What Is a Man-in-the-Middle Attack? How to Stay Safe on Public Wi-Fi

A man-in-the-middle attack is when someone secretly places themselves between your device and the website or app you are using, so they can read or change what passes between you. On public Wi-Fi this usually means a fake hotspot or a tampered network that routes your traffic through the attacker first.

Checked on 6 November 2026.

How does a man-in-the-middle attack happen on public Wi-Fi?

A man-in-the-middle attack on public Wi-Fi usually starts with a network you trust by its name. An attacker sets up a hotspot called something like "Cafe_Free_WiFi" or "Airport Guest". Your phone joins it, and every request you send goes through the attacker's device before it reaches the internet. On a real but poorly secured network, an attacker on the same Wi-Fi can also try to redirect your traffic to their device. Either way, the attacker sits in the middle of the conversation without you noticing.

What can an attacker see in the middle?

What an attacker can see depends on whether the connection is encrypted. On a site that uses HTTPS, they can usually see which site you visit but not your password or messages. On a site without HTTPS, or in an app that does not encrypt its traffic, they may see everything you send. An attacker can also show you a fake sign-in page, try to make you accept a bad security certificate, or send you to a look-alike site to collect your details.

What are the warning signs of a man-in-the-middle attack?

The main warning signs are small interruptions you might be tempted to click past:

Your browser warns that a site's certificate is not valid or not private.

A familiar site suddenly loads without the padlock, or the address looks slightly wrong.

A Wi-Fi network asks you to sign in with your email or social account in an unusual way.

Two networks nearby have almost the same name.

Treat any of these as a reason to stop and switch to mobile data.

How do you protect yourself from a man-in-the-middle attack in 4 steps?

Ask staff for the exact network name. Join only that network, and turn off auto-join for open networks in Settings > Wi-Fi.

Never accept a certificate warning. If your browser says the connection is not private, close the page.

Use the official app, not links. For banking and email, open the company's own app instead of a link in a message.

Turn on your VPN before you browse. A VPN encrypts everything between your phone and the VPN server, so someone in the middle of the Wi-Fi sees only scrambled data.

Does HTTPS alone stop man-in-the-middle attacks?

HTTPS stops most of them for the sites that use it, as long as you never accept a certificate warning. It does not protect apps that skip encryption, it still lets the network see which sites you visit, and it cannot help if you are tricked into typing your details into a fake page. That is why HTTPS and a VPN work best together.

Frequently asked questions

Is a man-in-the-middle attack common on public Wi-Fi?

It is one of the main reasons security teams warn about open networks. You cannot tell from the outside whether a hotspot is honest, so it is safest to assume it might not be.

Can a man-in-the-middle attack happen on mobile data?

It is much harder. Mobile networks encrypt the link between your phone and the carrier, and an attacker would need special equipment nearby.

Does a VPN make public Wi-Fi completely safe?

No tool makes you completely safe. A VPN protects your connection on the network, but you still need to avoid fake sites, keep your phone updated, and use strong sign-ins such as passkeys.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Learn more in How to spot a fake Wi-Fi network or Download CasperVPN →