Guest Wi-Fi at the office: why you really want a separate guest network

A client asks for the Wi-Fi password and you type it in without a second thought. Convenient — but also risky. Here's how to set up a guest network without making it complicated.

A client stops by for a meeting, wants to show a presentation, and asks: "Can I get the Wi-Fi password?" You type it straight into their laptop. Friendly, quick, done. And without anyone realising it, that laptop is now on the exact same network as your printer, the NAS drive holding all your contracts, and your accountant's laptop.

In most offices we visit, there's a single Wi-Fi network. Everyone uses it: employees, visitors, the engineer who comes to top up the air conditioning, the intern from last year whose phone still connects automatically. There's a smarter way to handle this — and it won't take you a full day to set up.

Why one network for everyone is a problem

A Wi-Fi network isn't just "internet". It's also the digital hallway of your office. Anyone connected to it can, in principle, see and sometimes access other devices on that same network. Think about:

• The network printer, which still has the last 200 documents stored in its memory.
• A network drive or NAS containing invoices and personnel files.
• Cameras, thermostats, or other "smart" devices that are often poorly secured.
• Colleagues' laptops, which sometimes have shared folders left open.

Most visitors obviously have no bad intentions. But their device could be infected without them knowing it. Suddenly there's malware on your network quietly poking around. On top of that: every Wi-Fi password you share stays saved on phones and laptops. Forever. Even long after that person is no longer a client.

What exactly is a guest network?

A guest network is a second Wi-Fi network from the same router. It has its own name and its own password. But most importantly: devices on the guest network can only access the internet. They can't reach your printer, your NAS, or your employees' laptops.

Virtually every modern router or Wi-Fi access point supports this. With business providers like KPN, Ziggo Zakelijk, or Odido, it's built right into the menu. With standalone brands like Ubiquiti, TP-Link, Fritz!Box, or Netgear, you'll find it under names like "guest network", "guest Wi-Fi", or "SSID 2".

How to set it up in practice

1. Choose two network names

Pick something recognisable but not too specific. For example, Bakery-Internal and Bakery-Guests. Don't put your address or your router brand in the name — that only makes it easier for outsiders to figure out what equipment you're running.

2. Give each network a strong, unique password

For the internal network: a long password that you set once per device and don't hand out. For the guest network, the password can be easier to read aloud, since you'll be sharing it more often. Change the guest password twice a year, for example — former clients will automatically lose access.

3. Enable client isolation on the guest network

This option ensures that guests can't see each other on the network either. Handy when multiple clients are sitting in the waiting area at the same time. In your router's menu this is sometimes called "AP isolation" or "isolate devices from each other".

4. Limit bandwidth (optional)

Want to prevent a visitor streaming a Netflix series from disrupting your video call? Many routers let you set a maximum speed for the guest network. 20 to 50 Mbit is usually more than enough for email, browsing, and a video call.

5. Print a sign for the waiting area

A small card with the guest network name and password saves you several questions every week. And it sends a clear message: we think about these things here.

Don't forget your own devices

While you're at it: move your "smart" devices onto the guest network too. Think of a smart TV in the meeting room, a smart doorbell, or a Wi-Fi-enabled coffee machine. These things rarely receive serious security updates and don't belong on the same network as your administration. If you can create multiple networks, a third network dedicated to these devices is even better.

What does this cost?

Usually nothing. The feature is already built into your current router. You'll need at most twenty minutes to set it up. Only if your equipment is really old (older than, say, 2018) might a guest network not be supported. That's a good moment to think about replacing it — a modern router or access point for business use starts at a few hundred euros.

Quick summary

• One Wi-Fi network for everything is like handing every visitor the key to your filing cabinet.
• A guest network costs nothing and can usually be set up in twenty minutes.
• Enable client isolation and change the guest password every now and then.
• Keep smart devices off your main network too.

Not sure whether your router supports this, or would you like someone to take a look without it turning into a big project? Our access check covers exactly these kinds of issues: who is on your network, who has access to which systems, and where the hidden vulnerabilities are. Practical, in plain language, and with no sales pitch afterwards.