To take action : 5–10 min · Depending on your devices and accounts
You're at a café checking your bank account
Understand what HTTPS protects, even on a shared network.
PatchYourself · Last editorial revision : · Sources
Fictional example: an everyday situation
At a café, Lina sees two similarly named networks. She asks which one to use and opens her usual website. A page asks her to install a certificate to continue, so she stops and uses another connection.
The problem
A Wi-Fi network name does not prove who runs it. An unfamiliar network can display a fake portal or observe unencrypted traffic. That does not make everything you do readable.
HTTPS encrypts the connection between your browser and the website. On an up-to-date device, with a valid certificate and no ignored warnings, a network observer normally cannot read page contents, passwords or messages carried inside that connection.
The network can still observe metadata, such as IP addresses and sometimes domains. HTTP traffic remains exposed. A fraudulent website using HTTPS receives the data you give it: encryption does not prove honesty.
What to do now
Step 1: Check the network and destination
Ask staff for the network name. This reduces mistaken choices but does not guarantee the access point’s identity. For banking or email, use your usual app or address.
Step 2: Respect warnings
Do not ignore certificate or insecure-connection warnings. A public portal should not ask you to install a certificate, management profile or app to access personal accounts. If uncertain, disconnect.
Step 3: Limit automatic connections
In Wi-Fi settings, disable automatic reconnection to public networks you no longer use. Forget unnecessary networks. Exact options depend on the device and version.
Step 4: Choose another connection when needed
Mobile data or your personal hotspot is a practical alternative when a network looks suspicious. It does not protect against phishing or malicious apps. A VPN can protect traffic as far as its provider, but is not needed to make HTTPS encrypted. See the VPN module.
Go further
Eavesdropping and malicious intermediaries
A man-in-the-middle attack tries to intercept or alter communication. TLS, used by HTTPS, checks the server’s identity and protects the exchange. Ignoring a warning or installing a stranger’s certificate can undermine that protection.
DNS and visibility
A DNS request translates a domain name into an IP address. It does not contain search terms or page contents. Encrypted DNS reduces observation of those requests on the local network without hiding all browsing. See DNS and tracking.
Sources and verification
References used for this revision. Menus and offers can change; consult the provider’s help for your version.