In short: Public Wi-Fi has not become safer just because more sites use HTTPS. The network itself still leaks which services you use, exposes devices with weak defaults, and lets a nearby attacker set up a look-alike hotspot you connect to without noticing. A VPN does not fix everything, but it removes the single biggest weakness of an untrusted network — anyone else on it being able to see and shape your traffic.
Why open networks are risky by design
An open hotspot has no encryption between your device and the router. Everyone connected shares the same air. That means a stranger two tables away can, with free tools, watch the metadata of your session: which domains you reach, how often, and from what device. HTTPS hides the contents of a page, but not the fact that you opened your bank, your mail provider or a dating app.
The second problem is trust. When you join "Airport_Free_WiFi", you have no way to prove the router is really run by the airport. Attackers create hotspots with friendly names precisely because phones and laptops will happily reconnect to a remembered name automatically.
The three attacks that still work
Evil twin. A cheap device broadcasts a network name identical to a legitimate one. Your phone reconnects, and all traffic flows through the attacker first.
Captive-portal traps. The "accept the terms" page you see on hotel Wi-Fi is a web page the network fully controls. A malicious one can push fake update prompts or harvest the email and room number you type in.
Downgrade and injection. On unencrypted links an attacker can try to strip a connection back to plain HTTP for sites that are not strict about it, or inject scripts into pages that still load mixed content.
How a VPN changes the picture
A VPN wraps every packet leaving your device in an encrypted tunnel to a server you chose. On the local network, an attacker now sees one thing: an encrypted connection to a VPN endpoint. No domains, no per-app patterns, no room for injection or downgrade — because there is nothing readable to tamper with. The evil-twin hotspot still forwards your traffic, but it can no longer read or alter it.
This is exactly the case where a VPN earns its keep. Limp Secure VPN keeps a no-logs policy, so while the tunnel protects you locally, the provider on the other end is not quietly building the profile you just denied the café.
A five-minute public-Wi-Fi routine
Turn off "auto-join" for open networks so your phone stops reconnecting to remembered names. Keep the VPN set to connect automatically on untrusted Wi-Fi. Treat any "install this to continue" or "update required" prompt on a captive portal as hostile. And keep two-factor authentication on your important accounts, so a stolen password alone is not enough.
None of this requires expert knowledge — it is a habit. The network you cannot vouch for is the one where the tunnel should always be on.