Wi-Fi done right for a small office: coverage, guest access, and keeping printers and smart devices apart

One network for everything

Illustration, not a real event: a six-person accounting office in Poughkeepsie has one Wi-Fi network. The password is on a sticky note at reception because clients ask for it. The conference-room TV, the thermostat, the label printer and the partners’ laptops all share it. The back office drops calls, so someone bought a range extender that nobody remembers setting up.

Every device on that network can see every other device. A client’s infected phone, a smart TV that stopped getting updates in 2022 and the laptop holding tax returns are neighbors. And the coverage problem has been “solved” with a box that is itself a new unmanaged device.

Why it happens

Wi-Fi is set up once, on the day the internet is installed, with one name and one password.
Guests need access, so they get the only password there is.
Printers and smart devices are added one at a time, wherever is convenient.
Coverage is guessed. Access points go where a cable already runs, not where people work.

The design: plan the coverage, then separate the traffic

SMC’s preferred platform for office Wi-Fi is UniFi. If your current Wi-Fi equipment is supported and does the job, SMC designs around it with the same structure.

1. Plan coverage before buying

UniFi Design Center (design.ui.com) imports a floor plan image or PDF, draws walls, runs a coverage simulation, places access points by zone and expected client count, and recommends channels. Ubiquiti offers it without recurring software fees, and a finished design can be sent to Site Manager for pre-provisioning (Introducing the Next Generation of UniFi Design Center, September 24, 2026).

Use it to put access points where people sit, not where cable is easy, and to replace range extenders with wired access points. Old buildings with plaster and brick, common in the Hudson Valley, usually need more access points than a quick look suggests; the plan shows you before you buy.

2. Three networks, not one

Network	Who and what	Rules
Staff	Company laptops and phones	Can reach printers; cannot be reached from guest or device networks
Guest	Visitors’ devices	Internet only; isolated from everything else and from each other
Devices	Printers, TVs, thermostats, smart speakers	Reachable from staff for the specific service; no access to staff devices

Cameras and door hardware get their own network as well; a separate post covers that.

The guest network. Ubiquiti’s guest Wi-Fi best practice is to turn on Network Isolation for the guest network so it can’t reach other networks, Client Device Isolation so guests can’t reach each other on the same access point, and Device Isolation (ACL) to complete isolation at the switch. A captive portal (Hotspot Portal) is optional, and speed limits keep one guest from using all the bandwidth (Best Practices: Guest WiFi). Change the guest password on a schedule, and give staff a different one.

The device network. Put printers and smart devices on their own network and use UniFi’s Zone-Based Firewall to allow only what’s needed, for example staff laptops to the printer for printing, and nothing back the other way (Zone-Based Firewalls in UniFi).

3. Fewer network names with private passwords

Three network names can be one. UniFi’s Private Pre-Shared Keys (PPSK) let a single Wi-Fi name carry several passwords, each mapped to its own network, so staff, guests and devices land in the right place by which password they use. Ubiquiti notes PPSK requires WPA2 (UniFi WiFi SSID and AP Settings Overview). That is also how you give one device, or one group, its own password that you can change without disturbing everyone else.

4. Settings that trip up small offices

From the same Ubiquiti settings guide:

Use multi-band networks. Ubiquiti warns that 6 GHz-only networks can cause discovery problems because many devices scan on 2.4 or 5 GHz first.
Multi-Link Operation, a Wi-Fi 7 feature, also enables WPA3, which may stop some smart devices from connecting. Turn it on only where Wi-Fi 7 clients benefit, and not on the device network.
Enhanced IoT Connectivity can help older low-power devices stay connected; it is generally not needed otherwise.
Broadcasting a network only from specific access points or groups keeps, for example, the guest network to the front of the building.

5. Wire what doesn’t move

Desktops, printers, conference-room TVs and access points themselves are better on cable. Wi-Fi is for the things that move.

Checklist

Floor plan run through a coverage plan; access points placed where people work
Range extenders replaced with wired access points
Separate staff, guest and device networks (or one name with PPSK)
Guest network: Network Isolation, Client Device Isolation, Device Isolation (ACL)
Device network reachable only for named services from staff
Guest and staff passwords differ; guest password changed on a schedule
Multi-band networks; MLO and WPA3-only kept off the device network
Fixed equipment wired

When to get help

SMC assesses the building and current Wi-Fi, designs the network layout and rules, and writes the specification. A licensed installer or IT provider you contract with does the installation; SMC reviews the bid and checks the finished network against the specification. SMC doesn’t sell equipment or take commissions. UniFi is our preferred platform; if your existing equipment fits, we design around it.

Start with the free security assessment at https://www.securitymedic.com/assessment. You get a gap report to keep and a free results review; you can also start with a free 30-minute call.

Sources

Ubiquiti blog, Introducing the Next Generation of UniFi Design Center, September 24, 2026.
Ubiquiti Help Center, Best Practices: Guest WiFi, updated October 19, 2026.
Ubiquiti Help Center, Implementing Network and Client Isolation in UniFi, updated October 20, 2026.
Ubiquiti Help Center, Zone-Based Firewalls in UniFi, updated October 28, 2026.
Ubiquiti Help Center, UniFi WiFi SSID and AP Settings Overview, updated October 8, 2026.