Securing your office Wi-Fi

Common weaknesses in small office networks

Many small offices run on a consumer router installed years ago. The Wi-Fi password is written on a sticky note, former employees still know it, and visitors, contractors and staff phones all share the same network as the accounting computer and the file server. None of this looks dangerous day to day, but it means anyone within range who has the password can reach your business systems directly.

Fixing this does not usually require expensive equipment. It requires deliberate configuration and someone responsible for keeping it current. A few hours of setup and a simple checklist reviewed twice a year will address most of the risks described in this guide. Business-grade equipment helps, but good configuration matters more than the brand on the box.

Use strong encryption and change default settings

Use WPA3 where your equipment and devices support it, or WPA2 with AES as a minimum. Turn off WPS, the push-button pairing feature, which has known weaknesses. Change the default administrator password on the router or access points, and make sure the admin page is not reachable from the internet. Keep firmware updated, and replace equipment the manufacturer no longer supports.

Choose a long Wi-Fi passphrase and change it when staff leave or when it has been shared too widely. A network name that does not identify your business is a small but useful step. Avoid printing the business network password on signs or welcome cards, and give visitors the guest password instead.

• WPA3, or WPA2 with AES at minimum
• WPS turned off
• Default admin passwords changed
• Firmware current and supported

Separate guests and devices

Create a guest network that is isolated from your business network and only provides internet access. Give it its own password and change it regularly, or use a captive portal with daily codes. Visitors, personal phones and anything you do not manage should live there. Check the isolation actually works by connecting a phone to the guest network and confirming you cannot see printers or shared drives.

Smart devices such as TVs, cameras, thermostats and printers are often poorly secured and rarely updated. Put them on their own network segment, called a VLAN, so a compromised camera cannot be used to reach your file server. Business-grade access points and firewalls make this segmentation straightforward to set up and manage.

Control who joins the business network

For organizations with more than a handful of staff, a shared password for the business network becomes hard to manage. Enterprise Wi-Fi, known as WPA2-Enterprise or WPA3-Enterprise, lets each person sign in with their own credentials, often their Microsoft 365 account. When someone leaves, disabling their account removes their Wi-Fi access too, with no need to change the password for everyone.

Combine this with a regular review of connected devices. Unknown devices on the business network should be identified and either moved to the guest network or removed. Most business-grade systems can list connected devices by name and manufacturer, which makes this a quick monthly check rather than a large project. Investigate anything you cannot name.

Watch the edges

Wi-Fi signals do not stop at your walls. Position access points to cover your space without broadcasting strongly into the parking lot or neighbouring units. Check occasionally for rogue access points, such as a cheap router an employee plugged in to fix a weak signal, which can bypass your security controls entirely.

Finally, remember that Wi-Fi security is only one layer. Encrypted connections to cloud services, updated devices and MFA still matter, because staff will also connect from home, hotels and coffee shops. A secure office network is a strong foundation, but it should not be the only thing standing between your data and an attacker.