My team works from cafés and home Wi-Fi: is public Wi-Fi safe for business work?
⏱ In about 9 minutes
Affiliate disclosure: Some links on this page may become affiliate links. If you buy, we may earn a commission at no extra cost to you. Commissions may influence which products we choose to cover, but not our assessment of them. Read the full disclosure.
In this article
The short answer
Short answer
Public Wi-Fi is much safer than it used to be, because most websites and apps now encrypt your connection (that's the "https" and padlock). The bigger risks for a remote team are usually stolen passwords, missing updates, and people seeing screens over shoulders, not the café's network itself.
So: fix the basics first (MFA, password manager, updates, screen locks). Then, if staff regularly handle sensitive data on networks you don't control, or need to reach company systems, a business VPN such as Proton VPN adds a sensible extra layer. Where you can, use a phone hotspot instead of public Wi-Fi for anything sensitive.
The honest picture, without the hype
Government agencies don't all say it the same way, and that's worth understanding.
- The US Federal Trade Commission (FTC) says that "because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe." (FTC)
- The US Cybersecurity and Infrastructure Security Agency (CISA) goes further. It says the old advice "to never shop online using a coffee shop's wi-fi connection" had "some truth" a decade ago, but "that's not how people and organizations are compromised today." (CISA)
- The Australian Cyber Security Centre (ACSC) is more cautious for work use: public Wi-Fi networks "can be insecure and are often targeted by cybercriminals". It advises using "trusted networks such as your home Wi‑Fi or a personal hotspot", and, if you must use public Wi-Fi, to "limit what you access and avoid activities involving sensitive information, such as logging into accounts or making payments." (ACSC, Remote working security)
Our read: these fit together. Encryption has removed most of the old "someone on the café network can read everything" risk. But networks you don't control can still be fake or misconfigured, and the ACSC's caution makes sense for business data. The practical answer is to make your team safe wherever they connect.
What HTTPS already protects (and what it doesn't)
It protects: the content travelling between the device and the website, such as passwords, emails and payment details. The FTC says to "look for a lock symbol or https in the address bar". (FTC)
It doesn't protect against:
- Fake websites. The FTC warns scammers "create fake websites and encrypt them to make you think they're safe when they're not." A padlock means the connection is encrypted, not that the site is honest.
- Phishing and password reuse. If someone types a reused password into a fake login page, Wi-Fi has nothing to do with it.
- Out-of-date devices. Unpatched software is a far bigger door than café Wi-Fi.
- Shoulder surfing. The ACSC advises avoiding "accessing sensitive information when in public locations." (ACSC)
Fix it: step by step
The time guides are rough, for a team of about 5–20 people.
Step 1: Lock down accounts first (1–2 hours)
MFA on email and other key accounts, and unique passwords in a password manager. These protect your team on any network. See our password reuse guide.
Step 2: Keep devices updated and locked (30 minutes)
Turn on automatic updates. Set screens to lock automatically after a short period. The FTC also recommends keeping "security software, operating system, and internet browser" up to date. (FTC)
Step 3: Prefer a phone hotspot for sensitive work (5 minutes per person)
The ACSC names "a personal hotspot" as a trusted option. For banking, payroll or customer records, tether to a phone rather than joining public Wi-Fi. (ACSC)
Step 4: Secure the home router (20 minutes per home)
Home Wi-Fi is "trusted" only if it's set up properly. The ACSC's list: change the default Wi-Fi name and password, change the router's default admin username and password, "use the strongest Wi-Fi encryption available", keep the router updated, and "disable remote management and Universal Plug and Play". (ACSC)
Step 5: Decide whether you need a business VPN (15 minutes to decide)
A business VPN encrypts all traffic from the device to the VPN service and can control access to company systems. It's worth it when:
- staff regularly work from public or shared networks with sensitive data;
- you need to reach internal systems or whitelist access by IP address;
- you want to enforce settings centrally across devices.
It's less important when your team mainly uses well-known cloud apps over HTTPS, with MFA on.
Step 6: Use secure file transfer, not USB sticks (ongoing)
The ACSC advises avoiding removable media and using "secure methods of file transfer such as cloud storage from a reputable provider." (ACSC)
Quick pick
Quick pick: tools for teams who work on the move (product details from official vendor pages, checked 18 Oct 2026. Not hands-on tested. No ratings. Confirm prices and features on the vendor's site.)
Best for most small teams that need a VPN: Proton VPN for Business. VPN Essentials (minimum 2 users) lists NetShield protection against "malware, phishing, scam & ad" threats, centralised user management with organisation-wide 2FA enforcement, a kill switch and always-on VPN, on Windows, Mac, Linux, iOS and Android. 14-day free trial and 30-day money-back guarantee. VPN Essentials listed at US$6.99 per user/month (minimum 2 users) on a discounted rate when we checked, 19 Oct 2026 (Proton VPN pricing). → See our cybersecurity guide- If you want device protection managed in one place: Bitdefender GravityZone Small Business Security. Bitdefender says it covers 1 to 100 devices with anti-phishing and ransomware mitigation from a central console. Pricing depends on device count. → See our cybersecurity guide
Don't forget the free steps above first. See all our quick picks.
Honest limits
Free: the Small Business Password & Access Checklist
A 1–2 page checklist that turns this article into a to-do list: which accounts to protect first, how to set up shared access, and what to do when someone joins or leaves.
You only get emails if you tick the consent box. Unsubscribe any time. See our privacy policy.
Frequently asked questions
Is hotel Wi-Fi any different from café Wi-Fi?
Treat them the same: unknown networks. Use HTTPS sites, MFA and a hotspot or VPN for sensitive work.
Do we need a VPN if all our apps are in the cloud?
Not necessarily. Well-known cloud apps already encrypt connections. A VPN becomes more useful if you handle sensitive data on public networks often, or need to reach internal systems.
What's the single most useful habit for remote staff?
Lock screens and MFA. A lost or unattended laptop, or a stolen password, is a more common problem than a hacked café network.
Is it OK to join Wi-Fi with no password?
For browsing, usually. For business accounts, prefer a hotspot. The ACSC advises avoiding logging into accounts or making payments on public Wi-Fi.
Related guides
- Cybersecurity tools
- 10-step basic cybersecurity checklist
- My staff reuse passwords: how to fix it this week
- Do I really need antivirus on business laptops?
Sources
Government bodies first. All links checked and loading on 18 Oct 2026.
- Australian Cyber Security Centre: Small business cyber security handbook: remote working security
- US Federal Trade Commission: Are public Wi-Fi networks safe? What you need to know
- US Cybersecurity and Infrastructure Security Agency: Cyber guidance for small businesses
- Vendor pages (checked 18 Oct 2026): Proton VPN for Business · Proton VPN business pricing · Bitdefender GravityZone Small Business Security
About our review process
We pick products from official information and say clearly when we haven't tested something hands-on. Commissions may influence which products we choose to cover, but not our assessment of them. See how we work.