Guide · Network security

Guest Wi-Fi is not staff Wi-Fi

By Christopher Smith, MS Cyber Security, penetration tester·Published October 18, 2026·Updated October 18, 2026·5 min read

Visitors expect Wi-Fi. They do not need — and should never get — a path to your staff computers, printers, file shares, or payment devices. The Short says split the networks; this guide explains what 'split' actually means, how to set it up on typical small-business gear, and how to test that the separation works.

Quick verdict

• Separate SSID, separate segment. A different network name alone is not enough — guest clients must not be able to reach staff devices.
• Internet-only for guests. Guest Wi-Fi should reach the internet and nothing on your local network.
• Test it yourself. Join the guest network on your phone and try to reach a printer or file share. If you can, it is not separated yet.

What separation actually means

On many small-business routers and mesh systems this is a 'Guest network' toggle plus a setting often called client isolation, AP isolation, or 'allow guests to access local network' — that last one should be off. On more capable gear, ask your IT provider for a separate VLAN for guests. The label varies; the outcome to require does not.

Setup steps

1. Turn on the guest network with its own name and password. Use a password you can change without disrupting staff, and change it periodically or after staff turnover if it was widely shared.
2. Enable client isolation and confirm guests cannot access the local network / router admin page.
3. Use WPA2 or WPA3 with a real passphrase on staff Wi-Fi; never run an open staff network.
4. Change the router's default admin password and keep its firmware updated — include it in automatic updates.
5. Keep point-of-sale, servers, and network storage off guest and, where your gear supports it, segmented from general staff devices too.
6. Test from a phone on guest Wi-Fi: browse the web (should work), then try to open the printer, a file share, and the router admin page (should fail).

Common mistakes

• Giving a trusted visitor the staff password 'just this once' — create the guest path so staff never need to.
• Assuming two SSIDs means two networks when both land on the same LAN.
• Leaving the guest network on the same segment as point-of-sale or back-office PCs.
• Never re-testing after a router swap or firmware reset. Re-run the phone test after any network change.

For remote staff rather than on-site guests, the related problem is controlled access from untrusted networks — see our business VPN guide.

Bottom line

Separate SSID, separate segment. A different network name alone is not enough — guest clients must not be able to reach staff devices. The expanded steps above turn the Short's rule into a process with an owner and a check — do the first section today, schedule the rest this week, and write down what you changed so the next person does not have to rediscover it.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.