How to Secure Your Mac on Public Wi-Fi

Difficulty
Beginner
Tested on
macOS 15.0 - MacBook Pro M3
You will need
macOS Sonoma or later, Active VPN subscription (optional but recommended)

Step by step

  1. 30 sec

    Disable automatic network joining

    Open System Settings from the Apple menu. Navigate to Wi-Fi and toggle off 'Ask to join networks' to prevent your Mac from connecting to rogue access points automatically.

    Note: Keeping this disabled prevents your Mac from broadcasting its presence to malicious networks.
  2. 1 min

    Activate the system firewall

    Go to System Settings and select Network. Click on Firewall, then toggle the switch to On. This restricts incoming connections to only essential system services.

    Note: Check 'Block all incoming connections' in Options if you are in a high-risk environment.
  3. 1 min

    Enable stealth mode

    Within the Firewall menu, click Options. Enable 'Stealth Mode' to prevent your Mac from responding to ICMP (ping) requests, making your device invisible to network scanners.

    Note: Stealth mode is highly effective for public Wi-Fi, but may interfere with local network discovery if enabled at home.
  4. 2 min

    Establish a VPN tunnel

    Install a reputable VPN client and connect before accessing any web services. A VPN encrypts all traffic leaving your Mac, rendering data unreadable to anyone on the same public network.

    Note: Ensure the 'Kill Switch' feature is active in your VPN settings to prevent traffic leaks.
  5. 1 min

    Disable file and printer sharing

    Navigate to System Settings > General > Sharing. Ensure 'File Sharing' and 'Printer Sharing' are set to Off to prevent unauthorized local access to your shared folders.

    Note: Review this list periodically to ensure no background processes have enabled sharing services.
  6. 30 sec

    Forget the network after use

    Once finished, go to System Settings > Wi-Fi. Locate the public network, click the ellipsis (...) button, and select 'Forget This Network' to clear credentials and prevent future auto-joins.

    Note: This is critical for airports and coffee shops where network names are common.