and captive portals harvesting your contact information for marketing. Treat public Wi-Fi as low-risk for reading the news and higher-risk for banking, work email, or anything you don't want tied to your identity.
Does public Wi-Fi sell my data?
Often, yes, indirectly. Many captive portals are built specifically to collect emails, phone numbers, or social logins for marketing, not to secure your connection. It's legal and disclosed in the terms you click past, but it's still your data being monetized.
How can I protect my information when connecting to a public Wi-Fi hotspot?
Confirm the network name before connecting, stick to HTTPS sites, use a VPN, enable two-factor authentication or passkeys, and turn off file sharing. Those five habits cover most common attacks described above.
Are Xfinity Wi-Fi hotspots safe to use?
Yes. It's a legitimate Comcast service, not a spoofed network, though the same public Wi-Fi precautions still apply.
How do I know if a public Wi-Fi network is legitimate?
Ask an employee for the exact network name (SSID) rather than guessing from the list on your device, and be suspicious of any network that asks you to install software, run a script, or enter credentials you wouldn't normally give out to get online.
Updated on 8/3/2026 with current research on hotel and conference Wi-Fi attacks, personal-hotspot guidance, and current VPN recommendations.
Read more: The Best VPNs for Protecting Your Privacy
