Every small office has one

Every small office has one: the router that one person set up on day one and nobody has opened since.

I keep a checklist for this exact hour, because in every team I've worked with the symptoms are identical. The admin password is still admin or the sticker value. The firmware is from the year the business opened. The guest network has the same password as the office network, because separating them "seemed complicated". And the WPS button is still enabled, because it was never anyone's job to turn it off.

None of that is a technical failure. It's an ownership failure, and it costs one hour to fix — once — followed by a ten-minute quarterly pass. Here is the order that actually matters.

1. Fix the admin plane before the WiFi password. People spend an afternoon on the passphrase and leave admin/admin on the management interface. The WiFi password gets shared with every visitor's laptop; the admin password must never leave the password manager. Two credentials, always. Turn off remote administration and UPnP unless something genuinely needs them, kill WPS entirely, and check firmware. Router firmware is a vendor product like any other — read the advisories the way you'd review any supplier.

2. Use WPA3 if your oldest work device allows it, WPA2-AES if it doesn't. WEP and the "mixed" TKIP modes are not options. If a five-year-old printer forces you backward, the printer belongs on the guest/IoT network, not the office one. And make the passphrase long, not clever — six random words beat a symbol-swapped movie quote. Length is the only property that scales.

3. Split the network: staff, guests, everything else. Printers, cameras, thermostats and door locks are computers with terrible patch records. A compromised camera must not be able to reach the accounting laptop. Then test the split once: join the guest SSID from a phone and try to reach a shared drive or the printer admin page. Whatever you can reach from guest WiFi is what a visitor can reach. If the answer is "the file server," you've found this month's fix.

4. Decide the rotation trigger before you need it. Rotate the office WiFi password when someone with the password leaves, when a device is lost, or every six months — whichever comes first. The offboarding moment is the one that bites. Make rotation cheap: update router, print passphrase, walk the office. If it takes an afternoon, it will never happen, and a password nobody rotates is a password your cousin's babysitter may hold.

5. The devices matter more than the password. Turn off auto-join for open networks on every work laptop — an evil twin named "Airport_Free_WiFi" wins the moment a laptop connects by reflex. Count the router's client list quarterly: fifteen clients for a nine-person office is a conversation worth having, because the extra four have owners who forgot them. Retire devices, not just people — the printer that left the building in March is still on the list if nobody removed it.

6. The quarterly walk test. Stand in the carpark with a phone. If your office SSID is full bars from the street, strangers can attempt your passphrase at leisure. Long passphrases survive attempts; short ones don't. Then read the client list and the admin log — the router keeps that history whether anyone looks at it or not. Write three lines: firmware date, client count, changes made. That's the whole audit trail.

The whole thing is one owned hour. I've written it up as a free, complete walkthrough — the WiFi Security Checklist for Small Teams on HIVE80lab ops-notes — including the guest-network reachability test and the exact quarterly pass.

If you want the device inventory and review cadence as fill-in-the-blank sheets instead of a checklist to retype, the Ops Starter Kit ($14) covers incident response for small teams, and the Automation Starter Pack ($19) schedules the recurring checks so the quarterly pass happens without anyone remembering to remember. There's also a free one-page incident quick-start if you want to start there.

MFA and passwords get all the attention. The router got none — and it's the one device every laptop, phone and camera in the building trusts.