Who this suits: Shops, offices and venues offering visitor internet access.
What guest Wi-Fi should do
Guest Wi-Fi should let visitors use the internet without granting unnecessary access to business systems. Give it a distinct name and appropriate access controls, but do not assume the name itself creates separation. The router, access points and switching configuration must enforce the intended boundary. A technician should explain the design and demonstrate what a guest device can and cannot reach.
Decide whether guests actually need the service. An appointment-based office may provide access to a few visitors, while a busy venue has a very different capacity and support problem. Keep the experience proportionate. A complicated sign-up page can increase staff workload and collect information you do not need.
Define the trust boundaries
Identify business computers, printers, payment terminals, security cameras, building devices and visitors. Decide which groups need to communicate. A VLAN is a logical division within a network; firewall rules control permitted traffic between divisions. The labels are less important to an owner than the resulting access: a visitor should not browse office files or the camera recorder.
Ask the installer to document exceptions, such as a meeting-room display visitors need to use. Avoid a broad rule allowing access to all internal devices merely because one presentation system was difficult to configure. Test the exception itself and keep it limited. If staff use guest Wi-Fi for personal devices, explain that it may not provide access to internal business resources.
Test instead of assuming
Use a guest device that has never joined the staff network. Confirm it can reach the internet and then check that it cannot open the administration interface of the router, printer or recorder. Have a competent technician test the separation; do not attempt intrusive scanning on networks you do not control.
Check whether guest devices can communicate with each other and decide if that is appropriate. Client isolation can limit that access, but the exact behaviour depends on the equipment and configuration. Also test after a restart and a firmware update. A guest configuration written on a handover sheet is not proof that the current live rules still match it.
Manage capacity and expectations
Guest use shares some resources with the business unless a separate service has been installed. Set sensible limits or priorities if heavy downloads could disrupt transactions or calls. A separate Wi-Fi name does not provide a separate internet connection. Consider simultaneous usage, upload demand and busy times, as nbn's business setup guidance recommends.
State practical expectations for visitors: how to connect, whom to ask if it fails and whether the service is available throughout the premises. Avoid promising uninterrupted or secure access without evidence. If your business requires continuous connectivity for payment processing, assess that requirement separately rather than relying on a guest password policy to solve it.
Keep administration and privacy simple
Use a business-controlled administration account and protect it with MFA where supported. Limit who can change settings, keep software supported and document recovery. Change shared access details when necessary and remove old staff access to management systems. A QR code can simplify entry, but it should reveal only the intended guest details.
If a captive portal collects names, email addresses or acceptance logs, understand why the information is needed, where it is stored and who can access it. Do not assume that collecting more information makes the network safer. Get advice on applicable privacy and other obligations where necessary. This guide does not establish a compliant monitoring or data-retention policy.
Keep a practical decision record
Document exceptions as business decisions. If visitors need to cast to a display or access a shared device, name that device, the permitted method and the person maintaining it. Do not expose a whole network segment for convenience. Give staff a short instruction for helping guests that does not include the internal password or administrator login. When changing routers or engaging a new supplier, include guest isolation in the handover test. Otherwise a seemingly routine equipment replacement can quietly remove a boundary that the business assumed still existed.
Handover checklist
Ask for a network diagram showing staff, guest and device separation; the access rules; the administrator owner; and an agreed test record. Keep the guest instructions visible to staff so they are not tempted to disclose the main business password. Record which provider handles failures and what support is included.
Use the internet and Wi-Fi estimator to include visitors in peak demand. Then read the Wi-Fi troubleshooting guide if capacity remains unreliable. The goal is useful visitor access with a tested boundary and manageable cost, rather than a branded sign-in screen that hides an insecure or overloaded network.
Sources and review notes
Official references used for this guide. Product features and terms can change. Examples are illustrative unless explicitly described otherwise.