Public Wi-Fi and VPNs: protect the connection without trusting every site
Understand what HTTPS already protects, what a VPN changes and which account and device risks remain.
In brief
Most modern websites use HTTPS to encrypt the connection, including on public Wi-Fi. A VPN adds a protected route to its provider, but it does not make a phishing website legitimate or erase your signed-in identity.
Use the protection that matches the job instead of buying a VPN because every public network is described as automatically unsafe.
Keep website trust separate
The padlock or HTTPS indicates encryption to that destination. An attacker can use HTTPS too, so still verify the hostname and request. Do not install a certificate or “security update” from a captive-portal advert to obtain Wi-Fi access.
Know which traffic the VPN covers
An organization may require its VPN for access to work systems. For a personal provider, inspect privacy practices, supported devices and whether the feature covers only a browser or the device. Do not assume a free app has no data or advertising business model.
Reduce risks a tunnel does not address
Keep sharing and device exposure appropriate for a public network, maintain updates and protect account sign-ins. Use a trusted mobile connection when the hotspot cannot be verified. A tunnel does not prevent you from giving a code to a scammer or running a malicious downloaded installer.
Before you act
Trust shifts toward the VPN provider. A browser-only feature may protect that browser’s traffic rather than the whole device, and neither route fixes malware or exposed credentials.
What to do next
- Confirm the network name with its operator and avoid automatic reconnection to unknown hotspots.
- Use HTTPS and do not bypass certificate warnings.
- If a VPN is required or useful, use a trusted supported provider and check its actual coverage and connection state.
