Harden a digital signage player: a security checklist for Windows, Android and Raspberry Pi
Quick answer: DigitalSignage.com players need only outbound HTTPS on port 443 to *.signage.me, plus DNS and NTP, so start with a firewall that allows nothing else and a VLAN that isolates the screens. On the device: a standard user with automatic logon and kiosk mode on Windows, device-owner kiosk enrollment with debugging off on Android, SSH keys, a firewall and a read-only filesystem on a Raspberry Pi, and on all three a BIOS or bootloader lock, disabled USB storage, an update window, a locked enclosure and no unneeded remote desktop. The DigitalSignage.com SignPlayer itself is managed from SignStudio, where multi-factor authentication and least-privilege roles protect the account.
Last updated October 22, 2026. Sources: security best practices, network requirements, Windows, Android and Raspberry Pi install and platform guides, player management and user management pages on this site. Operating-system commands and settings are described as the platforms document them.
What you are defending against
| Threat | How it happens on a signage player | What stops it |
|---|---|---|
| Someone shows their own content | An unlocked desktop, a reachable keyboard, a USB stick, a stolen login | Kiosk mode, USB lockdown, a locked enclosure, MFA on the account |
| The player becomes a way into the network | A flat network, inbound services left on, default passwords | A dedicated VLAN, outbound-only rules, no inbound services |
| The device is wiped and taken | Physical access, factory reset from the remote | Enclosures, factory reset protection, bootloader and BIOS locks |
Checks for every platform
| Check | Do this | Source |
|---|---|---|
| Outbound-only firewall | Allow TCP 443 to *.signage.me, DNS on 53 and NTP on UDP 123; deny everything else, inbound and outbound | Network requirements |
| Network isolation | A signage VLAN with no route to workstations, servers or point-of-sale; wired Ethernet where possible, WPA2 or WPA3 Enterprise where not | Security best practices |
| No inbound services | Remote desktop, SSH, VNC and file sharing off unless you administer the device that way, and then from a management subnet only | Security best practices |
| Updates on a schedule | Player updates are automatic; set the operating system to update outside opening hours and test on one screen first | Player management |
| Physical | Locked enclosure or hidden mount, cable locks, ports out of reach, tamper alert where the risk justifies it | Security best practices |
| Boot protection | BIOS or UEFI password and a locked boot order on a PC; the device's bootloader lock on Android; a Pi inside a case with its card out of reach | Security best practices |
| Retire properly | Before a device leaves, clear the player's data so it shows a new registration code, and retire the screen in SignStudio | Reset and re-register guide |
| Monitor | Offline, failed sync, low storage and high temperature alerts to a person who can act; a screenshot when something looks wrong | Player management |
Windows (SignPlayer Desktop)
| Step | Setting | Note |
|---|---|---|
| 1 | Create a dedicated local standard user, not an administrator, for the signage session and set it to sign in automatically | The install guide's auto-login route; keep the administrator account separate and strong |
| 2 | Let SignPlayer start with Windows for that user, or use Assigned Access (Pro, Enterprise, IoT) or Shell Launcher (IoT Enterprise, Enterprise) so nothing but the player can appear | Shell Launcher relaunches the player if it closes |
| 3 | Disable USB storage: set the USBSTOR service start value to 4, as the security guide shows | Keeps a visitor's stick from mounting; re-enable for maintenance |
| 4 | Set a BIOS or UEFI password, lock the boot order to the system drive, and enable power on after AC loss | A reboot from a USB drive is otherwise the easiest way in |
| 5 | Turn on Windows Firewall for all profiles; block inbound; allow outbound TCP 443 | The security guide's PowerShell example does exactly this |
| 6 | Turn off Remote Desktop and Remote Registry unless you administer the PC that way, and then only from the management subnet | Fewer listening services |
| 7 | Encrypt the drive with BitLocker and enable auto-unlock so the player still boots unattended | Protects cached content and credentials if the PC is taken |
| 8 | Set Windows Update active hours to opening hours, or use Windows IoT Enterprise LTSC, which receives security updates only | No feature update at noon |
| 9 | On Windows IoT Enterprise, enable the Unified Write Filter with the player's cache folder excluded | The system drive returns to the same state on every reboot |
Android, Android TV and SoC displays
| Step | Setting | Note |
|---|---|---|
| 1 | Prefer a commercial Android player or a SoC panel that supports lockdown over a consumer stick | Consumer sticks often cannot be enrolled as device owner |
| 2 | Factory reset and enroll the device in an MDM that supports Android Enterprise dedicated-device (device-owner) mode, then pin SignPlayer | Device owner is set at provisioning; it cannot be added later without a reset |
| 3 | Install the SignPlayer and Watchdog APKs, then turn installs from unknown sources back off | The Watchdog relaunches the player; player updates are automatic |
| 4 | Turn off developer options and USB debugging (ADB) after setup | Debugging gives anyone with a cable full control |
| 5 | Turn on factory reset protection and the bootloader lock where the device offers them | A reset from the remote otherwise hands the device to whoever holds it |
| 6 | Enable the device's own system updates and schedule them outside opening hours | Security patches without a surprise restart |
| 7 | Do not sign the device into a personal Google account; use a dedicated account or none | Nothing personal to leak on a public screen |
| 8 | Disable Bluetooth, nearby sharing and any screen-casting receiver | A phone cannot cast over your content |
| 9 | Hide or lock the remote's settings access through the MDM or the panel's remote lock | The remote is the keyboard on an Android TV |
| 10 | Mount the stick or box out of reach, with its USB and power ports inaccessible | A pulled stick is a stolen player |
Touch components in SignStudio are a Plus+ feature and full kiosk presentations are Enterprise; the device lockdown above is separate from that and is done in the MDM.
Raspberry Pi
| Step | Setting | Note |
|---|---|---|
| 1 | Set a unique user name and a strong password in Raspberry Pi Imager; never keep the historical default login | The Pi platform guide starts here |
| 2 | Use SSH keys and disable password authentication (PasswordAuthentication no), disable root login (PermitRootLogin no), and limit retries | The platform guide's SSH configuration |
| 3 | Enable ufw with default deny incoming and default allow outgoing; allow SSH only from the management subnet, or not at all | The security guide's Pi recipe |
| 4 | Disable services a sign never uses: Bluetooth, avahi, cups, triggerhappy, ModemManager | Fewer listening services and a faster boot |
| 5 | Install unattended-upgrades for automatic security updates | Patches without a visit |
| 6 | Turn on the read-only overlay filesystem in raspi-config once the player is set up | Nothing writes to the card, so a power cut cannot corrupt it and a tamperer's changes vanish on reboot |
| 7 | Enable the hardware watchdog so a hung Pi reboots itself | Recovery without a site visit |
| 8 | Disable VNC unless you use it, and never expose it beyond the management subnet | A remote desktop is a remote keyboard |
| 9 | Case with the card slot covered, mounted out of reach; consider USB or NVMe boot so the boot media is not a pocketable card | Physical control of the boot media is control of the Pi |
Our documentation does not publish the SignService service name or uninstall commands, so administer the player through SignStudio and ask support for anything at the service level.
What to log and review
| Log | Where | Review |
|---|---|---|
| Logins, content changes, screen commands and setting changes per user | The SignStudio audit log, documented in user management | Monthly, and after any surprise on a screen |
| Player offline, failed sync, low storage, high temperature | Alerts from the Screens dashboard by email, SMS, webhook, Slack or in-app | As they arrive |
| Failed logins and new devices on the signage VLAN | Operating system logs, the firewall | Weekly on larger networks |
| Firewall denies from the signage VLAN | The firewall | A player trying to reach anything other than *.signage.me, DNS and NTP is worth a look |
The account side, briefly
Hardening the device is half the job. Protect SignStudio with multi-factor authentication for every administrator, one login per person with the least role they need (Owner, Administrator, Content Manager, Editor, Operator or Viewer), scopes that limit store staff to their own screens, an approval step before publishing where many people contribute, and a quarterly review of users. The security best practices page covers the account controls and the network design; this page is the per-device checklist that goes with it. Ask support at support@digitalsignage.com, live chat at https://chat.digitalsignage.com/ or +1-877-344-7446 for the current MFA options and the security documentation for your plan.
Frequently asked questions
Harden a digital signage player: what is the security checklist for Windows, Android and Raspberry Pi?
On every platform: an outbound-only firewall allowing TCP 443 to *.signage.me plus DNS and NTP, a dedicated VLAN, no inbound services, scheduled updates, a locked enclosure and a boot lock. Windows: a standard user with auto-logon, Assigned Access or Shell Launcher, USB storage off, BIOS password, BitLocker. Android: device-owner kiosk enrollment, debugging and unknown sources off, factory reset protection. Raspberry Pi: SSH keys, ufw, unneeded services off, unattended upgrades, a read-only filesystem.
What firewall rules does a DigitalSignage.com player need?
Outbound only: TCP 443 to *.signage.me for SignStudio, registration and content, DNS on port 53 and NTP on UDP 123. No inbound ports, no static IP and no port forwarding; the player connects out over a real-time socket and falls back to HTTP polling. Deny everything else and put the players on their own VLAN.
Should a signage PC run as an administrator?
No. Create a dedicated local standard user that signs in automatically and runs SignPlayer, keep a separate administrator account with a strong password for maintenance, and lock the session down with Assigned Access or Shell Launcher. Disable USB storage and set a BIOS password so the PC cannot be booted from someone else's drive.
How do I lock down an Android stick or display for signage?
Factory reset it, enroll it in an MDM that supports Android Enterprise dedicated-device mode and pin SignPlayer, then turn off developer options, USB debugging and installs from unknown sources, turn on factory reset protection, and mount it out of reach. Consumer sticks often cannot be enrolled; commercial Android players and SoC panels with lockdown can.
How do I secure a Raspberry Pi running digital signage?
Set a unique user and password at imaging time, switch SSH to keys only with root login off, enable ufw with incoming denied, disable Bluetooth and other unused services, install unattended-upgrades, turn on the read-only overlay filesystem after setup, enable the hardware watchdog and keep the card slot inside a case out of reach.
Does hardening the player protect the content?
It protects the device. The content is protected on the account side: multi-factor authentication for administrators, one login per person with the least role needed, screen scopes for local staff, an approval step before publishing and the audit log in SignStudio. Both halves are needed; a perfect device with a shared password is still open.
What should I do before a player leaves the site?
Clear the player's data or reinstall it so it shows a new registration code and no longer holds your content, retire the screen in SignStudio so it stops counting toward your screens, wipe the device if it changes hands, and revoke any device-specific credentials such as Wi-Fi certificates.
Related guides
- Digital signage security best practices
- Network requirements
- Install SignPlayer on Windows
- Install SignPlayer on Android and Android TV
- Raspberry Pi digital signage
- SignStudio user management
Try it on your own screens, free
DigitalSignage.com, which publishes this guide, runs a permanent free plan: the first 3 screens are free forever (no credit card, no ads, no watermark, no time limit), then from $3 per screen per month on Plus+. Once an account has 4 or more screens, every screen is billed, so 10 screens cost $360 a year; Enterprise is priced per screen in the public price calculator. The free DigitalSignage.com SignPlayer runs on Windows, Mac, Android and Android TV, Chrome OS, Raspberry Pi, iPad or any modern web browser, so the hardware you already own usually works. Start free · 2026 pricing · How 11 vendors compare on price
Maintained by MediaSignage Inc., operator of DigitalSignage.com since 2006. Product behavior on this page comes from our own SignStudio and SignPlayer documentation; where we do not document a step, this page says so instead of guessing. Last reviewed October 22, 2026.