Public Wi-Fi Checklist for Mac Users

HTTPS now protects much web traffic in transit, but an untrusted network can still present fake sign-in pages, log connection metadata, or encourage unsafe actions. The practical checklist is short: confirm the network name, heed certificate warnings, use a VPN when appropriate, and lock down sharing.

What actually changed since 2015

HTTPS is designed to protect content between your browser and the site when the connection and certificate are valid. That makes casual traffic reading much harder, but it does not validate every page you see or every action you take on an untrusted network.

What’s left is a narrower, more specific set of risks. Fake hotspots, sometimes called evil twins, are networks named to look like the real one, so you connect to an attacker’s router instead of the coffee shop’s. DNS snooping lets the network log which sites you visit even when it can’t read the contents. Captive portals, those “agree to continue” pages, can be imitated. And plain shoulder surfing still works, because no encryption stops someone reading your screen.

The reason a fake hotspot is worth caution is not that it automatically defeats properly validated HTTPS. Once traffic flows through someone else’s router, they control the surrounding experience: the fake sign-in page they show you, the DNS answers they hand back, and the nudges to install something or “verify” a login. The danger is the setup around your connection, not the encrypted contents inside it, which is why confirming the network name up front does more good than any amount of inspecting individual sites once you’re on.

The five-minute checklist

Seven quick checks cover almost all of it:

• Verify the exact network name with staff. A fake hotspot’s only trick is looking legitimate, so confirming the real name defeats it.
• If you use a VPN, connect before sensitive activity so the local network sees less of the subsequent connection. HTTPS is still required.
• Set AirDrop to Contacts Only in Control Center, so strangers on the network can’t send you anything.
• Confirm the firewall is on under System Settings > Network > Firewall, which blocks unexpected incoming connections from others on the network.
• Turn off auto-join for public networks so your Mac doesn’t silently reconnect to a lookalike later.
• Do sensitive tasks after the captive portal loads, never on that first sign-in page itself.
• Forget the network when you leave so it isn’t saved and rejoined automatically next time.

Verifying the network and browser connection comes first. A VPN can then reduce what the local network observes, and the longer guide to when to use a VPN explains its limits. It does not validate a captive portal, block phishing, or replace device and account security.

What you don’t need to worry about anymore

When a browser establishes a valid HTTPS connection, the page contents are encrypted in transit. Do not treat a padlock alone as proof that the site itself is legitimate, and never bypass a certificate warning on an untrusted network.

The risk that replaced it is subtler and worth naming plainly. What the network can still see is metadata: which services you connect to, roughly when, and how much, depending on the protocol and configuration. A VPN can reduce some of that visibility for the local network. And the fake-hotspot risk is about which network you trust, not which sites you visit, so verifying the name matters more than inspecting any padlock. If you want to go further than the network layer, a look at the Mac security settings worth checking covers the on-device side.

When something feels off, use your phone

The simplest fallback costs nothing. If the network name looks slightly wrong, the captive portal seems off, or you just don’t trust the place, skip the Wi-Fi entirely and use your phone’s personal hotspot. A cellular connection is yours, not a stranger’s router, and it sidesteps the whole category of network-level risk in one move.

It’s a good default for anything genuinely sensitive, too. Checking a bank balance or logging into a work account over your own hotspot for two minutes removes the guesswork entirely, and a modern phone plan barely notices the data. Save the public network for the browsing that doesn’t matter much, and let your own connection carry the rest.

The bottom line for public Wi-Fi is to treat it as an untrusted connection. A VPN can reduce local-network visibility, but verifying the network, using valid HTTPS, and switching to your own hotspot when something feels wrong still matter.