Summary:
- Lock down your router, turn on WPA3 or WPA2, and change all defaults.
- Separate staff, guest, and smart devices into different networks.
- Keep firmware updated and disable risky features like WPS and remote admin.
Introduction:
This guide gives small businesses a focused Wi-Fi checklist you can complete in a week. It covers routers used in small offices and storefronts. It does not cover large enterprise wireless designs.
Why it matters for small firms
Small offices often rely on a single internet router to handle payments, point-of-sale, files, cameras, and guest access. Attackers know these devices are widely deployed and often left with default settings or outdated software. U.S. agencies urge stronger protections on small office/home office (SOHO) routers because weak web interfaces and exposed management ports are routinely exploited. (Internet Crime Complaint Center)
Cybercrime losses keep rising. The FBI’s Internet Crime Complaint Center reported more than $16 billion in reported losses in 2024, a 33% increase from 2023. Phishing and data breaches remain top issues that often begin with weak network defenses. A secure Wi-Fi baseline reduces exposure. (Federal Bureau of Investigation)
What attackers do and why it works
Attackers scan the internet for routers with default or reused passwords, outdated firmware, or remote administration turned on. Once in, they can change DNS, capture traffic, or stage ransomware and fraud. CISA highlights that weak defaults and exposed management interfaces are common in SOHO gear. (Internet Crime Complaint Center)
Inside the office, criminals try to join open or poorly protected Wi-Fi. If the network uses old encryption, like WEP or WPA, traffic can be cracked. Current guidance is to use WPA3 where available, or at least WPA2, and to keep guest devices away from business systems. (Federal Trade Commission)
How to fix it this week
- Change all defaults on day one
Log in to the router’s admin portal. Change the admin username and password, and change the Wi-Fi network name (SSID) so it does not reveal the brand or location. Use a long passphrase. (Federal Trade Commission) - Turn on strong encryption
Set Wi-Fi security to WPA3 if your router and devices support it. If not, use WPA2. Avoid older options like WEP or WPA. Plan to replace hardware that cannot support WPA2/WPA3. (Consumer Advice) - Disable risky features
Turn off remote management from the internet, Wi-Fi Protected Setup (WPS), and Universal Plug and Play (UPnP). These features are convenient but increase risk on office networks. (Consumer Advice) - Update firmware and check monthly
Apply the latest router firmware from the vendor or your internet service provider. Create a recurring calendar task to check for updates and subscribe to vendor alerts. Outdated firmware is a known path to compromise. (Federal Trade Commission) - Create separate networks
Use separate SSIDs and VLANs if available: one for business devices, one for point-of-sale or critical systems, and one guest network for visitors and personal phones. Keep the guest network isolated from internal devices. (Federal Trade Commission) - Limit who connects
Only allow business-owned or managed devices on the primary network. Use the guest SSID for all other devices. Strong device access rules are part of basic small-business security. (Federal Trade Commission) - Turn on the router firewall and safe DNS
Ensure the built-in firewall is enabled. Consider a DNS service with malware blocking to cut off known bad domains. Many SOHO routers include a basic firewall that should be on by default. (Consumer Advice) - Document and train
Write a one-page Wi-Fi policy: who may join, which SSID to use, the current passphrase, and update steps. Train staff to avoid connecting work devices to public Wi-Fi and to report issues. The FTC recommends regular training and clear policies. (Federal Trade Commission)
Consider using a Managed Service Provider
A Managed Service Provider (MSP) can apply these controls faster and keep them enforced. MSPs bring automated firmware patching, secure configurations mapped to standards, network segmentation, 24/7 monitoring, and tested response plans. That is broader than the average IT person who may set up a router once but not maintain policies, logs, or alerts over time. MSPs also help standardize hardware and lifecycle upgrades so you reach WPA3 across the fleet and retire unsupported devices.
Costs, effort, and common pitfalls
- Hardware: Modern Wi-Fi 6 or Wi-Fi 6E routers that support WPA3 range from a few hundred dollars up, plus any managed access points for larger spaces. Budget for replacements if your devices cannot use WPA2/WPA3. (Consumer Advice)
- Labor: Expect 2–6 hours to inventory devices, change settings, update firmware, and document policies for a small office. Larger sites may need after-hours changes.
- Ongoing: Schedule monthly checks for updates and quarterly reviews of who has access.
- Pitfalls to avoid:
- Leaving remote admin exposed to the internet. (Internet Crime Complaint Center)
- Keeping factory passwords or SSIDs that reveal device brand or location. (Federal Trade Commission)
- Using a single SSID for staff, guests, and smart devices. (Federal Trade Commission)
- Relying on outdated encryption modes. (Consumer Advice)
Compliance notes (if relevant)
- NIST Cybersecurity Framework (CSF) 2.0: Network access control, secure configuration, and patching align with Protect and Govern functions. Using WPA2/3, limiting devices, and updating firmware are concrete CSF practices for small firms. (Federal Trade Commission)
- FTC Safeguards Rule for covered financial institutions: requires access controls, system monitoring, and secure configurations. Strong Wi-Fi controls support these obligations.
- NIST SP 800-153 offers detailed WLAN security recommendations that back the checklist above, including strong encryption, network separation, and continuous monitoring. (NIST Computer Security Resource Center)
FAQs
Q: Do I need WPA3, or is WPA2 enough?
A: Use WPA3 when your hardware supports it. If not, use WPA2 while you plan upgrades. Avoid older modes like WEP or WPA. (Consumer Advice)
Q: Should I hide my SSID?
A: Hiding the SSID does not secure a network. Focus on strong encryption, strong passwords, and segmentation. CISA and FTC stress changing defaults, enabling WPA2/3, and limiting devices over cosmetic settings. (Federal Trade Commission)
Q: Is a guest network really necessary?
A: Yes. It keeps visitors and personal devices off your business network and reduces the chance of malware spreading to point-of-sale or file servers. (Federal Trade Commission)
Call to action
Need help turning this checklist into a locked-down network? Book a quick consultation. Get a Wi-Fi assessment, safe configurations mapped to best practices, and a plan to reach WPA3 and separate networks without downtime.
Sources
- Federal Trade Commission. “Cybersecurity for Small Business: Protect your wireless network.” Accessed content with guidance on WPA2/3, limiting devices, guest networks, and router security. (no listed date; content current as of 2025). (Federal Trade Commission)
- FTC Consumer Advice. “How To Secure Your Home Wi-Fi Network.” Guidance to enable WPA3/WPA2, disable WPS/UPnP/remote admin, set guest networks, and enable firewalls. (accessed 2025; page content active). (Consumer Advice)
- CISA & FBI. “Security Design Improvements for SOHO Device Manufacturers.” Jan 31, 2024. Background on SOHO router risks and insecure defaults. (Internet Crime Complaint Center)
- NIST Special Publication 800-153. “Guidelines for Securing Wireless Local Area Networks (WLANs).” Feb 2012. Configuration and monitoring recommendations for WLANs. (NIST Computer Security Resource Center)
- FBI. “FBI Releases Annual Internet Crime Report.” Apr 23, 2025. National loss figures and complaint trends. (Federal Bureau of Investigation)