Free WiFi in a restaurant, hotel or cafe is convenient, and for most people it is fine for everyday use. It helps to know where the real risks are, so you can use it with a little care and without worry.
What has improved
Most websites and apps now encrypt their traffic, shown by https:// in the address bar. Browsers show this in different ways, and some no longer use a padlock, so check the connection details if you are unsure. It means someone on the same network cannot easily read what you send to those sites. It does not prove a site is genuine. This has made ordinary browsing on public WiFi much safer than it used to be.
The real risks
- Fake networks. Someone can set up a network with a name that looks like the venue's. If you join it, your traffic passes through their equipment.
- Unencrypted sites. A site that uses plain http:// does not protect what you type.
- Risky sharing. Banking, payments and passwords are best kept for a trusted connection.
- Out of date devices. Software that has not been updated can contain known weaknesses.
Simple steps that help
- Check the network name. Ask staff, or look at the menu or sign, rather than choosing a name that looks right.
- Look for https. Be careful with any page that asks for personal details and does not use https, and never click through a certificate warning.
- Turn off auto-join. Stop your phone joining open networks automatically.
- Keep your device updated. Install system and app updates when they appear.
- Use mobile data for sensitive tasks. Banking is better on your own mobile connection.
- Consider a VPN. It adds protection if you are on a network you do not trust.
- Read what the login page asks for. A venue login that wants a card number or your passwords is not normal. Names and an email address are the usual limit.
For venues: a guest network set up on its own, with a clear login page and plain terms, helps guests feel safe. See guest WiFi versus staff WiFi.
What a venue login page should look like
A well-run venue shows its name, a short explanation and clear terms. If it asks for an email address, it should tell you why and give you a choice about marketing. Our guide to what captive WiFi means explains how these login pages work.
If you run a venue and want your guest WiFi to feel trustworthy from the first tap, book a 15-minute demo.