VPN on Public Wi-Fi: Why You Need It

Free Wi-Fi in cafes, airports, hotels and trains is the norm. You connect with no password, or with a password like "cafe123," open your email, log in to your bank. Convenient. But these very networks are the main scenario VPNs were invented for when it comes to ordinary users.

In this article, we'll look at which risks on public networks are real (and which are overblown media scares), and what exactly a VPN does.

What's actually wrong with public Wi-Fi

The key difference: you don't know who set up the network or what's happening on it. Even if the cafe's administrator is honest, the network may include:

• Other connected users. There could be dozens of people on the same network as you, and in theory any one of them could be analyzing shared traffic.
• The network owner. All of your unencrypted activity is visible to the owner of the access point. What they do with it is anyone's guess.
• A fake access point. One of the old but still effective scenarios: an attacker creates a network called "Airport_Free_WiFi," and people connect to it.
• MitM attacks. Traffic interception at the network level.

What HTTPS protects — and what it doesn't

An important caveat: most of today's internet runs over HTTPS, which is already encrypted. When you log in to your bank or email, nobody on the network can see the content (passwords, message text) thanks to HTTPS.

But HTTPS does not protect:

• Site names. Through DNS queries and SNI, the network owner can see that you visited bank.com, mail.ru, and so on. Not the specific pages, but "where you went" — yes.
• Requests to older sites without HTTPS. They still exist.
• Some phone apps. Not every mobile app encrypts its traffic properly. Sometimes certificate validation is disabled, and then interception becomes possible.
• Metadata. Traffic volume, session times and behavior patterns remain visible.

What a VPN adds

A VPN closes the remaining gaps:

• Site names. With a VPN, DNS queries go through the provider's server rather than the local network. The Wi-Fi owner only sees a connection to the VPN.
• Protection for unencrypted traffic. If an app or site doesn't encrypt on its own, the VPN encrypts for it.
• Protection against tampering. If an attacker tries to spoof a page or a server response, it's harder to pull off, because all traffic goes through the VPN tunnel.
• Hiding what you're doing at all. The network owner sees neither sites nor apps — only a connection to a VPN server.

Real risks vs. media panic

Articles about public Wi-Fi often try to scare you with specific attacks. Not all of them are equally real:

• Intercepting your bank password. Very unlikely — banks only work over HTTPS, which can't be broken without spoofing a certificate (and that requires access to your device).
• Session cookie theft. Real, but mostly for sites without HTTPS — and those are rare these days.
• DNS spoofing. Real, especially through fake networks. A VPN closes this off.
• Activity tracking. Entirely real and happens regularly. A VPN closes this off.
• Covert device tracking via Wi-Fi trackers. Real and widespread in shopping malls and airports. A VPN doesn't help here (it's an attack on the radio signal, not the network) — it needs separate protection.

When a VPN on public Wi-Fi is critical

Specific scenarios where going without a VPN is a noticeable vulnerability:

1. Connecting in an unfamiliar country. Especially in a country with a habit of surveillance. Any open network is a potential risk.
2. When the whole point of connecting is sensitive data. Work documents, banking transactions, correspondence with clients.
3. In hotels with known leaks. Several hotel chains have been caught in the past injecting malicious code into HTTP pages (a banner with an infected link).
4. In airports. A high flow of random users makes for an ideal attack environment.
5. In chain cafes. The bigger the chain's brand, the more attractive a target it is for attackers.

VPNs while traveling: a separate story

When you travel, the demands on your VPN grow many times over. Here's why:

• Lots of open networks one after another. Airport → hotel → restaurant → another airport. Every network is unfamiliar, and every one is a potential risk.
• Access to services from your home country. Your banking app, government services, delivery apps — all of these are often blocked for foreign IPs. A VPN with a server in your home country restores access.
• Protection from surveillance at the hotel. Some hotel networks run traffic filtering and collect statistics — sometimes this is passed on to the government.

A practical tip: before your trip, make sure your VPN app is installed and working. Some countries block access to VPN providers' websites, so installing one from scratch once you've arrived may be impossible. The same goes for updates — update before you leave.

When you can leave the VPN off

A few situations where a VPN on public Wi-Fi is overkill:

• At the home of a trusted friend, where you know there are no strange gadgets on the network.
• On your office's work network, where IT is responsible for security.
• On a 4G/5G mobile network — there, traffic is protected by the carrier's encryption (though a VPN won't hurt).

Otherwise, the rule is simple: on any untrusted network, the VPN is on.

How to set it up so you don't forget

The universal solution is auto-connect. Every decent VPN app can:

• Turn on the VPN automatically when connecting to any Wi-Fi network except trusted ones.
• You set the list of trusted networks yourself: home, work, your parents' place.
• When your phone connects to someone else's network, the VPN turns on before any apps get a chance to send traffic anywhere.

If your app doesn't have this setting, build a habit: connected to someone else's Wi-Fi — turn on the VPN right away. In VolnaLink, it's a single button.

What else to do on public networks

A VPN is the main measure, but not the only one. In addition:

• Don't leave your device unattended in public places.
• Turn off automatic connection to open networks in your phone's settings — decide manually every time.
• Don't do important operations (payments, password changes) over public Wi-Fi, even through a VPN — it's better to do them at home.
• Enable 2FA on all important accounts. If something does leak, a password without the second factor is useless.

The bottom line

Public Wi-Fi is the main scenario where an ordinary person genuinely needs a VPN. Not for "total anonymity," but for solid protection against surveillance and traffic tampering. Turn on auto-connect and forget about it — the VPN will do its job on its own.

VolnaLink VPN turns on with a single button and is available on all popular devices.

Further reading

• Is a VPN safe?
• VPN for your phone
• VPNs and privacy protection