Why sharing the staff password is a problem
Many offices hand visitors the same Wi-Fi password staff use. Once a laptop or phone joins that network, it sits alongside your PCs, file shares, printers and sometimes your accounting server. A visitor's device infected with malware can then scan for weaknesses and spread, without anyone at the office doing anything wrong.
The password also spreads. Contractors write it down, former staff keep it on their phones and it ends up on a sticky note at reception. Changing it means updating every staff device, so it rarely happens. A separate guest network breaks that cycle. Over a few years, the number of people and devices that know the staff password can be several times the size of your team.
Isolation is the key setting
A proper guest network sits on its own segment, usually a separate VLAN, with firewall rules that allow internet traffic and block access to every internal address. Client isolation stops guest devices from seeing each other as well, so one visitor's infected laptop cannot reach another's phone. Separating guests this way also keeps their traffic out of your internal logs, which makes it easier to spot genuine problems on the staff network.
Business access points and firewalls make this straightforward. A consumer router's guest mode sometimes only creates a separate name with a different password while leaving everything on the same network underneath. Test it: join the guest network and try to reach a shared printer or a file share. If you can, it is not isolated.
Choosing how guests sign in
The simplest option is a separate password that you rotate monthly and display at reception. A step up is a captive portal, the splash page you see at cafes, where guests accept terms of use before connecting. Some systems can issue printed vouchers or text a code, which suits clinics, schools and offices with many visitors.
Whichever you choose, keep it easy. A guest network that needs a staff member every time someone connects will end up being bypassed by handing out the staff password again. Put the current password on a small sign at reception or in meeting rooms, and include it in the welcome information you send to visitors before they arrive, so nobody has to ask.
Sensible limits
Cap the bandwidth per device so one visitor streaming video does not slow down the whole office. Set a maximum session time so devices drop off overnight. Many businesses also apply basic content filtering to block obviously harmful or inappropriate sites, which protects your reputation if something is misused on your connection. A few megabits per device is plenty for email, browsing and the odd video call.
If you offer Wi-Fi in a waiting room, a cafe area or a shared tenancy, think about how your terms of use describe acceptable use and what information, if any, you collect through a captive portal. Under the Privacy Act 2020, collect only what you need and tell people why.
Where contractors and staff phones fit
Contractors who need internal access, such as an accountant connecting to a server, should not use guest Wi-Fi at all. Give them a named account with access to only what they need, and remove it when the job is done. For one-off support sessions, screen-sharing tools that the contractor runs through a staff member's computer are often safer than giving them any network access at all.
Staff personal phones are a judgement call. Putting them on the guest network keeps personal devices away from business systems, which is the safer default. If staff need work apps on their phones, a device management policy that protects work data is better than joining personal phones to the internal network.
Keeping it tidy over time
Put the guest password change on a calendar, check now and then that isolation still works after firmware updates, and review the bandwidth cap if visitors complain. If your office uses smart TVs or wireless presentation devices, decide whether guests need to cast to them and set up a specific rule rather than opening up the whole network.
A short health check of your Wi-Fi settings is a sensible way to confirm guests are truly separated, because the difference between isolated and not isolated is invisible from the reception desk. It takes only a few minutes for a technician to confirm, and the peace of mind lasts until the next major change to the network.
In short
- Never give visitors the staff Wi-Fi password.
- Isolate guests on their own segment with firewall rules blocking internal access.
- Test isolation by trying to reach a printer from the guest network.
- Cap bandwidth and session time for guests.
- Contractors who need internal access get named accounts, not guest Wi-Fi.