Confirm the hotspot with the venue, keep the device updated, use encrypted websites and official apps, and avoid certificate warnings. Turn off sharing and automatic connection, then forget the network when finished. Use cellular data or a trusted personal hotspot when you cannot verify the network or need to complete a sensitive task.
Before you connect
Ask an employee or check official venue signage for the exact network name and any required access code. Similar names can belong to a different hotspot. Do not choose a network solely because it has the strongest signal or includes the venueâs name.
Install pending updates before traveling. Keep Google Play Protect and trusted security software enabled. Back up important data and use a screen lock so a lost device does not expose active accounts.
Disable automatic connection to open networks. Review saved networks and remove generic names that could cause the phone to join a different hotspot later.
While using the network
Use the official app or type a known address for email, banking, shopping, and payment services. Check that the browser uses HTTPS and stop on certificate or privacy warnings. Do not enter sensitive information into a page reached through an unexpected captive portal message.
Keep file sharing, network discovery, remote login, and local media sharing off unless the task requires them. On a computer, choose the operating systemâs public-network profile when offered.
Avoid leaving the device unlocked or unattended. Shoulder surfing and physical theft remain practical risks in airports, hotels, libraries, and cafés.
What a captive portal should ask for
A legitimate portal may request acceptance of terms, a room number, an event code, or an email address for access. Verify the network before providing even routine information.
Stop if the portal asks for:
- the password to your email, bank, or social account;
- a one-time authentication code;
- a Social Security number or payment-account login;
- installation of a certificate, profile, app, or remote-access tool without prior explanation;
- payment through gift cards, cryptocurrency, or a transfer to an individual.
Close the portal and ask the venue how access is supposed to work.
Should you use a VPN?
A reputable VPN can protect traffic routed through its tunnel between your device and the VPN provider and may be required for work. Choose a provider whose ownership, business model, and privacy terms you understand. A no-cost VPN may fund itself through advertising or data practices you would not accept.
A VPN does not make a fake login page authentic or protect an account after you submit a password. It also does not replace software updates or official apps.
Safer choices for sensitive tasks
Cellular data or a personal hotspot avoids reliance on the venueâs Wi-Fi. Use it for financial transfers, access to sensitive work systems, or account recovery when the public network cannot be confirmed.
If public Wi-Fi is the only option, verify the hotspot, use the organizationâs official encrypted service, and postpone the task if the browser shows a warning or the network behaves unexpectedly.
Use a personal hotspot carefully
Protect a personal hotspot with a strong password and current Wi-Fi security settings. Change the default hotspot name if it reveals your full name or phone model, and turn the hotspot off when the other device finishes. Review the connected-device list when the phone provides one.
A personal hotspot removes the venueâs network from the connection path, but the connected laptop or tablet still needs updates, a screen lock, and protection against phishing.
Avoid sharing the hotspot password in a public message or leaving the network active without supervision. If an unknown device appears, disconnect it and change the password before reconnecting your own devices.
After you disconnect
Forget the network, especially when it has a generic name. Turn automatic connection back off if the hotspot changed the setting. Review the device for unfamiliar profiles, certificates, VPN configurations, notification permissions, or apps.
If you entered a password on a suspicious page, change it from a trusted connection and revoke other sessions. Contact a bank or card issuer for financial information. Preserve the network name and screenshots if reporting is necessary.
For a work device, tell the security or IT team when you accepted an unexpected certificate, installed a profile, entered work credentials into a suspicious portal, or saw a company VPN warning. The organization can review account sessions and device-management records that are not visible to the user.
How WiFi Checker helps
WiFi Checker can provide information and warnings about a connected network within dfndr security. It complements manual verification of the network name and venue. It cannot confirm who physically operates a hotspot or guarantee that every site opened through it is legitimate.
PSafeâs analysis of safer public Wi-Fi use
Most sensitive traffic is encrypted today. You still need to confirm the hotspot, stop at browser warnings, turn off local sharing, and open sensitive accounts through their official apps or known addresses. Verify the Wi-Fi network and the site separately.
Frequently asked questions
Can I shop on public Wi-Fi?
Use an encrypted site or official app and a payment method with suitable protections. The connection does not verify the seller, so evaluate the store separately.
Does incognito mode protect me on Wi-Fi?
It limits some browser history and cookie retention on the device. It does not encrypt unprotected traffic, verify the hotspot, or prevent phishing.
Should Bluetooth be turned off?
Turn off Bluetooth when you are not using it, especially in crowded places. Also review nearby-sharing and device-discovery settings.
Is hotel Wi-Fi safer with a room-number login?
The login helps control access but does not prove that you selected the real network. Confirm the name with the hotel and keep the same device protections in place.