Wi-Fi best practices: the checklist worth arguing about

Every item here fixes a real problem we have seen more than once. Disagree with any of them deliberately, not accidentally.

RF

• Design for capacity, not coverage. Count devices and applications first.
• Target -67 dBm primary coverage at the highest band you depend on, with 25 dB SNR.
• 20 MHz channels at 2.4 GHz. Always. There is no exception.
• 40 MHz at 5 GHz in dense environments, 80 MHz where the channel budget genuinely allows.
• 80 MHz at 6 GHz as a default. 160 MHz only in low density. 320 MHz almost never, indoors.
• Disable the 2.4 GHz radio on the majority of APs in a dense deployment.
• Set AP transmit power to match your weakest client — usually 11–17 dBm indoors, not maximum.
• Decide the DFS question deliberately and record why.

Configuration

• Disable 802.11b data rates. Set minimum basic rate to 12 or 24 Mbps.
• Three or four SSIDs maximum. Use RADIUS-assigned VLANs instead of SSID sprawl.
• Enable 802.11k, 802.11v and 802.11r — and test 802.11r against your client mix before global rollout.
• Turn on airtime fairness.
• Rate-limit or convert multicast and broadcast; disable multicast forwarding on guest SSIDs entirely.
• Set a sensible client idle timeout. Ghost associations consume table space and confuse capacity reporting.
• Disable legacy WEP, TKIP and WPA1 everywhere, without exception.

Security

• WPA3-Enterprise with 802.1X for corporate devices; WPA2-Enterprise transition mode only while you still have legacy clients, with an end date.
• Validate the RADIUS server certificate on clients. An 802.1X deployment where clients accept any certificate is trivially phishable, and this is the single most common enterprise Wi-Fi security failure.
• Use OWE for guest networks rather than a fully open BSS.
• Per-device PSK (variously PPSK, iPSK, DPSK) for IoT that cannot do 802.1X — far better than one shared key across 400 devices.
• Enable Protected Management Frames. Mandatory on 6 GHz, worth enabling everywhere.
• Segment IoT onto its own VLAN with egress filtering. Assume every IoT device will eventually be compromised.
• Turn on rogue AP detection and actually read the alerts.

Operations

• Monitor channel utilisation as your primary health metric, not client count or signal strength.
• Alert on AP reboots, PoE budget approaching limits, and radar events.
• Keep firmware current but not bleeding-edge: one minor release behind the newest is usually the sweet spot. Read the release notes for client-compatibility regressions.
• Re-survey after any significant change to walls, racking, occupancy or furniture. Buildings change.
• Keep a device compatibility register: what broke, on which firmware, with which client, and how it was resolved.
• Baseline performance while everything is working, so you have something to compare against when it is not.

The two habits that matter most

Write down why. Every non-default decision — DFS off, 2.4 GHz disabled in a wing, a legacy SSID kept alive — needs a one-line reason recorded somewhere the next engineer will find it.

Measure before you change. The instinct to add an access point, raise power or widen a channel is nearly always wrong. Capture channel utilisation and SNR first; the data usually points somewhere else entirely.