Retail and restaurant customer Wi-Fi filtering
Customer Wi-Fi is now part of the service in cafes, restaurants, bars, shops and shopping centres. It carries your brand name, runs next to your tills and is used by families, teenagers and strangers alike.
This guide is for store and restaurant operators, franchise IT teams and the providers who install their networks. It covers what to block, how to keep card systems out of reach and how to roll one policy out across many locations.
Why shops and restaurants filter customer Wi-Fi
Few operators filter to control customers. They filter to protect the brand, the people in the room and the business systems next door. Our general guest Wi-Fi content filtering guide covers the basics; this page goes deeper on retail and hospitality floors.
Family space
Children sit at the next table. Explicit content on a phone or laptop is a direct complaint risk.
Brand safety
The network name is your brand. What happens on it reflects on you.
Customer safety
Blocking phishing and malware protects customers who trust your connection.
Payment systems
Tills and terminals must stay out of reach of anything on the guest side.
Fair bandwidth
Online orders, card payments and stock systems need the line more than a torrent does.
Policy suggestions by venue type
The baseline is the same everywhere. What changes between venues is how family-friendly the space is and whether alcohol or gambling are part of the business.
Cafes and coffee shops
Long stays, laptops, remote workers and students. Keep the policy light so people can work, but block Adult and P2P.
Baseline + bandwidth limitsQuick service and family restaurants
Many children, short visits, shared screens. Use the family add-ons and force SafeSearch.
Baseline + family add-onBars and pubs
Adults only in most cases. Sports betting and alcohol brand sites may be part of the experience.
Baseline, Gambling and Alcohol allowedFashion and specialty stores
Short visits, mostly price checks and loyalty apps. A light policy keeps comparison shopping working.
BaselineSupermarkets and pharmacies
Customers use shopping lists, coupons and prescriptions apps. Health information must stay open.
Baseline + family add-onShopping centres and malls
Large public spaces with food courts, play areas and cinemas. Treat as a public venue with the family add-on and strict bypass controls.
Baseline + family add-on + VPN blockingWhich categories to block
Build the policy in layers. Every venue gets the baseline, family venues add the second stack, and adult venues pick from the third. Names come from our 59 web filtering categories.
Baseline: every venue
- Malware / Phishing / Suspicious
- Adult
- Illegal Drugs
- Hate/Discrimination
- File Sharing/P2P
- Parked / For-Sale Domains
Protects customers, the brand and the line, without getting in anyone's way.
Family add-on
- Gambling
- Violence and Weapons
- Dating
- Lingerie/Swimsuits/Intimate Apparel
- VPN / Proxy / Anonymizers
- Forced SafeSearch
For restaurants, malls, supermarkets and anywhere children spend time.
Adult venue choices
- Gambling: often allowed in sports bars
- Alcohol: usually allowed
- Tobacco: depends on local rules
- Streaming Media: shape, do not block
- Gaming: allow or schedule
Keep the baseline in place even where the clientele is adult.
Not sure where a particular site falls? Check it with our domain lookup before adding it to an allow or block list. A domain can carry several categories, ranked by how much of the site they describe.
Network design: four separate networks
Filtering only works if the right traffic is on the right network. Most stores and restaurants need four, even if they share the same access points.
Guest Wi-Fi
Captive portal, client isolation, DNS filtering with the venue profile and a bandwidth cap per device.
Staff devices
Rota apps, training, email. Security categories plus a staff policy, separate from customers.
Kitchen and stock
Kitchen displays, ordering tablets, stock scanners, music and signage. Allow lists where possible.
POS and terminals
Card terminals and tills on their own segment, reachable only by what they need.
PCI DSS and customer Wi-Fi
- PCI DSS treats wireless networks as untrusted
- A guest network that can reach the cardholder data environment is pulled into scope
- Firewall rules, not only VLAN tags, should separate guest and payment traffic
- Segmentation should be tested, and rogue access points looked for
Where filtering helps PCI
- Blocking phishing on staff and back office networks protects logins to payment portals
- Allow lists on payment and operations networks limit what malware could reach
- DNS logs on the payment segment can reveal unexpected destinations
- Your assessor decides scope; talk to them before changing the design
How to deploy customer Wi-Fi filtering
Pick the option that matches who will look after the network. A single cafe and a 400-store chain need very different setups, but both can use DNS filtering at the core. See what DNS filtering is for the basics.
Router DNS setting
For a single venue: set the guest network's DNS server on your existing business router to a filtering service and choose the profile.
Minutes of work, no new hardware.
Hosted filter for many sites
Our managed DNS filter gives each store or restaurant its own profile in one console, with schedules, a branded block page and monthly reports.
Good for chains and franchise groups.
Firewall or SD-WAN
Larger chains often run a managed firewall or SD-WAN in every store. Use it to force DNS through the filter, separate payment traffic and shape bandwidth.
Avoid HTTPS inspection on customer devices.
Stop the bypasses
Block outbound DNS except to the filter, and decide whether to block VPN / Proxy / Anonymizers. Read about encrypted DNS and filtering before you decide.
Test like a customer
Join with a phone, try sites from each blocked category, and check your own app, menu, online ordering and loyalty pages.
Review monthly
Look at top blocked categories per site and any customer complaints. Adjust the profile, not individual store settings, where possible.
The captive portal: say it short and kind
Welcome to our free Wi-Fi
Enjoy your visit. To keep this a safe place for everyone:
Separate access from marketing
In many countries, consent to marketing must be a free choice. Do not make the Wi-Fi depend on signing up to emails, and keep the opt-in box unticked.
Collect only what you use
An email address may be useful. Date of birth, phone number and social login data usually are not, and each one adds to your data protection duties.
Explain the logs
Say what the network records, why and for how long, in a short privacy notice linked from the portal.
Do not list blocked sites
A short reason is enough. Lists of blocked brands invite arguments and go out of date.
HTTPS block pages
Customer devices show a certificate warning if you try to display a block page for an HTTPS site. A silent block plus a clear portal message works better.
Staff, kitchen and back office devices
The customer network gets the attention, but staff devices are where most real incidents start. A manager's laptop that opens a fake invoice can do far more damage than any customer phone.
Manager and office PCs
Block Malware / Phishing / Suspicious and newly registered domains. These machines reach banking, payroll and supplier portals.
Shared staff tablets
Ordering, rota and training tablets are used by many people. Apply a staff profile that blocks Adult, Gambling and P2P.
Kitchen displays and signage
These should only reach their own services. Use allow lists and block everything else.
Music and screens
In-store music and TV systems need streaming services. Allow them by domain on the operations network.
Staff personal phones
Put them on the customer network or a separate staff guest network, never on operations or payments.
AI tools at work
Decide whether staff may use AI / LLM Tools on back office PCs that hold customer or supplier data.
Bandwidth and fair use
Customer Wi-Fi shares a line with card payments, online orders and delivery apps. Filtering and traffic shaping together keep the business side working at peak hours.
Per-device caps
A modest speed limit per customer device is the simplest fairness rule. Most customers never notice it.
Block the heavy hitters
File Sharing/P2P is the category that most often fills a small line. Large game downloads come next.
Priority for business traffic
Give payments, ordering and delivery apps priority on the operations network so customers cannot slow them.
Reading the monthly report
The report is not for watching customers. It tells you whether the policy fits the venue and whether anything is wrong on the business side.
Many blocks in one category
If a category you blocked shows heavy demand, check whether it is a real risk or simply something customers need, such as streaming in a cafe with long stays.
Security blocks on the operations network
Phishing or malware blocks from a till or kitchen device suggest a compromised device. Investigate quickly.
Unknown destinations from payment systems
Payment devices should talk to very few services. New destinations deserve a question to your POS provider.
Spikes after hours
Traffic on customer Wi-Fi when the venue is closed often means the signal reaches the street. Add a schedule or reduce the range.
Rolling out across a franchise or chain
Chains need one brand standard that store teams cannot accidentally break, with room for a few local variations. Decide who owns each part before the first store goes live.
| Decision | Who owns it | Typical choice |
|---|---|---|
| Brand-wide baseline profile | Head office IT or brand standards team | Baseline categories plus family add-on for family brands |
| Local variations | Regional or franchise operations | Bar profile for licensed venues, stricter profile near schools |
| Always-allow list | Head office | Brand app, ordering, loyalty, payment and supplier domains |
| Review requests | Central support desk | One form for store teams, answered centrally |
| Reports | Head office, shared with franchisees | Monthly per store and per region |
| Network hardware | Franchisee or managed provider | Must support separate guest network and custom DNS |
Common mistakes on customer Wi-Fi
Most of these are cheap to fix once someone notices them.
Guest and tills on one network
The single most serious mistake. It exposes payment systems and pulls the whole network into PCI scope.
Wi-Fi password on the wall
Fine for customer Wi-Fi, but not when the same password opens the staff network.
Blocking Social Networking
Customers check in, post photos and tag your venue. Blocking it costs free marketing.
No bandwidth limit
One customer downloading a game can slow card payments for the whole store.
Router left on defaults
Default admin passwords and old firmware are a bigger risk than any website.
Forgotten after setup
Nobody reads the reports, so problems surface only as customer complaints.
Legal pointers
General information, not legal advice. Laws differ by country and state, and change over time.
EU: intermediary protection
In the McFadden case (2016), the EU Court of Justice held that a shop offering free Wi-Fi can rely on the mere conduit protection for users' copyright infringements, but may be ordered to take measures such as password protection.
EU and UK: data and marketing
Portal sign-ups and logs are personal data under GDPR or UK GDPR. Electronic marketing rules generally require separate, freely given consent.
United States
Copyright safe harbours exist for some service providers, with conditions. State privacy laws may apply to data collected on the portal. Ask counsel how they apply to you.
Payment card rules
PCI DSS applies to anyone handling card data. Customer Wi-Fi design affects your scope; confirm it with your assessor or acquirer.
For Wi-Fi marketing, POS and network vendors
Guest Wi-Fi platforms, POS providers with network add-ons and managed network companies for retail and hospitality can offer filtering as part of their own product.
Our OEM licensing gives you the category data to build it, and MSP web filtering covers providers who manage many small venues.
- 120 million categorized domains in 59 web filtering categories, plus the IAB Content Taxonomy for audience and context features
- About 300,000 newly registered domains categorized daily, delivered as delta files
- Runs inside your own systems, with a lookup API included
- DNS RPZ, hosts and firewall list exports for licensed customers
- Starter database tiers from $999; OEM licences quoted per deployment
Customer Wi-Fi filtering FAQ
Should a cafe or shop filter its customer Wi-Fi?
Most do. A basic filter blocks malware, phishing and adult content, which protects customers, keeps explicit content off screens in a family space and reduces the chance of the connection being misused.
What should a restaurant block on its Wi-Fi?
A common baseline is Malware / Phishing / Suspicious, Adult, Illegal Drugs, Hate/Discrimination and File Sharing/P2P. Family restaurants often add Gambling, Violence and Weapons.
Can customer Wi-Fi share a network with the card terminals?
It should not. Keep customer Wi-Fi separated from point-of-sale and payment systems with firewall rules.
How do I filter Wi-Fi without buying new equipment?
Change the DNS server on the guest network of your existing router to a DNS filtering service, then pick categories in its dashboard.
Can franchise chains set one policy for all stores?
Yes. Use a central console with a brand-wide profile, then allow small local variations such as a bar profile in licensed venues.
Will a filter slow down our Wi-Fi?
DNS filtering adds almost no delay, because it only answers the lookup that happens before a site loads. Slow customer Wi-Fi is nearly always a bandwidth or coverage problem, which caps and traffic shaping fix better than blocking.
Should we block VPNs on customer Wi-Fi?
Cafes and business-friendly venues usually allow them, because remote workers need them. Family restaurants, malls and venues with many teenagers often block VPN / Proxy / Anonymizers so the filter cannot be bypassed easily.
What if a customer says a normal site is blocked?
Give staff one way to report it, check the domain's category, and add it to the always-allow list for that venue or the whole brand if it is a mistake. Keep the process short so the customer is not left waiting.
Is collecting emails on the Wi-Fi login page allowed?
It depends on the law where you trade. In the EU and UK, marketing consent must be freely given and separate from access to the Wi-Fi. Take local advice.
One policy for every store
Tell us how many venues you run, or what your Wi-Fi or POS platform needs. We will suggest the hosted filter or a data licence.