Office Wi-Fi Password Shared Too Widely? Set Up a Guest Network

Why one shared Wi-Fi password is a risk

Wi-Fi is the front door to your office network. A single password that everybody knows means the door is effectively open to people you no longer deal with.

• Everyone is on one network: a visitor's laptop or a phone with malware can see your file shares, NAS, printer, CCTV recorder and router login page.
• Former staff keep access: the password rarely changes, so ex-employees and old contractors can still connect from the corridor or carpark.
• Devices remember forever: phones and laptops save the password and reconnect automatically for years.
• No record of who is connected: you cannot tell a staff laptop from a stranger's device.

CSA's Cyber Essentials standard treats insecure configurations seriously: it requires default passwords to be replaced with a strong passphrase of at least 12 characters, and gives upgrading old WEP Wi-Fi to WPA2 or WPA3 as an example of replacing weak protocols.

Guest network vs staff network: what goes where

The simplest good setup is two networks from the same router or access points.

Shops and clinics with a POS or card terminal should keep those on their own wired or separate network too. See our guide to retail shop IT security for that setup.

How to set up a guest Wi-Fi network

Menus differ between router brands, but the settings have similar names. You need the router's admin login; if you do not have it, that is the first problem to fix.

1. 1

   Log in to the router or Wi-Fi controller

   Use the admin page or app. If the admin password is still the default on the sticker, change it to a long passphrase now.

2. 2

   Create a guest network (SSID)

   Look for Guest Network, Guest Wi-Fi or Additional SSID. Give it an obvious name such as "OfficeName-Guest".

3. 3

   Turn on isolation

   Enable options called client isolation, AP isolation or "allow guests to access local network: off". This stops guests reaching your devices or each other.

4. 4

   Set the security mode and password

   Choose WPA3-Personal, or WPA2/WPA3 mixed for older phones. Use a password you can share on a card at reception.

5. 5

   Change the staff network password

   Set a new, strong password on the main network and re-enter it only on company devices. Personal phones move to guest.

6. 6

   Test from a phone on guest

   Connect to the guest network and try opening the printer's or NAS's web page. It should fail; the internet should work.

WPA3, WPA2 and why the security mode matters

The Wi-Fi Alliance's security overview says WPA3 is mandatory for Wi-Fi CERTIFIED devices and that WPA3-Personal users get increased protection from password-guessing attempts. WPA3 also requires Protected Management Frames, which makes some disruption attacks harder.

In practice: use WPA3 where all your devices support it, WPA2/WPA3 mixed (transition) mode if a few older laptops or printers only do WPA2, and never WEP or an open staff network. If your router only offers WEP or WPA, it is too old to keep; replace it.

Printers, CCTV and smart devices: keep them apart

Printers, smart TVs, door access panels, CCTV cameras and similar devices rarely get security updates and often keep default passwords. They are a favourite stepping stone for attackers.

• Printers: keep them on the staff network (or a separate device network) so only company laptops can print. Change the printer's admin password.
• CCTV recorders and cameras: best on their own network or wired, with remote viewing only through the vendor's app.
• Smart TVs and meeting-room screens: the guest network is usually fine; they need the internet, not your files.
• Unsupported devices: CSA's standard says devices no longer receiving updates, such as old cameras or printers, should be removed or replaced.

Routers and access points need updates too. Our patch management guide includes them in a simple monthly routine.

When to change the Wi-Fi password

Changing the staff password is a five-minute job, and it closes one of the most common gaps after people leave.

Add the Wi-Fi password change to your employee offboarding checklist so it is not forgotten.

Do it yourself or get help?

If you have one router and the admin login, setting up a guest network and changing the staff password is a short DIY job using the steps above.

Get help if nobody knows the router login, the ISP or installer set things up, you have several access points, or you want printers and CCTV on separate networks. A Quick Fix (1 hour) (S$119) covers a straightforward guest network setup. Our Security Health Check (S$290) reviews the whole network, including router settings, Wi-Fi, printers and CCTV, and gives you a prioritised fix list.