Public Wi-Fi Security: A Simple Routine for Australians

Free Wi-Fi is everywhere: the cafe, the airport lounge, the hotel, the library, the shopping centre. It's handy, and for checking the footy scores or reading the news it's usually fine. The trouble starts when you do something sensitive on a network you share with strangers. This guide covers what the Australian Cyber Security Centre says about public Wi-Fi, the main risks, a short routine you can use anywhere, and where a VPN fits. The government guidance was checked on 30 October 2026.

SecureCheck.com.au is an independent guide operated by Dominet BV. This page is general information, not legal or technical advice for your situation. We don't sell VPNs or security software. No link on this site is an affiliate link right now. We may earn a commission from VPN or security companies in future when a reader buys through a link on this site. If that happens we'll label those links and explain it in our affiliate disclosure, and it won't change the facts we publish. Facts were checked on official and company websites on 30 October 2026. Read our general information notice.

What the ACSC says

The Australian Cyber Security Centre's security tips for remote working make three points about public networks:

• Avoid public Wi-Fi for sensitive work where possible.
• A VPN can hide your activity from others on the same network.
• A VPN won't protect you from malware, phishing or vulnerabilities in your software.

It also says to use a reputable VPN provider if you use one. That's the balance this guide follows: a VPN is one useful layer, not a complete answer.

Why shared networks carry risk

On a public network, you're sharing the connection with everyone else nearby, and you're trusting whoever set up the network. The main risks are:

• A fake network. Someone can set up a hotspot with a name that looks like the venue's, such as "Airport Free WiFi". If you connect to it, your traffic passes through their equipment.
• Others on the same network. On an open network, other people connected to it may be able to see more of your traffic than you'd like, especially from apps or sites that don't encrypt properly.
• Fake sign-in pages. Some public networks show a page asking you to sign in or accept terms. A fake version can ask for your email password or card details.
• Your device sharing too much. File sharing, device discovery and auto-connect settings can expose more of your device than you intend.

Most banking apps and well-known websites encrypt your connection, which helps. But you can't always tell which apps do, and a VPN covers all your traffic between your device and the VPN server.

A routine for any public network

Use this every time you join a network you don't control.

Before you connect

• Check the exact network name with staff, or on a sign at the venue. Don't guess between "CafeWiFi" and "Cafe_WiFi_Free".
• Turn off auto-connect for public networks in your device's Wi-Fi settings, so your phone doesn't join a lookalike network on its own.
• Turn off file sharing and device discovery on your laptop.

While you're connected

• Turn on your VPN if you use one.
• Save banking and anything sensitive for mobile data or home. This is the ACSC's "avoid public Wi-Fi for sensitive work" in practice.
• Never enter a password or card on a Wi-Fi sign-in page. A legitimate venue page might ask for your name or a room number, not your email password.
• Watch for security warnings in your browser. If one appears, disconnect.

When you leave

• Forget the network in your Wi-Fi settings.
• Turn the VPN off only if you need to, for example for a streaming app.

Use your phone's hotspot instead

For sensitive tasks, your phone's mobile data is usually a better choice than public Wi-Fi, because you aren't sharing a local network with strangers. If you need your laptop online, use your phone's personal hotspot with a strong password. It uses your phone's data allowance, so check your plan, but for a quick banking task or work email it's often the simplest option.

Working from a cafe or co-working space

The ACSC's tips are written for remote working, and a few extra habits help when work comes with you:

• Use your employer's VPN if it provides one, and follow its rules. A work VPN may be required to reach internal systems, and your IT team may not want a personal VPN running alongside it.
• Mind your screen. Sit where people can't easily read over your shoulder, especially in a busy space.
• Lock your device whenever you step away, even for a moment to order a coffee.
• Keep calls general in public. Other people can hear one side of a phone call as clearly as you can.
• Don't plug in unknown USB drives or accept files from people you don't know.

If something about a network seems off, tell your IT team. They'd rather hear about a strange sign-in page than clean up a compromised account later.

A quick test before you rely on a network

If you use the same cafe or library network often, it's worth a quick check once. Ask staff for the exact network name and whether there's a password. Note whether the sign-in page asks only for basic details. After that, you'll know what the real network looks like, and a lookalike will stand out.

Hotels and airports

Hotels. Hotel Wi-Fi is shared with every guest. Confirm the network name at reception, treat it like any other public network, and save sensitive tasks for mobile data where you can.

Airports. Airports are busy, which makes a lookalike network easier to miss. Check the official name on airport signs or the airport's website.

Overseas. The ACSC's security tips for travelling say to check local laws before using a VPN in another country, because some countries restrict VPN use. Check before you go rather than at the airport.

Where a VPN fits

A VPN encrypts the traffic between your device and the VPN company's server. On public Wi-Fi, that means other people on the same network, and whoever runs the hotspot, see far less of what you're doing. That's the benefit the ACSC describes.

What a VPN doesn't do:

• It doesn't stop phishing. If you type your password into a fake site, a VPN can't help.
• It doesn't remove malware or fix software flaws.
• It moves trust. The VPN company can see the traffic your network used to see. That's why the ACSC says to choose a reputable provider.

If you only use public Wi-Fi now and then, a free plan from a reputable provider may be enough. Proton VPN, for example, offers a free plan covering 1 device, with servers in 10 randomly selected countries (Proton VPN). Our free VPN guide covers the limits, and our checklist covers how to compare paid options.

Protect your accounts as well as your connection

The habits that matter most work on any network:

• Turn on multi-factor authentication for email, banking and social media. Moneysmart lists it among its tips.
• Use a unique password for each important account.
• Keep your device and apps updated.
• Be wary of urgent messages. Scamwatch's Stop. Check. Protect. steps apply on public Wi-Fi as much as at home. Our scams guide has more.

If you think something went wrong

If you entered a password on a page that looked wrong, or your device behaved oddly on a public network:

1. Disconnect from the network.
2. Change the password for the affected account from a trusted connection, starting with your email.
3. Turn on multi-factor authentication if it wasn't on.
4. Contact your bank straight away if you shared card or banking details, as Scamwatch advises.
5. Run your device's updates and any security scan you already use.

Frequently asked questions

Is public Wi-Fi safe in Australia?

It's fine for light browsing, but the ACSC suggests avoiding public Wi-Fi for sensitive work where possible. Use mobile data for banking.

Do I need a VPN for public Wi-Fi?

It helps. The ACSC says a VPN can hide your activity from others on the same network. It won't protect you from malware or phishing.

Is hotel Wi-Fi safer than cafe Wi-Fi?

Not necessarily. Both are shared networks. Treat hotel Wi-Fi like any other public network and confirm the network name at reception.

Is my phone's hotspot safer than public Wi-Fi?

For sensitive tasks it's usually the better option, because you aren't sharing a local network with strangers. Protect it with a strong password.

Should I enter my email on a Wi-Fi sign-in page?

Be careful. Never enter your email password or card details on a Wi-Fi sign-in page.

Can I use a VPN on public Wi-Fi overseas?

Check local laws first. The ACSC says some countries restrict VPN use.