Guest WiFi is safe when guests can reach the internet and nothing else. That means putting guests on their own network segment, blocking them from your systems and from each other, limiting how much bandwidth they use, and handling any personal information you collect at sign-in carefully.
The most serious guest WiFi mistake is giving visitors access to the same network as staff computers, servers, printers, cameras, payment terminals or building controls. A visitor's infected laptop, or a deliberate attacker sitting in the lobby, can then probe and attack those systems directly. Sharing the staff WiFi password with guests has the same effect, and the password tends to spread long after the visit.
Everything else in this guide builds on one principle: guest traffic must be kept separate from everything you care about.
Separate the guest network
- Its own SSID and network segment. Give guests a dedicated network name, placed on its own VLAN or equivalent segment.
- Firewall rules that allow internet only. Block guest traffic from reaching any internal address range, management interfaces or building systems. Allow only what guests need, such as web traffic and DNS.
- Client isolation. Stop guest devices from seeing or connecting to each other. This protects guests from one another and limits the spread of malware.
- Separate addressing and DNS. Use separate address pools and, where practical, filtered DNS for guests.
- Protect the management side. Make sure access points, controllers and switches cannot be managed from the guest network.
Some organizations send guest traffic straight to a separate internet connection, which adds another layer of separation.
Encryption and sign-in
Open, shared password or enhanced open
A completely open network, with no password, is easy to use but sends traffic between the device and the access point unencrypted. A shared password (WPA2 or WPA3 personal) encrypts traffic, but everyone with the password can, in principle, do more than they should if the network is poorly configured. Wi-Fi Enhanced Open, based on Opportunistic Wireless Encryption, encrypts each connection without a password where devices support it. The right choice depends on your guests' devices and how easy access must be.
Captive portals
A sign-in page can present terms of use, collect a code from the front desk or a room number, or require a sponsor's approval. Keep portals simple, test them on common phones and laptops, and make sure the network beneath is still properly isolated; the portal itself is not a security boundary.
Bandwidth and acceptable use
Without limits, a few guests streaming or downloading can slow the connection for everyone, including your own staff. Common controls include per-device or per-network rate limits, prioritizing business traffic over guest traffic, session time limits and content filtering in line with your policies. Terms of use shown at sign-in tell guests what is and is not allowed.
Privacy and records
Many guest portals ask for an email address, a phone number or a social media login. If you collect personal information, Canadian privacy law applies: federally, the Personal Information Protection and Electronic Documents Act (PIPEDA), and in some provinces, including Alberta and British Columbia, provincial private-sector privacy laws. If you plan to send marketing email to addresses collected at sign-in, Canada's Anti-Spam Legislation (CASL) consent rules also apply. Collect only what you need, explain why, store it securely and keep it only as long as necessary. Get advice on your obligations if you are unsure.
Keep logs in line with your policy, so you can investigate misuse, but do not keep more than you need.
Checklist
- Guest network on its own SSID and segment
- Firewall allows internet access only, with internal ranges blocked
- Client isolation turned on
- Management interfaces unreachable from the guest network
- Encryption chosen to suit guests' devices
- Bandwidth limits and business traffic priority in place
- Terms of use and privacy notice at sign-in
- Guest password or codes changed regularly, if used
- Isolation tested from a guest device after every change
Test the isolation. After setting up or changing the guest network, connect as a guest and try to reach internal systems, printers and other guest devices. If you can reach them, so can everyone else.
How ehZee can help
Guest WiFi is part of our standard survey checklist, alongside security items such as RADIUS and Active Directory integration and the physical security of equipment. Our WiFi design and build service designs and configures guest networks with proper segmentation, isolation and bandwidth controls. For sector-specific advice, see WiFi for hotels and WiFi for healthcare facilities.
Common questions
Is a separate password enough to make guest WiFi safe?
No. A different password only controls who can join. Safety comes from what the guest network can reach, which depends on segmentation, firewall rules and client isolation.
Should guest WiFi have a password at all?
It depends on the setting. A password or Enhanced Open adds encryption over the air; an open network is simpler for guests. Either can be safe for your business if the network is properly isolated.
Can tenants or contractors use the guest network?
For basic internet access, yes. If they need to reach specific systems, give them a separate, controlled network rather than loosening the guest rules.