Public Wi-Fi Security: What Open Networks See and How to Stay Private

Quick answer

Public Wi-Fi is not the horror story of 2010 — HTTPS now protects the content of most sessions. But open networks still observe more than people think: every domain you resolve over DNS, connection timing and volume, your device identifiers, and captive portals still inject pages into your traffic. The fix is a short habit stack: keep systems updated, prefer HTTPS, and put an encrypted tunnel under everything before you log in to anything.

What an open network can actually see

When you join a hotspot, its equipment forwards all your traffic. Even with HTTPS everywhere, the network still learns:

Your DNS lookups — the domain of every site and app you open, in plaintext, unless DNS is protected. This is the single biggest leak in the HTTPS era.
Connection metadata — which hosts you talk to, when, how often, and how much data moves. Patterns identify services even without content.
Device identity — hostname and network identifiers that make you recognizable across visits.
Anything unencrypted — legacy apps, some IoT traffic, and the initial redirect before a site upgrades to HTTPS.

And the network is not just the router: on shared Wi-Fi, other clients share the medium, and cheap hardware in between may be misconfigured or compromised.

Risks that are real vs. overstated

Mostly solved by HTTPS: reading your passwords and messages off the air. If the padlock is intact and you do not click through certificate warnings, session content is protected.

Still real:

Metadata profiling — DNS plus timing reveals your services, habits, and presence.
Rogue and look-alike hotspots — an attacker-run network named like the venue's, in the perfect position to watch metadata and serve malicious portals.
Captive portal injection — the sign-in system legitimately intercepts your first requests; poorly built ones mishandle or monetize that position.
Old-fashioned shoulder surfing — no protocol fixes a stranger reading your screen on a train.

The habit stack

Update before you travel. Most Wi-Fi-based attacks exploit known, already-patched bugs.
Join the right network. Confirm the exact SSID with the venue; "forget" networks after use so your device does not auto-join look-alikes later.
Portal first, tunnel second. Complete the captive portal sign-in, then connect the VPN before opening mail, banking, or work. Inside the tunnel, the network loses DNS lookups and traffic patterns — it sees one encrypted stream. ClickVPN resolves DNS through its own infrastructure, so the hotspot's resolver never sees your queries.
Verify, don't assume. After connecting, the what-is-my-IP tool shows what networks can see; the leaks guide covers DNS and WebRTC checks.
Protect the accounts too. A tunnel does not fix a reused password. Unique passwords (the generator is free) and two-factor auth cover the account layer.

Special cases worth knowing

Hotel networks often segment poorly and throttle video; a tunnel restores privacy and prevents traffic-type shaping in one move.
Coworking spaces are long-lived networks where metadata accumulates for months — the profiling risk grows with time, not just with sensitivity.
Tethering through your own phone beats open Wi-Fi when signal allows, and a VPN behaves identically over mobile data.