MyIPInfo

“Don’t use public WiFi” was solid advice 15 years ago. Today the answer is more nuanced — the web has changed in ways that make most of the old attacks much harder, but some real risks remain, and a few new ones have appeared.

This guide walks through what’s actually risky on a cafe or airport WiFi in 2026, what isn’t worth worrying about anymore, and the simple steps that handle the remaining concerns.

What’s Different in 2026

The internet of the early 2010s was mostly HTTP — anyone on the same WiFi could read your login pages, your emails, your banking sessions. That’s why “don’t use public WiFi” became a slogan.

Since then:

  • HTTPS is now the default for ~95% of web traffic. Browsers warn or block HTTP entirely. Anyone snooping on the WiFi sees encrypted traffic and which domains you visit, but not the content of pages or form submissions.
  • Apps mostly enforce certificate pinning for sensitive operations (banking, healthcare), making man-in-the-middle attacks much harder than on plain browsers.
  • Modern operating systems disable risky legacy protocols (like SMBv1) and isolate apps from each other on the network.

So the worst-case “someone on the same WiFi reads my passwords” scenario is genuinely much rarer than it used to be. But it’s not zero.

What’s Still Risky

1. Captive portals impersonating real sites

The “Sign in to use the WiFi” page is the venue’s portal — but malicious operators can set this up to look like a Google, Microsoft, or Apple login. If you type credentials in, they go to the attacker.

Rule: Captive portal pages should never ask for your existing accounts. Use a dedicated, throwaway email if signup is required.

2. The WiFi operator sees every domain you visit

HTTPS hides page content but not which domain you connected to. The cafe, the airport, the hotel — and anyone with access to their router logs — knows you visited bank.example.com, clinic.example.com, dating.example.com, etc.

If the venue is a chain, the parent company may aggregate this across all their locations. Some venues sell this data.

3. Network-level injection

A malicious WiFi can:

  • Redirect HTTP requests (the ~5% non-HTTPS traffic) to malicious pages
  • Inject ads or scripts into HTTP pages
  • Run “transparent proxies” that strip security headers
  • Block VPN protocols, forcing you to fall back to less secure ones

None of these break HTTPS sites, but they degrade safety.

4. Old or unpatched devices

A laptop running an OS from 5+ years ago, or a phone that stopped getting updates, may still have exploitable vulnerabilities in network code. Public WiFi is one of the few places where those get exercised.

5. Evil twin networks

Attacker sets up a WiFi network with the same name as the legitimate one (Starbucks_Free_WiFi). Your phone auto-connects because the SSID matches. Now you’re on the attacker’s network.

What to Actually Do

For 90% of people in 90% of situations:

  1. Use a VPN on public WiFi — encrypts everything, hides domain names from the venue, and prevents most network-level attacks. This single step solves the majority of risks above.
  2. Disable auto-join for public networks — prevents the evil twin attack. You should manually choose to connect each time.
  3. Keep your OS, browser, and apps updated — closes the network-code vulnerabilities.
  4. Don’t enter credentials on the captive portal — use a throwaway email if signup is required.
  5. Watch for the lock icon in the address bar — if a site you know is HTTPS suddenly isn’t, stop and investigate.

For higher-stakes activities (banking, work systems, sensitive accounts):

  1. Tether to your phone instead — your carrier is at least a known entity with regulatory accountability.
  2. Use SMS or app-based MFA — even if credentials leak somehow, the second factor blocks the attacker.
  3. Avoid sensitive admin work entirely — managing servers, transferring large sums, accessing legal documents are best left for a network you trust.

Quick Checklist Before Connecting

- Is this the venue's actual network name? (ask staff if unsure)
- Is auto-join for this SSID off?
- Is your VPN running?
- Does your browser still show HTTPS on every important site?
- Are your OS/apps up to date?

The Bottom Line

Public WiFi in 2026 is safer than it was 10 years ago, but it’s still a network you don’t control, run by people who may not be careful or may not be honest. A VPN plus basic hygiene makes it acceptable for normal use. For anything sensitive, mobile data is a better default.

If you do use public WiFi without a VPN, at least confirm your IP and DNS look normal on MyIPInfo before doing anything important — sudden weird routing is one early sign that something is wrong with the network.