A builders' merchant, a salon and a small accounts office often share one habit. The Wi-Fi password is on a whiteboard, in the staff chat, or on a card taped to the router. Visitors, a Saturday temp and a contractor sending a quote all end up on the same network as the tills, the shared files and the printer that scans to email.
That is convenient for an afternoon. It is a poor boundary. A guest does not need to see your office PCs, and those PCs should not share a network with a phone that also joins cafe Wi-Fi all week. This note is for North East firms that still have a single wireless name for everyone. Splitting it is a smaller job than people expect, and it belongs with the other cyber security basics rather than as a project in its own right.
Why one password for everyone causes trouble
The office wireless network is an extension of the cables in the wall. If a laptop on Wi-Fi can open the accounts folder, print, or reach the router's admin page, then so can any other device that knows the password. You will not see it happen. The password was shared so someone could get online, and it is still the password months later.
Personal phones are the usual extra. They are a reasonable way to read Microsoft 365 mail. They are a bad place to keep the only copy of a key that also unlocks the office. When someone leaves, you can block their mailbox the same day and forget that the wireless password is still in their notes app. The leaver checklist covers accounts. The wireless key lives outside Microsoft 365, so it needs its own line.
A flat network also makes a bad day worse. Something that arrives on a guest laptop, or on a camera that has not been updated since it was fitted, can try every other device in the same address range. Staff working from a van should use Microsoft 365, or a VPN when they need a PC that stays in the building — see VPN versus remote desktop. The guest password in reception is not a remote-access design.
What to separate
- Office devices — staff PCs, the server or NAS, tills, and the printer you trust with scans
- Guests — visitors, contractors who are in for a day, and any laptop that is not yours
- Personal phones — fine on guest Wi-Fi if you do not want them beside the file server
- Awkward equipment — some cameras, card machines and alarms cannot take a normal update. They often belong on their own network, not on guest Wi-Fi and not next to the accounts PC
A setup that suits a small office
Most business routers already have a guest network switch. Turn it on, give it a different name and a different password, and enable the option that stops guests reaching the rest of the network. The wording varies. Look for guest network, access isolation or client isolation. Client isolation stops guests talking to each other. The guest network itself should stop them talking to the office.
Use WPA2 or WPA3. If the router still offers an open network, or an old WEP key kept "for the till", retire it. Change the router admin password from the one printed on the sticker, and do not manage the router from the guest side. A visitor should get the internet, not the page where DNS and port forwards are changed. Turn off remote administration from the internet unless you already know you need it and who can reach it.
Write the two names down somewhere the office can find them, not on the router. "Office" and "Guest" in the name is clearer than the default labels the broadband provider printed. The office password can be long. People who work there type it once. The guest password should be one you will change after an open day or a contractor's last afternoon, without reconnecting every PC.
Printers are a common snag. Many still only join the 2.4 GHz band, and some routers publish that band under a second name that looks like the guest network. Put the printer on the office side and test a scan afterwards. A printer that has wandered onto guest Wi-Fi looks online on a phone and vanishes from the PCs that use it.
If the building has more than one access point, set the same split on each of them. A guest network on the main router, plus an old extender repeating only the office name, undoes the work in the stock room.
What a guest network does not fix
It does not replace multi-factor authentication, a tested backup, or Windows updates. It does not stop someone plugging into a spare socket on the office switch. A phone on guest Wi-Fi can still get a phishing text. The split only limits what that phone can see locally.
Cyber Essentials still asks how the network boundary is controlled. A separate guest name helps that conversation, and it is not a certificate on its own. Read Cyber Essentials for North East SMEs if you are working towards the badge, and treat the wireless split as one control. Someone in the business needs to know which name is which, and to change the guest password when it has spread. If you are refitting a shop, decide the split before the cabling is boxed in.
Check it from a phone, not from the brochure
The broadband provider's router is enough for many small offices, until the tills, the cameras and the PCs need different rules, wireless dies in the warehouse, or the guest option does not actually block the printer. That is an access-point and firewall job, not a new password on the whiteboard.
From a phone joined only to the guest network, office PCs, shared folders and the router admin page should not open. On the office network, the printer and the file share still should. A name with the word guest in it, on the same address range as the server, has not separated anything. Keep a one-line note of the two names, who holds the office password, and the date the guest password last changed, so the next person can change the guest key without knocking the tills offline.
Garvey's IT sets this up as part of managed IT support for offices in Stockton-on-Tees and across the North East: guest Wi-Fi, the office network, and the devices that should never share either. Ask us to split the wireless if visitors still use the same password as the tills.
Common questions
Can we just give visitors the office Wi-Fi password?
You can, and plenty of firms do. Their laptop then sits on the same network as your files and printers until you change that password and reconnect every office device. A separate guest name, with a password you can change on its own, avoids that.
Will a guest network slow the office connection?
It uses the same broadband line, so a visitor streaming video can still use capacity. It should not let them open shared folders or the router settings. A busy line at lunchtime is a bandwidth question, not a reason to keep one password for everyone.