Guest Wi-Fi for a small office: keep visitors off your network
Visitors, personal phones and smart TVs don't belong on the network with your files. What a good guest Wi-Fi does, how to test it, and a simple setup.
In many small offices there is one Wi-Fi network and one password, written on a sticky note at reception. Staff laptops, the file server, the accounting PC, visitors' phones, the conference room TV and the security cameras all share it. It works, until a visitor's infected laptop, a cheap smart device or a former employee's phone turns out to be sitting on the same network as your most important files. Setting up guest Wi-Fi properly is one of the simplest ways to reduce that risk.
Who should not be on your business network
The business network is where your computers, server or NAS, printers you print sensitive documents on, and anything holding company data live. Everything else is a guest, including some things people don't think of:
- Visitors and clients who need internet access during a meeting;
- staff's personal phones, tablets and smartwatches, which you don't manage and can't update;
- smart TVs, streaming sticks, speakers and conference room gadgets, which often get few security updates;
- contractors working on site for a day or a week.
Security cameras, door entry systems and similar devices are a special case: they should not be on the guest network with visitors either. Ideally they get a network of their own.
What a good guest network does
- Internet only. Guests can browse, but cannot reach any computer, share, printer or admin page on the business network. This is the whole point, and it should be tested, not assumed.
- Client isolation. Devices on the guest network can't see each other either, so one infected phone cannot probe the next visitor's laptop.
- Its own password, different from the staff network and changed on a schedule, for example every quarter, and whenever someone who knew it leaves on bad terms.
- Sensible limits. A bandwidth cap stops one guest's large download or video call from slowing the office, and many systems can switch guest access off outside office hours.
Is the "guest" button on my router enough?
Often it is a reasonable start, but check what it actually does. On many consumer and internet-provider routers, the guest network is a second Wi-Fi name with internet access, and isolation from the main network is an option that may be switched off, or not available at all. Some also block guests from reaching a printer on purpose and others don't. A quick test: connect a phone to the guest network and try to open the router's admin page, a shared folder or the printer's web page. If any of them load, guests can reach your network.
Business-grade access points and firewalls handle this with separate network segments (often called VLANs), so guests, staff and devices like cameras each have their own space with clear rules between them. If your office has grown to the point where this is hard on your current equipment, our article on whether your office has outgrown its home-style router covers the signs.
A simple setup for most small offices
- Staff network: company-managed devices only, with a strong password that is not shared with visitors, or individual sign-in if your equipment supports it.
- Guest network: internet only, client isolation on, its own password, posted where visitors can see it.
- Devices network (if you have cameras, TVs or other connected gadgets): kept apart from both, with only the access those devices actually need.
Name the networks clearly so staff don't connect a work laptop to the guest network by mistake, and don't let personal phones on the staff network just because "it's faster".
Don't forget the wired side
A network port in the reception area or meeting room connects straight to your business network unless it has been set up otherwise. If visitors can plug in there, either disconnect unused ports or put them on the guest segment.
Getting it right
Separating networks is a small project for a technician and a big improvement in safety. Our network setup and management service can design and configure staff, guest and device networks on equipment you already have where it is capable, and test that the separation holds. It fits alongside our wider cybersecurity work for small businesses. Call (213) 986-4855.