Small Town Sysadmin
Free CJIS checklist

Tech basics

Securing your office Wi-Fi, including a separate network for guests

A plain-English checklist for locking down the office Wi-Fi: the right security setting, a strong password, and a separate guest network so visitors stay off your business computers.

Your office Wi-Fi is the front door to every computer, printer, and file in the building. Most offices set it up once, years ago, and never look at it again. A few settings in the router, the box that creates the Wi-Fi, decide how hard it is for a stranger to walk in.

Most of this takes under an hour. Some steps need someone who has the router’s admin login. If that’s your internet provider or an IT company, send them this list and ask them to confirm each item.

Check the four settings that matter most

Sign in to the router’s settings page (the sticker on the router or your provider can tell you how). Then check:

  1. Wi-Fi security type. Look for WPA3 Personal or WPA2 with AES. CISA, the US government’s cybersecurity agency, calls these the two safe choices. If you see WEP, WPA, TKIP, or Open (no password), change it. Very old equipment may not offer a safe option, which means it’s time to replace the router.
  2. The Wi-Fi password. Use a long, random, unique password, not the company name or phone number. A few unrelated words strung together works well and is easier to type.
  3. The router’s admin password. This is different from the Wi-Fi password. It lets someone change the router’s settings. Default admin passwords for most routers can be found online, so change yours to something long and unique and store it in your password manager or a locked drawer.
  4. Updates. Check the manufacturer’s website for newer router software (called firmware). Updates fix security flaws. If the router can update itself automatically, turn that on.

If the router belongs to your internet provider, ask them to make these changes rather than guessing. Changing the wrong setting can knock the whole office offline.

Turn off two risky extras

  • WPS (Wi-Fi Protected Setup). This is the “press the button to connect” feature. CISA advises turning it off because of a design flaw in how it checks PIN numbers.
  • Remote management. This lets someone sign in to the router from the internet. CISA advises turning it off so strangers can’t change your settings from afar. If your IT company needs it, ask them how it’s protected.

Set up a separate guest network

A guest network is a second Wi-Fi name with its own password, kept apart from the one your business computers use. Visitors, customers, and personal phones get the guest network. Your computers, printers, and files stay on the main one.

This matters because you can’t know what’s on a visitor’s phone or a staff member’s personal tablet. CISA’s guidance for organizations is to run a guest Wi-Fi network that is separate from the main one, so business information isn’t reachable from guest traffic.

  1. In the router settings, find Guest Network (sometimes called Guest Wi-Fi).
  2. Turn it on and give it a name people will recognize, such as the business name plus “Guest.”
  3. Give it its own long, random password, different from your main one.
  4. Look for an option like “Allow guests to see each other” or “Access to local network,” and make sure it is off.
  5. Connect visitors, personal phones, and smart TVs to the guest network only. Business computers and printers stay on the main network.
  6. Change the guest password now and then, and any time someone who knew it leaves.

Not every router has a guest network. If yours doesn’t, that is another good reason to upgrade. A business-grade router or access point includes it.

Check who is connected

Many routers show a list of connected devices. Look at it once. If you see names you don’t recognize, change the Wi-Fi password and reconnect only your own devices. If the list keeps showing strangers after that, it’s time to call a professional.

When to call a professional

  • The router is old and offers no WPA2 or WPA3 option.
  • You handle payment cards, medical records, or other sensitive customer information, which may carry rules about how your network must be set up.
  • You can’t sign in to the router and nobody knows who set it up.
  • You think someone has been using your network without permission. See Think you’ve been hacked? What to do in the first hour.

Sources

  • Securing Your Home Wi-Fi, Module 5 (CISA): WPA3 Personal or WPA2 AES as the safe options, long random passwords, guest Wi-Fi, updates, disabling WPS and remote management
  • Home Network Security (CISA): changing the default admin password, checking router firmware, the WPS PIN design flaw, turning off remote management
  • Securing Wireless Networks (CISA): WPA3 as the strongest encryption, changing default passwords, keeping access point software patched, using a guest network
  • Securing Enterprise Wireless Networks (CISA): the recommendation to run a guest Wi-Fi network separate from the main network

All articles