Café Wi-Fi and network basics: separate guest and POS networks, router placement and a backup line

On opening day, almost everything in a café depends on the internet: the register, the card readers, online orders, the kitchen printer, the music, the staff app and the temperature sensors in the walk-in. The network is usually set up in a hurry, by whoever installed the internet, with the router left wherever the cable came in.

An afternoon of planning before you open avoids most of the problems. This is the third post in our series on setting up the tech for a new café, after choosing a POS and online ordering.

This is general information, not a security audit. For anything beyond the basics, ask your internet provider, your POS vendor or an IT professional to check your setup.

List everything that needs the internet

Walk through the café and write down every device that will connect. A typical list:

The "who owns it" column decides which network each device goes on.

Two networks, at least

The FTC's guidance for small businesses says: "Limit your primary business network to business-owned, operated, or managed devices. If you need Wi-Fi access for guests, employee personal devices, or the public, you can follow step-by-step prompts in your network's admin portal to set up a separate 'public' network" (FTC: Cybersecurity for Small Business).

So, at least:

1. The business network: the POS, card readers, printers, office computer, kiosk tablet and other devices the business owns. A strong password that only managers know, and no guests.
2. The public network: guests, and staff's own phones. Its own name and its own password, which you can change without touching the register.

Note that staff phones go on the public network, not the business one. That feels odd at first, but a personal phone isn't a device the business manages, and the FTC's wording puts "employee personal devices" with guests.

Some cafés also put TVs, speakers and other gadgets on a network of their own, so a cheap smart device never sits next to the register. Whether you can depends on your router. Ask your installer.

Our post on Wi-Fi and laptop policy covers the guest side: whether to offer Wi-Fi at all, how to word the signs, and the FTC's rule that guest Wi-Fi must be "separate from and not connected to your business network."

Secure the router before you open

Routers arrive with settings meant to be easy to install, not safe to run. The FTC's checklist for the wireless network:

• "Secure your router. After you set up a router, change the default username and password, turn off remote management, and log out of the administrator account."
• "Use at least WPA2 encryption. Make sure your router offers WPA2 or WPA3 encryption, and that it's turned on."
• "Password-protect your network. Log into your Wi-Fi admin portal and create a strong password for staff to use to connect business-owned, operated, or managed devices to your network."

On passwords, the same page says "A strong password is at least 12 characters." CISA goes further for business accounts, asking for passwords "At least 16 characters long (more is better)," and warns that devices come with default logins that "may be printed on the device or listed online. Require staff to change default credentials before using systems" (CISA: Require strong passwords). That applies to the router, the cameras, the music player and the sensor gateway, not just the Wi-Fi.

Then keep it updated. CISA's advice for small businesses: "keep your software up to date and replace any hardware or software that is 'end of life,' or no longer supported" (CISA: Update business software). Turn on automatic updates in the router's settings if it has them, and ask your internet provider whether they update the equipment they supplied.

Wire the register where you can

Wi-Fi is convenient. A cable is more reliable. Toast's platform guide says its "terminals and access points typically have hard-wired Ethernet connections to the router," and that "Toast support recommends using hardwired connections where possible" (Toast: Offline mode overview). Whatever POS you choose, ask the vendor which devices should be wired.

This is a decision to make before the counter is built. Running a cable to the register, the kitchen printer and the back office is easy with the walls open and a chore once the millwork is in.

Where to put the router

The router usually ends up where the internet line enters the building, often a back corner. That's rarely the best place for Wi-Fi. A few practical rules:

• Somewhere staff-only. Keep the modem, router and any switch out of reach of guests, so nobody unplugs them to charge a phone. A labeled shelf in the office or a small network cabinet works.
• Not inside metal. A router inside a metal cabinet, behind the espresso machine or against the walk-in loses range.
• Central, and up high, if you can run the cable there. Wi-Fi spreads out from the router, so one in a back corner leaves the far side of the dining room and the patio weak.
• Add access points instead of a stronger router if the space is large or has thick walls. Wire them back to the router where you can.
• Test before opening. Walk the café with a phone and check the connection at the counter, every table, the patio, the back office, the kitchen and next to the walk-in, where a temperature sensor's gateway may need to reach.

A backup connection

When the internet goes down, so does most of the counter. Two options are worth asking about:

• A backup line from your internet provider, often a cellular box that takes over when the main line drops. Ask what it costs and whether it switches over by itself.
• A phone hotspot for the register in a pinch. Square's support center, for example, says its POS apps can use "a Wi-Fi, Ethernet, or data service (such as 4G, 5G, or EDGE) on your mobile device" (Square: Process offline payments). Check what your POS supports before you need it.

And know what your POS does offline. The POS post lists the questions to ask, and a later post in this series turns the answers into a downtime plan.

Write it all down

The day the internet fails, nobody remembers the router login. Keep a one-page network sheet in the office, and the passwords in a password manager, not on a sticky note:

• Internet provider, account number and support phone number
• Where the modem, router and switch are, with a photo of how they're cabled
• Network names (business, public, any others) and who has each password
• Router admin login (in the password manager, not on the sheet)
• Which devices are wired and which are on Wi-Fi
• The backup connection and how to switch to it
• When the guest password was last changed

Your network checklist

• Every device listed, with who owns it
• A business network for business-owned devices only
• A separate public network for guests and staff phones
• Router default login changed, remote management off, WPA2 or WPA3 on
• Long, unique passwords, stored in a password manager
• Default passwords changed on cameras, music players and sensor gateways
• Automatic updates on, and old equipment replaced when it's no longer supported
• Register, printers and office wired where possible
• Router in a staff-only spot, with coverage tested everywhere it's needed
• A backup connection, and staff who know how to use it
• A one-page network sheet in the office

Where Mays fits

The Mays apps and the devices connected to Mays use the same network as everything else, so a few things are worth knowing:

• Staff phones on guest Wi-Fi. If a phone is on a Wi-Fi network with a sign-in page, the Mays app shows Unable to reach the server. Check your connection. Sign in to the network in the browser, or switch to mobile data. The app needs a connection to clock in, complete tasks and send messages; there's no offline mode. See Troubleshooting the Mays app.
• Temperature sensors need Wi-Fi too. Govee thermometers report through their Wi-Fi gateway, and Mays records a reading from each sensor about every five minutes. A sensor that can't reach the internet shows as Offline, and an offline sensor doesn't alert, so place the gateway within range of the walk-in. See Setting up Govee thermometers and Temperature thresholds and alerts.
• Menu screens. A TV running Mays Player needs internet to get changes. If it starts without a connection it shows Waiting for network…. See Pairing a signage screen.

Set up the network before the furniture

Plan the cables, separate the networks, lock down the router and test the coverage before the counter goes in. It's the cheapest fix you'll ever make to your café's tech.

Start your free trial: 30 days, every module, no card needed. Want help setting up thermometers and kiosks on your network? Book a walkthrough.