QR code security checklist

A QR code security checklist for an owner is physical plus destination. Valid modules do not authenticate a lamp-post. Use HTTPS, keep the 302 hop, ban an extra shortener, run sticker patrol at open, and keep a street-facing Wi-Fi ban. Prove the payload with a test scan not preview.

QR code security checklist

This list is for people who are about to print. It is the wrong list for a guest standing at a meter; they need QR code phishing how to spot. It is also the wrong list for a one-off birthday poster that will never move. That job is Canva.

Hosted SmartQRCode types print a URL you can edit later. That is the point of a website generator and a menu generator. The trade is that the print needs this host to resolve, and that a sticker can still sit on top of your ink.

Wi-Fi stays static. Put it on the checklist as a password-handling item, not as a tracked door.

Walk the list in the order the printer will fail you

1. Write the final destination on paper. If you cannot name the host, you are not ready to encode it.
2. Choose hosted if the URL will change or you need a count. Choose static if it will not. Do not mix the story on the same brief.
3. Keep no extra shortener hop. You already have a short hosted path.
4. Confirm redirects are 302 so later edits are not cached as 301.
5. Export SVG or a 300 dpi PNG or PDF at the real millimetre size. Quiet zone of four modules on every side.
6. Ignore the designer preview for press. Do a test scan not preview on a physical proof.
7. Place Wi-Fi off the street window. Street-facing Wi-Fi ban: treat the password like a whiteboard in a staff corridor.
8. Schedule sticker patrol at open for tents, meters, and unsupervised boards.
9. Record pause versus archive. Archive keeps scanning. Pause stops the hop.

What belongs on the print-side list

Physical: one code per camera frame, matte if downlighters glare, size at least 2 cm across for a phone at about 30 cm. Destination: HTTPS you control. Analytics: totals, device type, country from headers only. Identity: none.

Retail windows pick up overlays. See retail marketing. Table tents pick them up faster. Pair each tent with a spoken URL.

Prices for a hosted account are $1.99, $29, $97, or $197. Lifetime has no renewal. The 7-day paid trial converts to annual unless cancelled. Those tokens do not buy you a free product tier. They also do not buy a physical patrol. Someone still has to look at the paper.

How do you prove the live payload

Print a proof. Scan with iOS Camera or Android Camera. Read the preview host. Confirm the dashboard moved if the type is hosted. If you scanned the monitor, you tested /qr-preview and learned nothing about the press file.

When is a static file the whole checklist

When the payload is a single https page that will never change and will never be counted. Generate it in Canva, Google Chart, or the in-app iOS tools. Skip the account. We are the wrong product.

If you still need edit-after-print, stay hosted and keep the patrol. Sibling owner pages: malicious QR code warning signs and QR code HTTPS and redirects.

Failure modes of this checklist

Sending a screenshot. Stacking shorteners. Putting Wi-Fi on the door. Calling archive off. Inventing scan totals for a board pack. Treating a centre logo as a seal.

Error correction H survives more scuff and makes a denser pattern. Use it when you add a logo or print on packaging that will be handled. Use M on clean paper if you want larger modules at the same size. Neither level authenticates the printer.

Outdoor UV ink chalks. Plan a reprint cycle. A hosted destination can move; a faded pattern cannot repair itself. Metallic grounds scatter: print the symbol on a solid white patch, then foil around it.

If none of the destination checks pass, stop the press. A cheaper static Canva file that encodes the real https page is safer than a hosted hop you cannot name. We are the wrong vendor when you needed a PNG and a weekend.

How guests actually fail an honest print

Guests fail honest prints for boring reasons. The tent is 1.2 cm wide. The quiet zone is trimmed off a round corner. The window decal has the street scene as its light modules because nobody backed it with white. Two codes sit in one camera frame. The downlighter turns gloss into a mirror. None of those failures are phishing. Fix the file, then keep the security list.

A vehicle wrap read from a neighbouring lane needs tens of centimetres across, not a business-card mark scaled up in Photoshop. Apparel stretches. Uncoated stock drinks ink and spreads modules. Compensate with size or coated stock, not by dropping error correction to L to make the pattern look airy.

Test-scan with the camera guests have: iOS Camera, Android Camera or Lens. Control Centre and Quick Settings widgets exist when a skin buries auto-detect. Do not promise a specific lock-screen banner. Confirm the preview host on the proof, then print the run.

Prices stay $1.99, $29, $97, $197. They pay for hosted edit and counts. They do not pay for a guest to ignore a lookalike host. Put the spoken URL on the same sign as the code so the checklist has a fallback.

Transparent stickers on glass fail when the street behind the glass becomes the light modules. Back the symbol with white. Dark wood and brick fail for the same invert reason: put a light patch down first. Emboss and letterpress break module edges; keep QR on a flat inked area.

A PDF export with vectors is what offset wants. A PNG sent to a vinyl cutter gets traced, and tracing QR corners breaks them. The security checklist assumes the file can be scanned. A broken cut is not a clever deterrent. It is a failed job.