Guest Wi-Fi at the office: why a separate network isn't a luxury

Customers, suppliers, and the plumber all ask for your Wi-Fi password. A separate guest network fixes that — and keeps your business data safe at the same time.

The engineer comes to service the boiler and asks if he can jump on the Wi-Fi. The sales rep wants to stream his presentation. And that client waiting for an hour would like to log in too. Before you know it, your business network password is floating around on sticky notes, in chat messages, and saved on strangers' phones.

That's not just careless — it's a real risk. Every device connected to your main network can, in principle, see everything else on it: the network drive, the printer, the till, the cameras. A guest network solves that. And setting one up usually takes no more than ten minutes.

Why your main network isn't for visitors

Your business Wi-Fi connects devices you trust: employees' laptops, the printer, the NAS with your files, maybe a card payment terminal. Those devices talk to each other, share folders, and trust one another.

A guest device is an unknown quantity. You have no idea whether it's up to date, what apps are on it, or whether it's carrying malware. Once that device is on the same network, it could:

• monitor other devices on the network;
• attempt to log in to the printer, router, or NAS;
• spread malware to other machines;
• save your Wi-Fi password and share it with anyone, at any time.

That last point is more often the real problem than a targeted attack. A former employee, an ex-cleaner, or a departing intern still has your Wi-Fi password saved on their phone. And you almost never change that password, because then everyone has to reconnect.

What a guest network actually does

A guest network is a second, separate Wi-Fi broadcast by the same router, but completely isolated from your main network. Anyone connected to the guest network gets internet access — nothing more. No access to your printer, your files, your cameras, or any other device in the office.

An added benefit: you can change the guest password every quarter without inconveniencing anyone in the office. You can also usually limit the bandwidth, so a visitor kicking off a large download doesn't grind your own work to a halt.

How to set it up

Almost every modern router — whether it's a KPN, Ziggo, Fritz!Box, or Ubiquiti model — supports a guest network. The steps vary by brand, but they generally go like this:

1. Log in to your router. Usually via an address like 192.168.1.1 or mijnmodem.kpn. The login credentials are on a sticker on the bottom of the device.
2. Find the Wi-Fi settings. There's often already a "Guest network" option there, just waiting to be switched on.
3. Give it a recognisable name. Something like CompanyName-Guests, so visitors immediately know which one to connect to.
4. Choose a decent password. Around 12 characters — easy enough to read out, but not your company name plus 2026.
5. Check that "isolation" or "no access to local network" is enabled. This is the most important setting — without it, a guest can still reach your printer.
6. Optionally set a bandwidth limit. For example, 20 Mbit per device.

Print the guest password on a small sign at the reception desk or in the waiting area. It'll save you answering the same question ten times a day.

Practical maintenance tips

A guest network isn't a "set it and forget it" thing. A few simple habits help:

• Change the password every quarter. Put it in your calendar alongside other small recurring tasks.
• Give your main network a boring, technical name. Not CompanyXYZ-Office, but something neutral. That way it attracts less attention.
• Don't hide your main network completely. "Hidden" networks aren't actually more secure — they're just more of a hassle to use.
• Test it yourself. Connect your phone to the guest network and try to reach the printer. If you can, the isolation setting isn't configured correctly.
• Keep your router updated. Most routers update themselves, but check that this feature is switched on.

What often gets overlooked

Two things come up regularly when we visit a client's office:

Smart devices are on the wrong network. A smart thermostat, a video doorbell, or an IoT coffee machine really has no business being near your company data. These devices rarely get updates and are often vulnerable. Put them on the guest network (or create a third network if your router supports it).

The router is still using the factory admin password. Not the Wi-Fi password — the administrator password used to log in to the router itself. That's usually printed on the sticker and is easy for anyone on your network to guess. Change this first.

Not sure whether your setup is secure?

Checking whether your network is locked down from the outside is a quick job. Our IP lookup tool shows you your public IP address and the provider behind it — useful if you ever want to verify a firewall rule. Prefer to have someone take a look and check whether your overall network setup still makes sense for the way you work today? Our access check is perfect for that — just half an hour. Small maintenance, big difference.