Securing a Wi-Fi Printer

When people talk about network security they think of the router, laptops, and phones. The printer is rarely mentioned, yet it's a small computer that's always on, connected to Wi-Fi, has an admin page, stores copies of documents, and is almost never updated. In a small office, the printer is often the weakest device on the network.

Why printers are a target

• Default admin password: many printers ship with an admin page that has no password, or one printed in the manual and easy to look up.
• Stored documents: laser and multifunction printers keep print jobs, scans, and fax copies in memory. Anyone who reaches the admin page can often download them.
• Stored Wi-Fi password: and sometimes the email or cloud credentials used for scan-to-folder.
• A foothold on the network: a compromised printer can scan other devices on the same network without looking suspicious.
• Rarely updated: printer firmware updates aren't automatic and almost never get done.

Five steps that are enough for a home or small office

1. Set a password on the admin page

Open the printer's IP address in a browser, usually shown in the printer's Network menu, or visible in the router's device list (see the guide to seeing devices on your Wi-Fi). Find the Security, Administrator, or Password menu and set a strong password. This is the most important step and the most often skipped.

2. Put it on the right network

The printer should be on the same network as the computers that print, the staff network, and not on the guest network. In a small office using VLANs, the printer can have its own segment reachable from the staff segment but not the other way round; explained in the VLAN guide. Also make sure the router isn't exposing printer ports to the internet, check port forwarding and UPnP settings in the guide to securing your router.

3. Turn off features you don't use

Modern printers come with many protocols enabled by default: FTP, Telnet, old SNMP versions, Wi-Fi Direct, print by email, and cloud printing. Every feature is a door. In the admin page, disable what you don't use, especially Telnet, FTP, and Wi-Fi Direct. Wi-Fi Direct makes the printer broadcast its own network, often without a password, and anyone nearby can connect straight to the printer without going through your router.

4. Update firmware once, then remember to repeat

Look for the Update menu in the admin page or the manufacturer's app. After updating, put a calendar note to check again every six months. If the manufacturer no longer releases updates for your model, step 2 becomes more important.

5. Wipe memory before selling, lending, or servicing

A printer being sold, returned to a leasing company, or taken for repair carries your Wi-Fi password and possibly copies of recent documents. Find the Factory Reset or Erase All Data menu, office multifunction printers often have a specific option to wipe the hard disk. The same issue applies to second-hand routers, covered in the guide to second-hand router security.

Extras for a small office

• If the printer scans directly to email or a shared folder, create a dedicated account for it with limited rights, don't use the business owner's email account.
• Enable secure print (PIN before printing) for financial documents and customer personal data, so printouts don't sit in the tray before being collected. This aligns with obligations under the Personal Data Protection Law.
• Add the printer to the list of devices you check when auditing the network, alongside the router and cameras.

What to do

A printer is a computer that holds your documents and your Wi-Fi password. Set an admin password, put it on the staff network not the guest one, disable Wi-Fi Direct and legacy protocols, update the firmware, and wipe its memory before it changes hands. Five steps, under an hour, and one big gap closed.

Frequently asked questions