Cybersecurity for restaurants: Payments, Wi-Fi and online orders

A restaurant runs on a handful of systems: the POS, card terminals, an online ordering page, delivery tablets, a reservation book and a payroll app. When one of them goes down on a Friday night, it costs you tables, not just time.

This guide covers the security basics that matter most for a small restaurant, café or bar, in plain English.

Why are restaurants a target?

Restaurants take a lot of card payments, often on shared devices, with staff who change frequently. Many also depend on several outside platforms for ordering, delivery and reservations, each with its own login.

None of that is unusual. It just means a stolen password or a careless click can reach more than you'd expect, and simple habits matter a lot.

Your next step: list every system you log in to, from the POS back office to each delivery platform, and note who has the password.

How do I protect card payments?

The safest card data is data you never touch. Modern POS systems and card terminals send card details straight to the payment provider, so your restaurant doesn't store them.

• Use chip and contactless terminals from your POS or payment provider, and keep their software updated.
• Never write card numbers on paper for phone orders. Enter them straight into your POS, or send the customer a payment link.
• Check terminals for signs of tampering, like loose parts or extra pieces attached to the card slot, especially at the counter and the bar.
• Turn on two-step sign-in for your POS back office and payment dashboard, where refunds and payouts are managed.

PCI DSS, the card industry's security standard, applies to every business that accepts cards. For most small restaurants, your payment provider does much of the heavy lifting, and it can tell you what you need to complete.

Your next step: ask your payment provider which self-assessment questionnaire applies to you and whether they complete any of it for you.

Should guest Wi-Fi be separate?

Yes. The FTC recommends keeping your main business network for business-owned devices only, and setting up a separate network for guests and personal phones.

• Put your POS, card terminals, office computer and kitchen printers on the business network.
• Put guests, staff phones and anything else on the guest network.
• Change the router's default admin password, turn off remote management, and use WPA2 or WPA3 encryption.

Your next step: ask whoever set up your internet to confirm the POS isn't on the same network as guest Wi-Fi.

How do I manage staff logins?

Shared passwords are the most common gap in restaurants. When everyone uses the same manager PIN or delivery tablet login, you can't tell who did what, and you can't lock out one person without locking out everyone.

• Give every staff member their own POS login, with access matched to their role. Servers don't need refund or reporting access.
• Remove access the same day someone leaves, including POS, scheduling, payroll and any shared email.
• Use a password manager for the accounts managers share, instead of a note by the register.
• Turn on two-step sign-in (MFA) for the owner and manager accounts on every platform.

How do I protect ordering, delivery and reservation accounts?

Your online ordering page, delivery platforms and reservation system each hold customer details and, often, your payout bank account. A criminal who gets in can change where your money goes.

• Turn on two-step sign-in for each platform, and use a different password for each.
• Turn on alerts for payout or bank account changes where the platform offers them.
• Be wary of emails or calls claiming to be from a delivery platform asking you to "verify your account." Sign in through the app or website you normally use instead of clicking the link. That's a common form of phishing.
• Confirm any request to change a supplier's bank details by calling a number you already have. The FBI recommends checking payment changes through a second channel.

How do I protect my website and email?

Your website is where guests find your menu, hours and ordering link. Your email domain is how suppliers, staff and catering clients know a message is really from you.

• Use HTTPS on every page, with an SSL certificate that renews automatically.
• Turn on two-step sign-in for your website builder, domain registrar and hosting account.
• Publish SPF, DKIM and DMARC records so criminals can't easily send fake gift card offers or invoices that appear to come from your restaurant. Our free DMARC record generator builds a safe starting record.

When we checked 400 independent Arizona restaurant websites in October 2026, about two out of three had no DMARC record at all. The Arizona restaurant benchmark has the full results and a way to compare your own site.

What's on a restaurant cybersecurity checklist?

For general small business steps like backups and passwords, see the small business cybersecurity checklist.

What should you do next?

Start with the steps that protect your payments and your busiest nights.

1. Run the free website security scan to check your website, certificate and email records.
2. Confirm guest Wi-Fi is separate from your POS.
3. Turn on two-step sign-in for your POS back office and every delivery platform.
4. Give anyone who shares a login their own account.