Public Wi-Fi: what to do and what to avoid

Start here

Ask one question before you connect.

Ask staff: ‘What is the exact guest Wi-Fi name, and should a sign-in page appear?’ That gives you something to check against. A familiar-looking name alone is not enough to identify the operator.

• Use the network staff identify, not simply the strongest signal or the first free-looking name.
• If there is a code, ask where to enter it: in Wi-Fi settings or on the sign-in page.
• If the answer and the screen do not match, pause and ask before submitting details.

Types of guest Wi-Fi

A Wi-Fi password and a website login do different jobs.

You may join without a password, enter a shared Wi-Fi password, or reach a website asking for terms, a voucher, room details, or payment. A network can require both a Wi-Fi password and a website login. Completing the second step grants access; it is not a security assessment.

Do not judge a network only by whether it asks for a password. Ask who runs it and whether the access requirements are expected.

Do and don’t

Protect the connection, and check the destination.

HTTPS encrypts the connection to a website. That is useful on public Wi-Fi, but a fraudulent website can use HTTPS too. Check the actual address before signing in; a logo or padlock is not an endorsement.

• Do keep your browser and operating system updated, and use unique passwords with two-factor authentication.
• Do stop at certificate warnings. Do not click through them just to get online.
• Do follow your employer’s remote-access rules on work devices.
• Do not install a ‘Wi-Fi repair’ app, profile, or browser extension just because an unexpected page demands it. Verify the request independently first.

What rescue can do

Opening the login is not the same as securing the network.

Wi-Fi Rescue can try to bring up a missing sign-in page. It does not inspect the hotspot or certify the operator. Its plain HTTP address is intentionally unencrypted and never asks you to enter information.

A VPN can protect traffic between your device and the VPN service; it does not make a phishing page legitimate. If you temporarily pause a VPN to complete an expected login, turn your VPN back on before continuing. Do not change managed work settings without permission.

Sources

First-party references.

1. Public Wi-Fi networks: encryption and everyday precautionsFederal Trade Commission
2. Use captive Wi-Fi networks on iPhone or iPadApple Support
3. Recognize and avoid social engineering and scamsApple Support
4. Holiday travel tip: using public Wi-FiNIST National Cybersecurity Center of Excellence

Keep going

Related help.