Assume any Wi-Fi you don't own is monitored to some degree, because basic logging leaves no sign on your device. Routers record which devices connect, when, and how much data they use, and the owner can often see which domains you visit. What you can detect is the more aggressive kind of monitoring that tries to read inside encrypted traffic.
What the network can see without you knowing
HTTPS hides the pages, passwords, and messages you send. It doesn't hide the site name, which is sent in readable form during the connection, and ordinary DNS lookups reveal the same. A hotel, landlord, or employer can log all of that silently.
Signs of deeper interception
- Certificate warnings on familiar sites. If Gmail or your bank suddenly triggers a "connection not private" error, something may be trying to impersonate the site. Don't click past it.
- A "network may be monitored" alert on Android. Android shows this when a user-installed certificate is on the device, which could let someone decrypt your traffic.
- Extra trusted certificates on iPhone. Check Settings > General > About > Certificate Trust Settings. If that section exists, an extra certificate has been installed. Also look under Settings > General > VPN & Device Management for profiles you don't recognize.
- Wi-Fi portals that ask you to install something. A network that requires a certificate or profile to get online wants visibility into your traffic.
What to do
Remove certificates and profiles you didn't install yourself, unless your employer manages the device. Then encrypt your traffic before it reaches the router: a VPN such as NordVPN leaves the network owner seeing only that you're connected to a VPN server and how much data moves, not the sites you visit.