Set up a guest Wi-Fi network

A guest network gives visitors internet without handing them the password to your main Wi-Fi. It also keeps their phones, and many smart-home gadgets, from seeing the computers, printers, and shared folders on your main network.

Most home routers have this built in. The setting might be called Guest, Guest network, Guest Wi-Fi, or Guest access. The exact name varies by brand and by whether your internet provider supplied the box. If you can’t find it, check the router’s or ISP’s help page rather than guessing.

This pairs with Secure your home Wi-Fi in 15 minutes. If you haven’t already changed the default admin password and set WPA3 or WPA2 AES on the main network, do that first.

1. Open the router’s admin page

You need to be connected to your own network (Wi-Fi or a cable into the router).

1. Find the router’s address. See Find your router’s admin page.
2. Type that address in a browser and sign in with the admin username and password, not the Wi-Fi password, if those are different.
3. Look for a Wireless, Wi-Fi, or Guest section.

If this is an ISP-managed gateway and there’s no guest option in the admin page, check the provider’s app. Some ISP boxes expose guest Wi-Fi there and not in the web menu.

2. Turn guest Wi-Fi on and give it its own name

Enable the guest network. Give it a name that’s obviously yours for visitors, but don’t put your full name or address in it. A simple name like SmithGuest is fine if that’s not also your street name; otherwise pick something generic.

Use a different name from your main network so people can tell them apart. If you see separate guest options for 2.4 GHz and 5 GHz, you can turn on one or both. 2.4 GHz is usually enough for a visitor who just needs email and a browser.

3. Set a strong, separate password and modern encryption

Set a password you don’t use on the main network or on your accounts. CISA recommends a long, unique password for guest Wi-Fi.

If the guest network has its own security setting, choose WPA3 Personal when it’s available, or WPA2 AES (also listed as WPA2-PSK or WPA2 Personal) if it isn’t. Don’t leave a guest network open, and don’t use WEP.

You’ll share this password with visitors. You can change it later without touching the main network’s password.

4. Leave guest devices separated from your main network

If you see a setting like Guest isolation, AP isolation, Allow guests to access my local network, or Allow guests to see each other, keep guests off the main network. The wording is inconsistent:

• Isolation or “access my local network” set to off means visitors shouldn’t reach your PCs, printers, or shared folders. That’s what you want for a typical home.
• If the only switch is “allow guests to see each other,” you can leave that off too, unless you have a reason for two visitor devices to talk.

When in doubt, pick the option that keeps guest devices off your main network, then test in the next step.

5. Decide what belongs on the guest network

Put these on the guest network:

• Visitors’ phones, tablets, and laptops
• Smart TVs, speakers, bulbs, and other gadgets that only need the internet, if they work fine there (CISA recommends this when internet access is all those devices need)

Keep these on the main network:

• Work or school laptops
• The printer, desktop, or network drive you need to reach from your own devices
• Anything that has to talk to another device in the house (a printer your laptop has to find, a camera app that expects the phone and the camera on the same network)

If a gadget stops working after you move it to the guest network, move it back to the main network. Guest isolation is doing its job.

6. Test it before you hand out the password

Connect a phone to the guest name, enter the new password, and confirm a website loads. Then try to reach something that’s only on the main network, like a shared folder or the printer. That should fail. If the phone can still see your PC or printer, look again for an isolation setting, or check the ISP app.

Sign the test phone off the guest network when you’re done, and store the guest password in your password manager.

What not to do

• Don’t reuse your main Wi-Fi password on the guest network. The point is to share a different one.
• Don’t put your work laptop on the guest network “to be safe.” Work devices usually need the main network, and your company may expect that.
• Don’t factory-reset the router if you can’t find the guest setting. Check the manual or the ISP app first.

Still stuck?

If you want help finding the guest setting on your router, I can connect remotely and walk through it with you. Support is after-hours, nationwide, with local help in the Dallas–Fort Worth area. Details are on the Work with me page.

Sources checked

• Module 5: Securing Your Home Wi-Fi (CISA)
• Securing Wireless Networks (CISA)
• Home Network Security (CISA)