Guest WiFi security
Is your Guest WiFi safe?
A 60-second check for UK pubs, hotels, cafés and salons handing the same WiFi password to everyone. No tech knowledge needed.
Free WiFi keeps customers in their seats and spending. But the way most venues set it up quietly puts the business at risk long before it puts anyone’s data at risk — one password on one flat network is all it takes.
What is actually at stake
Start with the till, not the law.
None of this needs a hacker. It is what one shared password on one flat network does on an ordinary Tuesday.
One flat network puts the till within reach.
If guests join the same network as your card terminal, EPOS, booking computer, office PC or cameras, then a stranger’s laptop is sitting alongside the systems the business runs on. Those systems were never designed to share a network with whoever came in for a pint.
A shared password is a key that is never handed back.
Chalked on the board or printed on the receipt, it goes home with everyone who has ever had it. The member of staff who left in March, the delivery driver, the table by the window — any of them can rejoin from the car park months later. The password does not know who it is letting in.
It is your line, and your name above the door.
Whatever a guest does on your broadband traces back to your account, not theirs. Adult content on the connection a family is sitting next to is a complaint, a review and an awkward conversation — and none of it needs anyone to be clever about it.
The bigger picture
You are not too small to be worth it.
Five figures, each with its publisher, its year and a link you can follow. If we could not source it, it is not on this page.
43%
of UK businesses were breached or attacked in the last 12 months
The government surveys UK businesses on this every year. Just over four in ten reported a cyber security breach or attack of some kind.
46%
of small businesses were among them
Small businesses 46%, micro businesses 42%. Being small, or being a pub rather than a bank, is not cover.
38%
were hit by phishing
Phishing remained the most prevalent type of breach or attack by far — the fake invoice, the fake supplier, the fake bank.
£225,000
in fines for marketing people had not agreed to
January 2026: one company fined £120,000 over 4,046,947 texts, another £105,000 over 67,772,285 emails, both under regulation 22 of PECR. The ICO: businesses must only send marketing messages to people who have freely and knowingly consented to receiving them.
ICO — Fines of £225,000 for nuisance marketing messages (2026)
£17.5m
is now the maximum PECR fine
Or 4% of global turnover. It was capped at £500,000 until the next phase of the Data (Use and Access) Act commenced on 5 February 2026, which brought PECR penalties up to UK GDPR levels.
Where the law actually sits
What the law expects — and what it doesn't.
Plain-English orientation for a busy manager, each card linked to the statute itself or to the regulator's own words. This is not legal advice, and we would rather tell you where the law stops than talk you into something it never asked for.
Your data duty
UK GDPR & Data Protection Act 2018
If you capture a guest's name, email address or mobile number at the login, that is personal data and you are the one answerable for it. You need a reason for holding it, a limit on how long you keep it, and a way to answer a guest who asks what you have.
Regulation 22
PECR 2003
A WiFi login is not marketing consent. To email or text a guest afterwards you need a separate, affirmative, unticked opt-in taken at the point you collect the address — and you need to be able to produce the evidence that they gave it.
£17.5m
PECR penalties, from 5 February 2026
The maximum PECR fine is £17.5 million, or 4% of global turnover, since the next phase of the Data (Use and Access) Act commenced on 5 February 2026 (ICO, 2026). It was £500,000 before that (Clifford Chance, 2026). The ceiling that used to apply only to data protection now applies to marketing messages too.
Not a mandate
Online Safety Act 2023
The Act places duties on online services — the platforms where content is posted and searched — not on the venue whose broadband a guest happens to be using. It does not require your venue to filter its guest WiFi, and anyone who tells you otherwise is overstating it. Filter because it is your line and your name above the door, not because a statute says so.
One you will be asked about
Friendly WiFi, and where we stand on it.
Friendly WiFi is the UK’s public WiFi safety mark — a Government-initiated standard, operated by RDI (UK) Holdings, under which a venue commits to blocking pornography, child sexual abuse material and other illegal content identified by the Internet Watch Foundation.
Hotwireless does not hold the Friendly WiFi mark, and we are not going to tell you we do.
We also do not filter what guests look at, and we do not sell content filtering by category. Filtering is set on the broadband line, by the provider who supplies it, so a venue that wants it asks them. If the mark itself matters to your brand, you apply for it directly — it is awarded to the venue, not bought from a supplier.
Friendly WiFi — Public WiFi Safety Assurance Standard (friendlywifi.com, seen 2026-09-17)
The fix
What ‘done right’ looks like.
Five things you get on every Hotwireless venue. Nothing on this list is a promise for later.
How the login page works →- A guest network of its own Firewalled off from the card terminal, the till, the booking computer and the cameras. Guests reach the internet, not your side of the router.
- Your own login page, with consent taken properly Branded with your name, behind your terms of use. Where you collect details, marketing consent is a separate, unticked box — not a condition of getting online — and the record of it is kept. That is what PECR asks for.
- Your rules on the line, agreed before anyone connects Your acceptable use policy sits on the login page and a guest accepts it before they get online, so the rules for the connection are yours and they are on the record. It is your line and your name above the door — and if you want content blocked by category as well, that is set on the broadband line itself, by the provider who controls it.
- A record you could actually produce Who connected and when, what guest details you hold, and when they are deleted. If a guest or the ICO asks, the answer exists.
- A router that is ours to look after Supplied and configured before it is boxed, with the admin password changed off the factory default and the firmware kept current. It arrives ready to plug in, and we watch it from our side so the question of who last updated it always has an answer.
On that last one, the NCSC puts it in five words: “If your device comes with a default password, make sure you change it.” National Cyber Security Centre — Small organisations guide to cyber security, ‘Protecting your devices’ (2026)
The 60-second check
Tick every box that is true for your venue.
Six questions, no jargon, and you already know the answers. Your score updates as you go, and nothing you tick is stored or sent anywhere.
Your score
You’ve ticked 0 of 6
Tick what applies. Your score updates as you go.
Not sure where you stand?
Send us what you have now and we will tell you straight what is worth changing. Packages start at £39 a venue a month, no VAT added, no survey fee and no installation charge.
Or email sales@hotwireless.co.uk