A decade ago, public Wi-Fi horror stories were about password theft — someone with a laptop reading logins out of the air. HTTPS everywhere genuinely fixed most of that. What it didn't fix is quieter: the network still learns a lot about you even when it can't read your traffic.
Here's an honest 2026 accounting of what public Wi-Fi sees, what it can do with that, and how to close the gap without thinking about it much.
What the network still sees (even with HTTPS)
Whoever operates the network — the hotel, the airport concession, the cafe's ISP, or the guy who set up a hotspot named after the cafe — can observe:
- Every domain you visit. Not the pages, but the sites: your bank, your clinic's patient portal, the dating app, the news outlet in your language. DNS queries and TLS handshake metadata reveal this by default.
- When and how much. Traffic timing and volume — enough to tell a video call from browsing, or that you're awake at 3am.
- Your device identity. MAC randomization helps, but captive portals that ask for your room number, email, or boarding pass tie your traffic to you directly.
None of this requires an attacker. It's the ordinary visibility of the network operator, and on commercial networks it's routinely fed into analytics.
The actual threats, ranked honestly
- Metadata collection by the network operator — near-certain on commercial Wi-Fi. Not dramatic, just constant.
- Rogue or spoofed hotspots — "Airport_Free_WiFi" run from a backpack. Rarer than the talks suggest, but real in airports and conference venues.
- Captive-portal weirdness — portals inject pages before you're "through," sometimes over plain HTTP, and occasionally inject ads after.
- Old-school interception of non-HTTPS traffic — mostly extinct for browsing, but plenty of apps still make sloppy unencrypted requests in the background.
The 60-second routine
When you sit down at the hotel desk or airport gate:
- Verify the network name with a human or signage. Twin networks with one letter changed are the classic trap.
- Join and clear the captive portal. Give it the minimum — a throwaway email beats your real one.
- Turn the VPN on. After the portal, one tap. From this point the network sees a single encrypted stream to one server: no domains, no per-site metadata, no browsing pattern.
- Leave it on for the whole stay. Modern protocols like WireGuard reconnect instantly when you move between the lobby and your room, so there's no reason to toggle.
That's the whole drill. Steps 1–2 handle the rogue-hotspot risks, step 3 removes the metadata layer, step 4 makes it durable.
What a VPN does not fix on public Wi-Fi
Honesty section — repeat visitors know we like these:
- A VPN doesn't stop phishing. The fake booking-confirmation email works identically through a tunnel.
- It doesn't protect a device with outdated software from targeted exploitation on a hostile network. Install iOS updates.
- It doesn't make shared computers safe. The hotel "business center" PC is not your friend, VPN or not.
A note for travelers
If you travel a lot, this pairs with our travel guide: the same VPN that cleans up hotel Wi-Fi also gets your banking app to stop locking you out abroad (connect via your home country) and keeps your streaming subscriptions working the way they do at home.
The habit worth building is boring: connect, portal, VPN on, forget it. FREE VPN FAST is free and takes one tap — there's no reason the sixty-second routine should ever get skipped.