If your office Wi-Fi password is on a sticky note at the front desk, every visitor, contractor, and customer who has ever used it is on the same network as your computers, file server, and printers. So is every phone they've connected since, because devices remember Wi-Fi passwords.

Most of those people mean no harm. But a single infected laptop or phone on your network can reach shared folders, and a former employee or contractor may still be able to connect from the parking lot.

Set up a separate guest network

Most business Wi-Fi systems, and many home routers, can broadcast a second network just for guests. A good guest network:

  • Has its own name and password, different from the staff network.
  • Only reaches the internet. Guests can browse and check email, but can't see your computers, file shares, or printers.
  • Isolates guests from each other (often called client or AP isolation), so one visitor's device can't reach another's.
  • Is speed-limited, if your equipment supports it, so a guest streaming video doesn't slow the office down.

Then you can hand out the guest password freely, put it on a sign in the lobby, and change it every few months without disrupting anyone's work.

Keep gadgets off the staff network too

Smart TVs, conference room displays, cameras, thermostats, and other connected devices rarely get security updates. They don't need to reach your file server, so don't let them. Put them on the guest network or on a separate network of their own.

Protect the staff network

  • Use WPA2 or WPA3 security with a long password, and don't share it with anyone who isn't staff.
  • Change it when someone leaves, or move to a system where each person signs in with their own account.
  • Keep the Wi-Fi equipment updated. Routers and access points get security fixes like any other device.
  • Change the default admin password on the router or Wi-Fi controller.

Check what you have

If you're not sure whether your guest network is really separated, try this: connect a phone to the guest network and try to open a shared folder or print to an office printer. If it works, guests can reach more than they should.