In many small offices there is one Wi-Fi network and one password, and it is on a sticker on the router. Clients, couriers, the cleaner's phone and a colleague's old tablet all end up on the same network as the accounting laptop and the shared storage. Nothing bad has to happen for this to be a problem; it only has to happen once.
The fix is small. It is one setting on the router and one page of rules.
A separate network for guests
Most routers sold for offices, and many from internet providers, have a "guest network" option. Turn it on and check three things:
- Isolation. Devices on the guest network should not see each other or the office devices. Look for a setting called client isolation or "access to local network: off".
- A different name. Something obvious, such as the company name followed by "Guest", so visitors do not try the office network first.
- No access to the router settings. The administration page should not open from the guest network.
Test it once: connect a phone to the guest network and try to open the shared printer or the shared storage. It should fail. If your router cannot do this, a cheap second access point set up as a separate network does the same job.
Passwords and how often they change
Use a long password made of a few ordinary words, not a company name and a year. It has to be easy to read out and type on a phone, because that is how it will be used.
Change it:
- On a schedule, for example every quarter, so an old password does not circulate forever.
- When a person who knew it leaves the team, or when you suspect it was shared more widely than intended.
- After a larger event at the office, if guests had it for the day.
Keep the current password in the password manager, not only on a sticker (see the password manager rollout for a small company). A printed card at reception with the current password is fine for guest Wi-Fi, as long as the card is replaced when the password changes.
The office network keeps its own password, which guests never get.
Who may give access
The simplest rule is the best one: the person who invited the visitor gives them the guest password, and nobody gives out the office one. If a visitor arrives unannounced, they ask reception or the office owner.
Name one person who owns the guest network. That person changes the password, answers questions and decides on exceptions, for example a contractor who needs to stay for a week. Exceptions have an end date.
What a guest gets is internet access, nothing else. A visitor who needs to print or open a company file is given that in a different way, for example the file sent by e-mail, and not by moving them to the office network.
What guests may not do
A short list, written on the card or sent with the password, is enough:
- No attempts to reach other devices on the network.
- No large downloads or streaming that slow the office down.
- No illegal content. The connection is registered to the company, so the company answers for what runs through it.
- No sharing the password further.
Most guests never think about any of this, so keep the tone friendly. The list exists for the one case that needs it.
A router check twice a year
Fifteen minutes, in a calendar reminder:
- Update the firmware, or confirm that automatic updates are on.
- Change the router admin password if it is still the default or was shared with a former supplier.
- Look at the list of connected devices. Remove ones nobody recognises.
- Check that the guest network is still isolated with the same test as before.
- Remove old settings: forwarded ports nobody uses, a remote administration option that is not needed.
- Note the date and who did it.
If an outside company set up your network, ask them for the admin login and a written note of what they configured. A router nobody can log in to cannot be checked (see also the annual cleanup of accounts and software access).
Common mistakes
- One network for everyone because the guest option was never turned on.
- The guest password never changes, so former visitors and former colleagues still have it.
- The office password given out "just this once". Then it is no longer private.
- Nobody owns the router. Updates and checks happen only when something breaks.
- Isolation assumed, not tested.
Summary
Turn on a separate guest network, test that it cannot see the office, change its password on a schedule and when someone leaves, say who may hand it out, keep a short list of what guests may not do, and check the router twice a year. It is an hour of work, plus a reminder twice a year.
Sources
- Common practice for small businesses, offered as a practical guide. No client results or market figures are claimed in this article. Adjust the steps to the router and the rules that apply to your company.
