Is the Wi-Fi password on the chalkboard a problem?

Yes. A password on the wall is a password everyone has, including people who never buy anything, and it ends up in the apps that collect and share cafe passwords. Take it off the wall today and have staff give it out.

Am I responsible for what guests do on my cafe's Wi-Fi?

It falls on you, because you pay the internet bill. If a guest does something illegal on your Wi-Fi, the copyright notice from your internet provider comes to you, not to the guest, and providers can cut off service after repeated notices. The way you show it was a guest, and which one, is terms they accepted when they signed in plus a record of who was online and when. Have a lawyer look at the wording of your terms once, then leave it alone.

Can I fix cafe Wi-Fi security with the router I have?

Eleven of the 21, yes. Changing the router's factory login, turning on guest isolation, and turning off WPS are examples, and they all work on the router you already have. The other ten need a sign-in page and a record of who signed in, and the router your provider supplied has neither. The check tells you which of the eleven apply to your cafe and the order to do them in.

How long does the Cafe Wi-Fi Safety Check take?

About five minutes. You get a score out of 100, your biggest exposures in plain language (up to three), and the full fix list in the order we'd do them.

What is a captive portal?

A captive portal is the sign-in page guests see when they join your Wi-Fi, before they get online. It is where guests accept your terms, where each sign-in is recorded with a time, where you remove one guest with a tap, where session length is set, and where your brand, your specials, and your email list live. The router your internet provider supplied does not have one.

How long should I keep records of who used my Wi-Fi?

At least three months. A copyright complaint from your provider, or a request from the police, usually shows up weeks after the fact, not the same day. Longer does not hurt. Records only exist once something on the network is writing down who signed in and when.

Should guests be on the same Wi-Fi as my card reader?

No. Guests should be on their own network, kept apart from anything that runs your business. A compromised phone on the same network as your point-of-sale system is a phone sitting next to the machine that processes credit cards.

All posts

Security

Is your cafe's Wi-Fi safe? 21 questions every cafe owner should be able to answer

September 17, 2026

Most cafes and coffee shops run their guest Wi-Fi on the router the internet provider dropped off on day one, and nobody has logged into it since. The login for its settings is still the one it came with from the factory, and for almost any router you can look that one up online. It has no sign-in page, so your guests never agreed to any rules before getting online, and it keeps no record of who was on it and when.

That's not a criticism. It's where most cafes are, and all of it is fixable. This article walks through the 21 questions in the free Cafe Wi-Fi Safety Check, and at the end you can run the check yourself in about five minutes. It applies to any place where people sit down with a coffee: cafes, bakeries, coffee bars, tea houses, and small restaurants.

The check asks 21 questions in seven parts: how guests get on, what you can do about one problem guest, the router itself, guest privacy, terms and records, what happens when it breaks, and what you get back. The five that matter most for safety are whether the login for your router's settings is still the factory default, whether guests accept terms before they connect, whether you could show who was online at a given time, whether you can remove one guest without changing the password for everyone, and whether one guest can see another guest's devices. Eleven of the 21 fixes can be done today on the router you already have. The other ten need a captive portal, the sign-in page guests see when they join, and a basic router doesn't have one.

Why cafe Wi-Fi is different from home Wi-Fi

At home, the Wi-Fi is used by a handful of people you know. In a cafe, it's used by strangers all day, on one shared password, on a router that was built for a living room. Every one of those strangers is on your internet account. If one of them downloads something illegal, the copyright notice from your internet provider comes to whoever pays the bill, and that's you. If one of them pokes at another guest's laptop, it happens on your network. And if the router locks up on a Saturday morning, you've got a room full of people packing up and leaving.

The Wi-Fi is also the busiest thing in the cafe, and most owners get nothing back from it: no emails, no idea who came back, and no way to reach a regular who stopped coming in.

If you want the short version first, Wi-Fi Security 101 for coffee shop owners covers the open-network and shared-network problems in plain language. This article goes question by question.

The 21 questions

The check runs in seven parts.

Getting on. How do guests get on your Wi-Fi? When did the password last change? Could someone use it from the parking lot at 2am?

Staying in control. Can you remove one guest without changing the password for everyone? Can you cap how much speed one person uses? Can you see how many devices are connected right now? Can you set how long a guest stays connected?

The router. Who set it up? Is the login for its settings still the one it came with from the factory? When did it last get a security update? Is the WPS button on?

Guest privacy. Can one guest see another guest's laptop or phone on your Wi-Fi? Could someone set up a fake network with your cafe's name?

Terms and records. Do guests accept any terms before they get online? If your provider sent a copyright complaint for 2pm last Wednesday, could you show who was online? How long do you keep records?

When it breaks. The Wi-Fi goes down at 8am on a Saturday. Who fixes it? How often does the router need a restart?

What you get back. What do guests see when they connect? Do you know how many people used your Wi-Fi yesterday? Could you reach any of the guests who used it last month?

The five that matter most

The check puts every fix in the order we'd do them, and these five come first: the router login, the terms guests accept, the record of who was online, the way to remove one guest, and the setting that keeps guests apart from each other.

The factory username and password for almost every router model is published online. Anyone on your Wi-Fi can type the router's address into a browser, enter that login, and control your network. They can change your password, send your guests to fake sites, or lock you out. Changing it takes five minutes.

Do guests accept terms before they connect?

Terms are where you say what the Wi-Fi is for and what isn't allowed on it. If guests never agreed to anything, you have nothing to point to when one of them breaks the rules.

Could you show who was online at a given time?

A copyright complaint from your internet provider comes to you, not to the guest. Providers can cut off service after repeated complaints. A record of who signed in and when is how you show it was a guest, and which one. Keep those records for at least three months. A complaint from your provider, or a request from the police, usually shows up weeks after the fact, not the same day.

Can you remove one guest without changing the password for everyone?

With one shared password, the only way to remove one person is to change it for the whole cafe and tell every regular the new one. Some routers can block one device if you can find its address in the settings, and that's worth trying. A managed network does it in one tap and keeps that person off for good.

Can guests see each other's devices?

On a lot of networks every device can see every other one, the way computers in an office can. One guest can poke at another guest's laptop from across the room. Look in your router for a setting called guest isolation, client isolation, or AP isolation, and turn it on. Guests keep their internet and lose the view of each other.

What you can fix today, and what you can't

Eleven of the 21 fixes work with the router you already have. Changing the router's factory login, turning on guest isolation, and turning off WPS are afternoon jobs, and most of the others are too. Which of the eleven apply to your cafe, and the order to do them in, is what the check works out for you, with the fix for each one.

The other ten need two things a basic router doesn't have: a sign-in page in front of the network (a captive portal), and a record of who signed in and when. That's where guests accept your terms, where you remove one guest with a tap, and where your brand and your email list live. Getting both means business-grade equipment that someone sets up and looks after, or a managed network, which is guest Wi-Fi run by a company instead of by whoever set up the router. Barista WiFi is one of those, built only for coffee shops and cafes. Alex Vodola founded it and runs it from Orlando, Florida, and we're the company behind this check.

Run the check

Take the Cafe Wi-Fi Safety Check. It's 21 questions, it doesn't ask for your email, and it gives you the fix for every gap it finds, in the order to do them.

Questions cafe owners ask

Is the Wi-Fi password on the chalkboard a problem?: Yes. A password on the wall is a password everyone has, including people who never buy anything, and it ends up in the apps that collect and share cafe passwords. Take it off the wall today and have staff give it out.
Am I responsible for what guests do on my cafe's Wi-Fi?: It falls on you, because you pay the internet bill. If a guest does something illegal on your Wi-Fi, the copyright notice from your internet provider comes to you, not to the guest, and providers can cut off service after repeated notices. The way you show it was a guest, and which one, is terms they accepted when they signed in plus a record of who was online and when. Have a lawyer look at the wording of your terms once, then leave it alone.
Can I fix cafe Wi-Fi security with the router I have?: Eleven of the 21, yes. Changing the router's factory login, turning on guest isolation, and turning off WPS are examples, and they all work on the router you already have. The other ten need a sign-in page and a record of who signed in, and the router your provider supplied has neither. The check tells you which of the eleven apply to your cafe and the order to do them in.
How long does the Cafe Wi-Fi Safety Check take?: About five minutes. You get a score out of 100, your biggest exposures in plain language (up to three), and the full fix list in the order we'd do them.
What is a captive portal?: A captive portal is the sign-in page guests see when they join your Wi-Fi, before they get online. It is where guests accept your terms, where each sign-in is recorded with a time, where you remove one guest with a tap, where session length is set, and where your brand, your specials, and your email list live. The router your internet provider supplied does not have one.
How long should I keep records of who used my Wi-Fi?: At least three months. A copyright complaint from your provider, or a request from the police, usually shows up weeks after the fact, not the same day. Longer does not hurt. Records only exist once something on the network is writing down who signed in and when.
Should guests be on the same Wi-Fi as my card reader?: No. Guests should be on their own network, kept apart from anything that runs your business. A compromised phone on the same network as your point-of-sale system is a phone sitting next to the machine that processes credit cards.