Business WiFi Installation: Coverage, Capacity & Security

Why Your Business WiFi Installation Spec Determines Everything

Most WiFi problems aren’t hardware problems. They’re design problems. An AP placed in the wrong position, running the wrong channel, with too many clients assigned to it. A switch with a 95W PoE budget trying to power 14 APs. A guest network with no firewall rules. None of these show up on a quote sheet. They show up three weeks after move-in when the complaints start.

What a Proper Spec Actually Covers

A solid business WiFi installation spec covers four things. First, it defines coverage — where signal needs to reach, at what minimum strength, and what building materials affect propagation. Second, it defines capacity — how many concurrent devices each AP needs to handle during peak load. Third, it defines the network design — which VLANs carry which traffic and what the firewall rules enforce between them. Fourth, it defines security — authentication standards for staff, isolation rules for guests, and management access controls.

Each of those four elements generates specific hardware decisions, AP placement coordinates, and configuration requirements. Skip any one and the installation has a gap the spec didn’t catch.

The Site Survey: Where Every Business WiFi Spec Starts

Every spec starts with a wireless site survey. You can’t write an accurate AP placement plan from a floor plan. Floor plans don’t show concrete density, glass partition reflection patterns, or the 28 neighboring SSIDs competing for 5GHz airtime in your building. A site survey measures all of those. It tells you exactly which AP model covers each zone, what channel plan avoids co-channel interference, and how many APs the space actually needs. For a full breakdown of what a survey covers, see our guide on why every business needs a wireless site survey before installation.

For standard web browsing and email, a signal of -72 dBm or better keeps connections stable. Video conferencing — Zoom, Teams, Google Meet — you need -67 dBm or stronger. Voice over WiFi on a handset or softphone, -65 dBm is the floor. If your office runs video calls in every room all day, design your coverage to -65 dBm minimum everywhere. Don’t design to -72 dBm and wonder why the huddle rooms struggle.

Your site survey heat map shows exactly where each threshold applies across your floor plan. Green zones meet the threshold. Yellow zones are marginal. Red zones fail it. The AP placement plan moves APs or adds new ones until the heat map shows green across every occupied area.

Every wall type attenuates 5GHz signal differently. Drywall drops signal by 3 to 5 dB per wall. Concrete block drops it by 15 to 20 dB. Glass reflects signal rather than absorbing it — creating coverage patterns that look very different from what a standard floor plan suggests. Steel framing and elevator shafts create dead zones that follow their physical boundaries exactly.

A U6 Pro AP covers roughly 2,500 square feet in a clean open-plan environment. Put two concrete block walls in the path and that same AP covers 600 to 800 square feet beyond them. Your AP count multiplies based on your building’s specific attenuation profile. That profile comes from measurement — not from a square footage estimate. This is why every serious business WiFi installation starts with a survey, not a calculator.

The coverage spec drives your AP model decision. Here’s how the current UniFi lineup maps to common business scenarios.

Coverage estimates apply to clean open-plan environments. Dense building materials reduce effective range significantly. Always verify with site survey data. For a more detailed AP comparison, see our guide to choosing the right wireless access points for your business.

WiFi Capacity Planning: Sizing for Devices, Not Just Square Footage

Coverage planning gets you signal everywhere. WiFi capacity planning ensures each AP handles the device load without degrading performance. These are two separate problems — and a WiFi installation that solves only one of them still underperforms.

How to Calculate Your Device Count

The starting point for WiFi capacity planning is your real device count — not your employee count. Most business environments average 2.5 devices per person. A 40-person office runs roughly 100 connected devices simultaneously. Those 100 devices distribute across your APs based on physical proximity. The AP nearest the conference room handles a spike of 15 devices the moment a meeting starts. That AP needs headroom for it.

Plan each AP for 40 to 50 active concurrent clients in a business environment. The U6 Pro rates for 300 clients — but RF airtime is shared among all clients. At 50 active clients, performance stays strong. At 150 active clients, latency climbs and video calls struggle. Your WiFi network design spaces APs so no single one handles more than 50 active clients under normal conditions.

High-Density Zones Need a Different Approach

Conference rooms and open collaboration areas concentrate device density in a small space. A 12-seat conference room can hit 30 active devices during a full meeting — laptops, phones, room systems, and a wireless presentation device. That’s 60 percent of your safe AP capacity limit in one room.

Place a dedicated AP inside or directly adjacent to every large conference room. Don’t rely on an AP in the corridor serving it through a wall. The U6 Pro or U7 Pro handles conference room loads well. The U7 Pro’s 6GHz radio gives high-demand conference devices a clean, uncongested channel. That makes a measurable difference in urban buildings where 5GHz spectrum is already crowded. For more on matching AP models to specific use cases, see our optimal placement guide for UniFi access points.

Every business WiFi installation needs at minimum three SSIDs mapped to three VLANs. A staff SSID on a data VLAN carries employee laptops and phones. A voice SSID — or voice VLAN on the wired switch — carries VoIP traffic with QoS prioritization. A guest SSID on a fully isolated VLAN carries visitor devices.

Each SSID maps to a specific VLAN in your UniFi controller. The VLAN carries a firewall policy. The staff VLAN gets internet access and access to internal resources. The voice VLAN gets QoS-tagged traffic prioritized above data. The guest VLAN gets internet access and nothing else. That structure takes about two hours to configure correctly. It protects your business from a compromised guest device for the entire life of the installation.

Quality of Service marks voice and video traffic for priority delivery through your network. Without QoS, a large file transfer on the data VLAN competes with a video call on the same uplink. The file transfer wins because it sends in large bursts. The video call stutters.

UniFi’s controller supports DSCP tagging natively. Enable it on your voice VLAN and mark traffic according to your VoIP provider’s recommendations — typically DSCP EF (46) for voice media and DSCP AF31 for voice signaling. Your gateway honors those markings when forwarding traffic toward the internet. Calls stay clear even when your uplink runs at 80 percent utilization.

Secure Guest WiFi: The Configuration Every Business Installation Needs

Secure guest WiFi requires three specific configurations. Get all three right and guest devices stay completely isolated from your internal network. Miss any one of them and the guest network becomes a lateral movement path for any compromised visitor device.

The Three Rules for Secure Guest WiFi

Rule 1: Block all traffic from the guest VLAN to your internal subnets. In UniFi, create a firewall rule that drops any traffic from the guest network subnet toward any RFC-1918 private IP range — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. This one rule prevents guest devices from reaching your file servers, printers, cameras, and management interfaces. Test it by connecting to the guest SSID and pinging an internal IP. You should see no response.

Rule 2: Enable client isolation on the guest SSID. Client isolation prevents guest devices from communicating with each other on the same VLAN. Without it, a compromised guest device can attack other guest devices directly. Enable it in the wireless settings for your guest SSID. It costs nothing in performance and eliminates peer-to-peer risk on your guest segment entirely.

Rule 3: Apply a per-client bandwidth limit. Set a 10 to 20 Mbps limit per client on the guest SSID. One guest streaming 4K video shouldn’t saturate your office uplink. A per-client limit prevents it. UniFi handles this through the guest SSID’s bandwidth profile in the network controller.

Optional: Guest Portal and Splash Page

A guest portal requires visitors to accept terms of service before connecting. UniFi supports custom splash pages natively — no third-party service required. For businesses that need to log guest access for compliance reasons, a portal provides a timestamped acceptance record. For most small and mid-size offices, the portal adds friction without much security benefit over the three rules above. Add it if your business has a compliance reason. Skip it if you just want clean guest WiFi without an extra click. For how guest WiFi fits into a full security posture, see our guide on 7 office WiFi vulnerabilities businesses miss.

Mistake 1: Specifying AP Count From Square Footage Instead of a Site Survey

What happens: The installer divides total square footage by 2,000 and orders that many APs. They arrive on installation day, space them evenly across the ceiling, and call it done. Conference rooms have dead zones. The corner offices drop video calls. Nobody ran a heat map to check.

Why it undermines the business WiFi installation: Square footage formulas ignore building materials, floor geometry, and neighboring interference. A 4,000-square-foot floor in a pre-war concrete building may need 6 APs where a modern drywall office needs 2. The formula gives you the same answer for both. The result looks fine in theory and performs poorly in practice.

The fix: Require a site survey before any AP count goes on the quote. The survey takes half a day. It tells you exactly how many APs you need, where each one goes, and which model handles each zone. That data produces a spec — not a guess.

From the Field: A 55-person media company in SoHo asked us to review their WiFi before signing off on a completed installation. Their contractor had placed 8 U6 Pro APs evenly across a 9,000-square-foot two-floor space — 4 per floor. The coverage looked fine on paper. The problem: all 8 APs used the same 2 auto-assigned 5GHz channels. Four APs competed directly with each other on Channel 36. Three of the four conference rooms sat in a co-channel interference zone at -61 dBm overlap. Video calls dropped every time a meeting started. We reassigned channels manually from a spectrum scan and moved two APs by 15 feet each. Post-change heat map: every room at -64 dBm or better. No new hardware. Channel planning and placement data fixed what $6,000 of equipment couldn’t.

Before You Sign Off on Any Business WiFi Installation

• Ask for the post-deployment heat map before the installer leaves. A heat map showing every zone at -65 dBm or better is the only objective proof that coverage meets your threshold. A green light in the UniFi controller shows the AP is online — not that it covers the room properly.
• Test every VLAN on move-in day. Connect a device to each SSID and verify correct routing, internet access, and isolation from other segments. Connect to the guest SSID and ping an internal IP address. No response means the firewall rule works. A response means it doesn’t and needs immediate correction.
• Run your PoE budget calculation before ordering switches. Add up the wattage of every AP, camera, and VoIP phone. Multiply by 1.25 for headroom. That number is your minimum PoE budget. The USW-Pro-24-PoE at 400W handles most mid-size offices. Underpowered switches throttle APs and cause intermittent drops that look like WiFi problems but aren’t.
• Enable 802.11r fast roaming on your staff SSID. Staff moving between floors or rooms need their WiFi session to follow them without re-authenticating. Fast BSS Transition handles the handoff between APs cleanly. It takes one toggle in the UniFi wireless settings and eliminates the drop that happens when someone walks from the conference room back to their desk mid-call.

A Business WiFi Installation Done Right Starts With the Spec

Every strong business WiFi installation comes from the same starting point: a spec built on measured data, not assumptions. Site survey data drives AP placement. Device counts drive capacity planning. A documented VLAN structure drives network design. Three firewall rules and client isolation drive guest security. None of it requires exotic hardware. All of it requires doing the design work before anything gets installed.

The SoHo media company had the right hardware. What they lacked was a channel plan built from actual spectrum data. That’s a spec problem — and it cost them weeks of poor performance that a proper pre-installation process would have prevented entirely.

If you’re planning a new office WiFi deployment or evaluating a quote that came with no mention of a site survey, book a call. We’ll walk through your space, build the spec, and give you a commercial WiFi installation that works from day one.

Ready to Spec Your Business WiFi Installation the Right Way?

Tell us your square footage, device count, and biggest pain point. We’ll run a site survey, build the coverage and capacity spec, and design a network that handles your real-world load — not a best-case scenario.

Call: 833-469-6373 or 516-606-3774
Text: 516-606-3774 or 772-200-2600
Email: hello@unifinerds.com | Visit: unifinerds.com

Free consultations • Phased implementation • Budget-friendly • Expert support