Turn Off Auto-Join for Public Wi-Fi Networks

Your phone keeps a list of every Wi-Fi network it has ever joined, and it rejoins them by name alone. Names are not secrets and not proof of anything: anyone with a €30 device can broadcast a network called Free_WiFi, Airport_Free, or the name of the café you sat in last summer. Your phone recognises the name, connects silently, and every request it makes travels through someone else's equipment. This is called an evil-twin network, and the fix takes about three minutes.

Clean up the saved list first

The risk is proportional to how many open networks your phone remembers. Most people carry years of hotel lobbies, airports and cafés they will never visit again.

On iPhone: Settings → Wi-Fi → Edit → you get the full list of known networks → swipe to delete everything you do not use weekly. Then, for the networks you keep, tap the ⓘ next to each and turn Auto-Join off for anything that is not your home or office. Set Ask to Join Networks to Ask, and Auto-Join Hotspot to Never or Ask to Join.

On Android: Settings → Network & internet → Internet → Saved networks (wording varies by manufacturer) → tap each one → Forget. In the Wi-Fi preferences, turn off Connect to public networks / Auto-connect to open networks, and disable Wi-Fi scanning if you do not need location accuracy from it.

Do the same on your laptop. A work laptop that auto-joins Guest in any building is the same problem with more valuable data on it.

What an attacker actually gets

Be precise about the threat, because the internet exaggerates it in both directions. Almost all traffic is encrypted now, so nobody is reading your bank session out of the air. What a hostile network operator can do:

• Redirect you to a lookalike login page — the classic fake captive portal asking for your email password, or a "session expired, sign in again" screen.
• See where you go, even without seeing what you send: domain names, apps that phone home, timing and volume.
• Attack the apps that are careless, the handful that still accept a bad certificate or send something over plain HTTP.
• Reach your device directly if file sharing, AirDrop-style discovery or an old service is exposed.

The practical damage is almost always phishing on a network you trusted, not decryption.

When you do need public Wi-Fi

1. Join manually, by asking a human for the exact name. "Is it Cafe_Guest or Cafe-Guest?" — that one question defeats most evil twins.
2. Prefer your phone's mobile data or personal hotspot for anything involving money or work accounts. Cellular is cheap now and far less contested.
3. Use a VPN if you cannot avoid the network — it moves your trust from the café to your VPN provider, which is only an improvement if you chose the provider carefully. See how to choose a VPN that actually protects you.
4. Never type credentials into a page a network opened for you. Open a new tab and type the address yourself.
5. Forget the network when you leave. One tap, and it can never auto-join again.

Frequent questions

If everything is HTTPS, does this still matter? Yes, but for a different reason than a decade ago. The modern risk is not eavesdropping, it is being steered — to fake portals, fake update prompts and fake login pages. Those work best when your device connected silently and you never consciously chose the network.

Does forgetting a network delete the password? Yes, you will re-enter it next time. That is the point: rejoining becomes a decision instead of a reflex.

Is my home network affected? Your home SSID can also be spoofed, which is why WPA3 or WPA2 with a strong passphrase matters — and why the router's default password should have been changed on day one. A separate guest network keeps visitors and smart devices off the segment where your laptop lives.

How often should I redo this? Twice a year, or after any trip. It takes two minutes and it is the cheapest security habit you own — cheaper than recognising a phishing page after you have already typed your password into it. And keep in mind the broader rule that public Wi-Fi is not your friend.