# Office Network and Wi-Fi: What a Small Business Needs > WPA3, a separate guest network, changed admin passwords, current firmware and cables for fixed devices. The router settings to use and why, a guest-network test, and a walk test for coverage. - Web page: https://sporesec.com/en/blog/office-network-wifi-small-business - Language: English - Last updated: 2026-10-17 - Also in עברית: https://sporesec.com/he/blog/office-network-wifi-small-business.md ## Answer WPA3, a separate guest network, changed admin passwords, current firmware and cables for fixed devices. The router settings to use and why, a guest-network test, and a walk test for coverage. - By Mahdy Lorens Gribkov - Published: 2026-09-13 - Revised: 2026-10-17 - IT, 6 min read - Keywords: office Wi-Fi setup, guest Wi-Fi separate network, WPA3 office, small business network security A reliable and safe office network has six parts: a router you keep updated, Wi-Fi encryption set to WPA3 (or WPA2/WPA3 transitional if older devices need it), a changed default admin password, a guest network separate from the staff network, cables for the devices that never move, and enough access points placed by testing rather than guessing. None of it is exotic. Most office network problems come from skipping the boring parts: nobody updates the router, nobody changed the password it shipped with, and visitors sit on the same network as the accounting computer. Below are the settings with the reasons from current vendor guidance, a test for the guest network, a walk test for coverage and what to hand to someone to own. ### Which settings should the router and access points have? Apple's support page on recommended router settings (published 26 March 2026) is a useful checklist, because it explains the reason for each setting. The advice, in short: - **Security:** set to WPA3 Personal, or to WPA2/WPA3 Transitional for compatibility with older devices. WPA2 Personal with AES is for when you cannot use either. Avoid WPA/WPA2 mixed modes, WPA Personal, WEP and anything with TKIP in its name, and never leave the network open, "even if security is turned off temporarily or for a guest network". - **Network name:** one unique name for all bands, on every router and access point, and not a default such as "linksys" or "netgear". Different names for the 2.4 GHz and 5 GHz bands can make devices connect unreliably. - **Hidden network and MAC filtering:** both disabled. Apple says hiding the name "doesn't conceal the network from detection or secure it against unauthorized access", and that MAC addresses "can easily be copied, spoofed (impersonated), or changed". Use a strong password with the right security mode instead. - **Automatic firmware updates:** enabled, if the router offers it. - **Radio mode and bands:** enable all modes and all bands the router supports. - **Channel:** auto. If you have several routers or access points, give each a different channel, especially when they are close. Set the 2.4 GHz channel width to 20 MHz. - **DHCP lease time:** 8 hours for an office network and 1 hour for a guest network. Notice how advice ages. NIST's small business guide (November 2016) tells you to stop the router broadcasting its network name and to use WPA2 with AES. Apple's 2026 page says hiding the name does not help and puts WPA3 first. When you read a checklist, look at its date. The same NIST guide has two lines that have not aged. It says to change the administrative password that was on the device, because default values "are typically known or easily guessed", and that if your business provides wireless internet access to customers, it should be "separated from your business network". It also notes that the hardware firewall between you and the internet may be a function of a router provided by your internet provider. If that is your case, ask the provider who manages that router and whether you can log in to it. ### What does separating the guest network mean in practice? Giving guests a different Wi-Fi name and password is a start, not the finish. The router or access points must also stop guest devices from reaching internal devices such as the file server, the printer and the accounting computer. After you set it up, test it: 1. Connect a phone to the guest network, with mobile data turned off. 2. Try to open the printer's address, the file server and the router's admin page from that phone. 3. Try to ping or open a staff computer by its address. 4. If any of them answers, the separation is only cosmetic. Fix it before you tell visitors the password. Also keep the printer, the cameras and anything staff use on the staff network, and put the visitors' password on a card at reception rather than the staff one. ### How do you get Wi-Fi that works in every room? - **Wire what does not move.** Desktop computers, printers, phones on desks and meeting-room screens work better on a cable than on Wi-Fi. That frees the wireless network for laptops and mobiles. - **Add access points instead of buying a stronger router.** One router in a corner covers the corner. Several access points, wired back to the switch, cover the office. Give them the same network name and different channels, as above. - **Walk the space.** Stand at the farthest desk, the meeting room and the kitchen with a phone, run a speed test and write down the result per room. Do it at the busy hour. Repeat after any move of furniture or equipment. - **Mind the walls and the floors.** Concrete, glass and metal doors weaken the signal. If your office has a reinforced concrete protected space or thick concrete walls, test the rooms behind them specifically. - **Choose by what your devices support.** A new access point does little for laptops and phones that only support an older standard. Check the devices you actually have before spending. ### When should you replace the router? Replace it when it no longer receives security updates, when it cannot do WPA3 or WPA2/WPA3 transitional or a real guest network, or when it is the cheap box that came with the internet line and also has to carry the whole office. Apple notes that firmware updates can change the security settings available to you, which is one more reason to keep a router that still gets them. A router is the front door of the office. Treat a device that no longer gets updates as a door with a known broken lock. ### What about power? NIST's guide advises plugging computers and critical network devices into an uninterruptible power supply, and the rest into surge protectors. For a small office, the router, the switch and the access points are the minimum: on a UPS they ride through a short outage or a flicker instead of restarting, so the network does not drop each time the power does. ### What should you hand someone to own? 1. **The admin login,** held by the business, in a password manager, not on a sticky note on the router. 2. **A list of what is on the network:** computers, printers, phones, cameras, any smart devices. 3. **A date for firmware updates,** monthly or on automatic. 4. **A copy of the router's settings,** exported before every change. Apple's advice is to back up the router's existing settings before you change them. The [backups post](https://sporesec.com/en/blog/backups-that-actually-restore) explains how to test that a copy restores. 5. **A map of the cables and access points,** so the next person does not start from nothing. ### How do we help? Network, Wi-Fi and printers that just work are part of our office IT service, priced as a fixed monthly fee per office and scoped on a free intro call. See [IT and infrastructure](https://sporesec.com/en/services/infrastructure), or [book a free intro call](https://sporesec.com/en/book). If you also run a website, our [free website scan](https://sporesec.com/en/tools) shows what your domain and site expose to the outside. ### Sources - [Recommended settings for Wi-Fi routers and access points, Apple Support](https://support.apple.com/en-us/102766), published 26 March 2026, as captured by Common Crawl on 11 April 2026. - [Small Business Information Security: The Fundamentals, NISTIR 7621 Revision 1, NIST](https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7621r1.pdf), November 2016, as captured by Common Crawl on 18 February 2026. ## Questions and answers ### Should an office have a separate guest Wi-Fi? Yes. NIST's small business guide (November 2016) says wireless access you provide to customers should be separated from your business network. Test it: from a phone on the guest network, try to reach the shared drive, the printer and the router's admin page. ### Which Wi-Fi security setting should I use? Apple's router guidance (published 26 March 2026) says to set WPA3 Personal, or WPA2/WPA3 Transitional for compatibility with older devices, and to avoid WEP, TKIP, WPA/WPA2 mixed modes and open networks. It also says hiding the network name and MAC filtering do not secure a network. ### When should I replace the router? When it no longer gets security updates, cannot do WPA3 or a real guest network, or is the basic box from the internet provider that has to carry the whole office. ## Next step - Book a free intro call: https://sporesec.com/en/book.md - Blog: https://sporesec.com/en/blog.md --- - Contact: contact@sporesec.com | WhatsApp https://wa.me/972532322318 | https://sporesec.com/en/contact.md - Book a free intro call: https://sporesec.com/en/book.md - Machine-readable site data: https://sporesec.com/llms.txt | https://sporesec.com/agents/en/index.json