Wi-Fi Security Check

In a café, hotel or airport you share the network with strangers and with the hotspot owner. The router sees which sites you connect to, and the network can answer your requests however its owner likes. Usually this is harmless: the network just shows a login page or limits speed. But attackers use exactly the same capabilities.

The most common problems of open networks are spoofed DNS answers, HTTPS interception through a proxy, ads and scripts injected into unencrypted pages, and fake hotspots with a name similar to the real one. The first three can be spotted right from the browser, and our check does it in a few seconds.

Your browser and our server look at the same connection from two sides. The server sees which address and network the request came from, which TLS version was used and whether it carries proxy headers. The browser opens control sites over HTTPS, downloads an unencrypted control page and checks WebRTC.

Each item gets its own colour. Green means no signs of a problem. Yellow means something that may be harmless, such as a browser extension or a network filter. We only show red for a direct sign of tampering. The summary answers a practical question: is it safe to log in to your bank and email here.

• Network and connection: whose network it is — a home ISP, a mobile carrier or a data centre your VPN runs through.
• DNS spoofing: whether well-known sites open over HTTPS with valid certificates. If the network sends you to someone else’s server, the certificate won’t match.
• HTTPS interception: whether the request came through a middlebox that decrypted it and left its own headers.
• Page injection: whether the network changed the unencrypted control page or added scripts or ads to it.
• WebRTC: whether your browser reveals your network interface addresses to websites.

To be honest about the limits: a browser can’t see who else is on the network, whether ARP spoofing is going on or whether the hotspot itself is a fake with the same name. It also can’t see how the Wi-Fi itself is encrypted. If a corporate root certificate is installed on the device, HTTPS interception can also go unnoticed — that is how company traffic inspection works.

So a green result isn’t a guarantee, only the absence of obvious signs. On someone else’s network it is safest not to rely on its settings and to encrypt your traffic yourself.

At home the main risk is different: not a middlebox on someone else’s network, but weak settings on your own router. You check these in the router and device settings — a browser test can’t see them.

• Replace the default Wi-Fi password from the sticker with a long one of your own.
• Change the router admin password: defaults like admin/admin are guessed in seconds.
• Use WPA2 or WPA3 encryption. WEP and WPA are outdated and crackable.
• Turn off WPS: its PIN login is easy to brute-force.
• Review the list of connected devices and remove any you don’t recognise.
• Put guests and smart-home devices on a separate guest network.
• Keep the router firmware updated: old versions often have known flaws.

• Only join a network whose name the staff confirmed, and forget it afterwards.
• Only open sites over HTTPS and never accept certificate warnings.
• Turn on two-factor authentication for your bank, email and social accounts.
• Disable auto-joining open networks and file sharing.
• For important tasks use mobile data or an encrypted connection that protects all of your device’s traffic.

Nothing. The result is calculated in your browser. The server answers the check requests and records neither your address nor the result. The control page is the same for everyone except a random check number that your browser generates itself.