Your Guest Network Is Sharing More Than the Broadband

There is a small black box in a cupboard, or under reception, or behind the photocopier. It was installed by an ISP engineer, handed a password, and has been quietly doing two jobs ever since: running the staff Wi-Fi and running the guest Wi-Fi. Those two jobs should not be the same job.

In plenty of small UK offices, the guest network is just a second name on the same flat network. A visitor joins it, gets an IP address, and can often see the printer, the NAS, the CCTV recorder or the router's admin page. Nobody meant for that to happen. It happened because the guest network was switched on once and never looked at again.

You do not need to be a network engineer to improve this. You need twenty minutes, a phone, and the willingness to press Save.

First, find the box and photograph the label

Do not factory reset anything. Find the router, note the make and model, and take a photo of the sticker on the back. That sticker usually has the admin address, the default admin username and the Wi-Fi key. It is also a useful record of what the ISP supplied.

If the router is in a locked cupboard and nobody knows who has the key, that is your first finding. The person who can reach the router can usually reset it. Put that on the list.

Change the admin password, not just the Wi-Fi key

The Wi-Fi password stops people joining the network. The admin password stops people changing the network. They are not the same thing, and the admin password is the one that gets forgotten.

Log in to the router's admin page using the address on the label. If the password is still the default, or still printed on the sticker, change it now. Use a long, unique password stored in your password manager. If the ISP manages the router and you cannot change it, ask them to confirm the admin password has been changed and remote administration is switched off.

While you are in there, look for anything called remote management, remote access or cloud admin. If you do not use it, turn it off. A router admin page exposed to the internet is a very boring way to have a very bad week.

Make the guest network actually guest

This is the part that matters most. Look for settings called guest network, client isolation, AP isolation or network isolation. The wording varies by manufacturer, which is unhelpful, but the idea is simple: guests should get internet access and nothing else.

Test it with a phone. Connect to the guest Wi-Fi and try to open the printer's web page, or the NAS address, or the router admin page. If any of those load, the guest network is not isolated. It is just a second door into the same room.

Turn on client isolation if it is there. If your router has no such option, you have a few choices. Ask the ISP whether they can separate guest traffic. Put a separate access point on a separate network for visitors. Or, for a small office, buy a modest router that supports a proper guest VLAN and stop using the ISP box as the whole network. You do not need enterprise kit. You need the guest network to be a dead end.

Update the firmware and set it to update itself

Find the firmware or system update page. Note the version and check whether automatic updates are on. If they are not, turn them on. If the router is ISP-managed, confirm the ISP pushes updates automatically, because some do and some quietly do not.

Do not go hunting for unofficial firmware from a forum. That is how a twenty-minute audit turns into a weekend. Use the manufacturer's or ISP's update path, and record the version you are on.

Turn off the features nobody uses

WPS is the button that lets a device join without typing the password. It was convenient years ago. It is not convenient now. Turn it off unless you have a specific, temporary reason to use it.

Have a quick look for port forwarding rules you do not recognise. If somebody has opened a port for a camera, a game server or a piece of software nobody remembers, close it or ask why it is there. Also check UPnP. If nothing needs it, off is usually the safer default in a small office.

Ask who actually has the guest password

Guest Wi-Fi passwords end up on whiteboards, in welcome packs, in the cleaner's phone, with the neighbouring business and with the contractor who left last spring. That is not a moral failing. It is what happens when a password is designed to be shared.

Change the guest password. Keep it separate from the staff Wi-Fi. If you print it, put a date on the printout so old copies are obvious. Rotate it after big events, office moves or anything that involved a lot of visitors. You do not need to change it weekly. Quarterly is a reasonable start.

Keep a one-page record

Write down the router location, make and model, admin address, where the admin password is stored, the guest network name, whether isolation is on, whether firmware updates are automatic, whether WPS is off, when the guest password last changed and who holds it. Put a reminder in the calendar for a quarterly twenty-minute check.

That record is not bureaucracy. It is the difference between a future you who can answer a question in two minutes and a future you who is crawling under a desk with a torch.

The router is not glamorous. It is the front door to a lot of things that matter. Give it twenty minutes and a proper guest list, and it stops being the quiet weak point in the cupboard.