Fast shopper WiFi for big-box stores, with each scanner kept safe
In a large-format store, shoppers use the WiFi to compare prices, check stock and pay through your app, often with children in the trolley. Shield gives that network a family-safe policy and strips ads so pages load faster across the floor. Behind it, ePOS, handheld scanners, self-checkouts and electronic shelf labels run on threat-first rules, each on its own VLAN.
Guest WiFi policy
- Adult contentBlocked
- GamblingBlocked
- Safe Search on Google, Bing and YouTubeEnforced
- Streaming at busy timesLimited
Allow list
bookings.examplemenu.exampleBlock list
rival-venue.exampleWhat is at stake
A shop floor with more devices than staff
Hundreds of devices per store
Handheld scanners, self-checkouts, shelf labels and stockroom printers share the building, and an infected one calling home is hard to spot.Families in the aisles
Families spend an hour in store, and children on a parent's phone reach whatever your WiFi allows.Click-and-collect and stockroom
Click-and-collect lockers and warehouse terminals reach the internet all day, often on networks nobody has reviewed in years.
How Shield fits
Shop floor, stockroom and tills, each on its own VLAN
- Shopper WiFiFamily-safe categories, Safe Search and ad blocking, so price checks and the store app load fast.
- ePOS and self-checkoutThreat-first rules, with phishing, malware, C2 callbacks and newly registered domains blocked.
- Handheld scannersAllow lists for stock and picking apps, behind a relay so each scanner's internal IP shows.
- Stockroom and IoTShelf labels, lockers and printers kept to the domains they need, with geographic blocking on.
Ads, trackers and bloatware load on every page
Ads and trackers stripped before they load
Proof
More bandwidth for shoppers, earlier warning for IT
- 500%
- faster page loads, once ads and trackers are stripped out
- 62%
- fewer DNS queries, once ads and trackers are blocked
- 10 days
- head start on standard blocklists for new malicious domains
- 80,000+
- venues in 90 countries run WiFi on the Purple platform
FAQ
Questions we hear from teams like yours
Can we see which scanner made a lookup?
Yes. With the relay in place on segmented VLANs, Shield sees each device's internal IP. You can drill down from a blocked domain to each scanner, till or shelf-label gateway that looked it up, and stream the logs to your SIEM.
Will filtering slow the store app or price checks?
No. Shield answers the DNS lookup each phone makes anyway, then strips ads and trackers. Purple's own measurements show page loads up to 500% faster and up to 62% fewer DNS queries, which helps when a busy store floor shares one connection.
Do we need an appliance in each store?
No. You point each store's router, firewall or DHCP at Shield, with no hardware to rack. The relay is only needed where you want per-device visibility on segmented VLANs. Shoppers install nothing on their phones.
How does Shield help with PCI DSS?
Shield helps you meet PCI DSS on the payment network rather than making you compliant. ePOS and self-checkouts get a threat-first policy, DNSSEC validation is on, and logs stream to Splunk, Microsoft Sentinel or syslog as evidence for your assessor.
Is Shield a replacement for our firewall?
No. Shield is a layer behind your firewall that stops threats at the DNS lookup, before a connection starts. It covers shopper phones and unmanaged devices your firewall rules were never written for, and it fails closed if there is an outage.
Other industries
Retail
Family-safe shopper WiFi across the estate, with ePOS, handhelds and head office on threat-first rules.High-street retail
Family-safe customer WiFi for independents and chains, with tills and card readers on threat-first rules.Shopping centres
Family-safe public WiFi across the centre, with management and building systems on threat-first rules.
Decide what your network reaches, free for 30 days
Tell us which networks and sites you run and who is on them. We map a policy to each one: staff, guests, students, residents and IoT. Then point one network at Shield and see what it stops for 30 days, before you pay anything. Running change control? We plan a pilot on one site with your team instead. No hardware to install.
- We map your networksA Purple expert maps your networks, your venues and the people on each, and answers your questions on bypass, outages, data handling and integrations.
- You get a policy for each oneStaff, guests, students, residents, IoT and paid tiers, each with the policy it needs.
- You prove it, then get your tailored quote30 days free on one network, or a pilot on one site planned with your team, then Shield priced standalone or as an add-on to your Access plan.
Your policy map
Tell us your networks. We map a policy to each one.
A Purple expert comes back with a policy for every network and group you run, from the team that has run content filtering since 2012 and runs WiFi for 80,000+ venues in 90 countries.