Every visitor who joins your main WiFi joins your network — the printer, the file PC, the CCTV, all of it visible to a stranger's phone. A guest network is the same internet through a different, locked door.
The guest network is not a courtesy feature; it is a security boundary drawn in one checkbox. On TP-Link the page is Wireless → Guest Network, and the whole game is one setting: whether guests may access your local network. Leave that off and guests reach the internet only. Turn it on by accident and you have built a second, weaker door into the same room.
With local access off, a guest device gets an address and a road to the internet, and no route at all to your LAN: it cannot browse shared folders, print, see the DVR, or poke the router's admin page from that network. It also cannot reach the other guests. Whatever malware a visitor's neglected phone carries stays politely in its own compartment — which, in a shop or clinic with daily strangers, is not paranoia but hygiene.
Guest is also the right home for things you own but do not fully trust: cheap smart bulbs and cameras, a smart TV that demands internet, office staff's personal phones, and an old tablet for the counter. If a gadget only needs the internet and never needs your files or printer, it belongs on the guest side of the wall — your main network stays small, known and boring.
Guests share your internet line, so a visitor's 4K binge still eats the same bandwidth as staff work — that is a QoS conversation, not an isolation one. And isolation depends on the checkbox surviving firmware resets: after any reset or big update, re-check the guest page during your verification walk. Finally, write the guest password somewhere guests may legitimately see it (the counter card) — it is a low-value secret by design, while the main password never gets displayed anywhere.
See the guest network page configured and explained in the full AC1900 setup video.
▶️ Watch Full VideoNot with local access off — the printer lives on the LAN side of the wall. If visitors genuinely need printing (a cyber café, a co-working desk), the honest options are a printer that itself offers a guest or email-print feature, or a staff member printing for them. Do not punch the isolation open for one convenience.
Change it when staff change, after any suspicion it travelled too far, or on a simple monthly rhythm in public-facing businesses. Because guests only lose internet (not your network), the change is cheap: update the counter card and reconnect your own smart gadgets on that network.
It shares the router's radios and the internet line, so heavy guest use competes like any other use — but the network itself adds no meaningful overhead. If guest traffic is squeezing work traffic, that is what the QoS settings are for.