Everyone at Church on Sundays expects Internet access. Members, visitors, volunteers and Staff members routinely use their mobile devices throughout the Church campus. A well-designed WiFi network should make that access convenient while protecting the Church’s administrative systems, financial information, staff computers, and technology infrastructure.

Patterns of Internet Use on Sundays

On a typical Sunday, dozens or even hundreds of devices may connect to the network using any of these patterns:

• Looking up Scripture: Worshipers use Bible apps and websites instead of, or alongside, their printed Bibles.
• Accessing Sunday School resources: Teachers use online Bible resources, videos, presentations, maps, and commentaries.
• Posting to social media: Members and visitors may post photographs, Scripture quotations, sermon comments, livestream links, or Church announcements to Facebook, Instagram, and other platforms.
• Church communications: Staff and volunteers update websites, send email, access cloud-based documents, or communicate through messaging services.
• Worship technology: Worship teams use Internet-connected computers for presentation software, music resources, livestreaming, video distribution, or other production functions.
• Online giving: Members use smartphones to make contributions through the Church’s online giving platform.
• Children and Youth Ministry: Ministry leaders use Internet resources for check-in systems, curriculum, videos, music, and activities.
• Visitors: Guests use WiFi because cellular coverage inside a large Church building can be unreliable.
• Accessibility: Worshipers use Internet-connected devices for hearing assistance, enlarged Scripture or worship materials, translation, or other accessibility services.

Providing Internet access therefore supports both the ministry of the Church and the expectations of the congregation, who are accustomed to continuous connectivity.

Security Issues With Public WiFi

Providing WiFi to the general public also creates security concerns. The fundamental problem is not that Church visitors should be considered untrustworthy. Rather, the Church generally has no control over the devices brought onto its campus.

A visitor’s smartphone, tablet, or computer could be infected with malware without the owner even knowing it. An improperly configured device could attempt to communicate with other devices on the same network. Someone could intentionally probe the network for printers, computers, cameras, file servers, or other equipment.

An unrestricted network can potentially expose:

• Staff computers and mobile devices
• Financial and accounting systems
• Contribution and donor information
• Membership databases
• Children’s ministry and check-in systems
• Network-connected printers
• Security cameras and access-control systems
• Worship and livestreaming equipment
• Network storage devices
• Building automation and other Internet-connected equipment

Churches often possess sensitive information, including contribution records, pastoral-care information, personnel records, children’s information, background-check documentation, and financial data. Public access therefore should never grant access to the same internal network used for Church business.

Another concern is bandwidth consumption. A small number of users streaming high-definition video, downloading large files, or even performing software updates can consume enough capacity to interfere with livestreaming or other mission-critical Sunday operations.

Staff WiFi: Advantages and Disadvantages of Locking It Down

A secured Staff WiFi network should normally be treated as part of the Church’s internal technology infrastructure.

Advantages

Security. Authentication prevents casual visitors from connecting directly to the staff network.

Protection of administrative resources. Internal computers, printers, servers, and other devices can be separated from public users.

Better accountability. Access can be limited to authorized staff and designated volunteers.

Reliable performance. Network administrators can prioritize business, worship, security, and livestreaming traffic.

Password management. Credentials can be changed when employees leave or when unauthorized access is suspected.

Reduced attack surface. Separating trusted and untrusted devices substantially reduces opportunities for unauthorized network access.

Disadvantages

A secured network requires administration. Passwords, Passkeys or other credentials must be maintained, authorized users must know how to connect, and occasionally devices must be reconfigured.

There can also be inconvenience when volunteers need temporary access. However, these disadvantages are primarily administrative and generally do not outweigh the security benefits.

Open Public WiFi: Advantages and Disadvantages

A separate public or Guest WiFi network can provide Internet service to members and visitors without giving them access to the Church’s internal systems.

Advantages

Convenience. Visitors can connect without requesting a staff password.

Hospitality. Free Internet access can be viewed as another service offered to people using the Church campus.

Support for worship. Members can access Scripture, sermon resources, Church websites, giving systems, and social media.

Support for ministries and events. Sunday School classes, community groups, meetings, weddings, funerals, and other events can have Internet access without using staff credentials.

Disadvantages

A completely open and unsecured WiFi network introduces several concerns.

Anyone within radio range may be able to connect, including individuals outside the building. The Church may have little knowledge of who is using the connection or what devices are connected.

Public users can also consume substantial bandwidth. Without proper network configuration, this could affect worship technology or livestream quality.

Most importantly, an open network becomes significantly more dangerous if it is not technically isolated from the Church’s internal network. Simply creating two WiFi names does not necessarily provide adequate security. The networks should be separated at the network infrastructure level.

Better Model: Separate Networks

The choice does not need to be between secure Staff WiFi and convenient Public WiFi. A properly designed Church network can provide both.

A Church should consider maintaining several logically separated networks:

Network	Typical Users	Access
Staff	Employees and authorized leadership	Internet + authorized internal resources
Worship/Production	Worship, AV and livestream systems	Restricted operational access
Guest/Public	Members, visitors and community users	Internet only
Facilities/Devices	Cameras, thermostats, access controls and other equipment	Only services required by those devices

This separation is commonly accomplished through network segmentation, such as VLANs, firewall rules, and separate wireless network identifiers (SSIDs).

The Guest network should not be able to initiate connections to the Staff, Worship, financial, security, or facilities networks.

Should Public WiFi Be Completely Open?

An “open” Guest network can be easy to use, but convenience does not require eliminating every security control.

The Church can provide a Guest WiFi network that is easy for visitors to access while still implementing safeguards behind the scenes. Depending upon the Church’s equipment and requirements, these can include:

• Client isolation so Guest devices cannot communicate directly with one another
• Firewall rules preventing Guest access to internal networks
• Bandwidth limits for individual Guest devices
• Separate bandwidth or Quality of Service (QoS) priorities for livestreaming and worship systems
• Appropriate content or security filtering
• Automatic expiration or periodic renewal of Guest connections
• A simple acceptable-use or welcome page
• Monitoring for abnormal network activity

A Guest password is another option. The password could be displayed in appropriate areas or provided by volunteers. This prevents completely anonymous drive-by access while imposing relatively little inconvenience on legitimate users.

Recommended Best Practices

The Church should adopt a segmented network architecture rather than treating all WiFi users as members of one network.

Recommended practices are:

1. Secure the Staff WiFi network. Staff access should require authentication and the credentials should not be distributed publicly.
2. Provide a separate Guest/Public WiFi network. Members and visitors should not need Staff credentials simply to access the Internet.
3. Isolate Guest users from internal resources. Public devices should have Internet access but should not be able to reach staff computers, financial systems, printers, security equipment, or other internal devices.
4. Protect worship-critical systems. Livestreaming, presentation, audio/video, and other essential Worship Center systems should be isolated or prioritized so heavy Guest usage cannot disrupt worship.
5. Separate specialized devices where practical. Security cameras, door controls, thermostats, building systems, and other Internet-connected devices should not automatically reside on the Staff or Guest network.
6. Use modern wireless security. Staff and operational networks should use currently supported encryption and authentication rather than obsolete WiFi security standards.
7. Maintain network equipment. Wireless access points, firewalls, switches, and related equipment should receive firmware and security updates.
8. Change credentials when necessary. Staff passwords and administrative credentials should be changed when compromised, broadly distributed, or affected by personnel changes.
9. Limit administrative privileges. Only designated individuals or technology providers should have administrative access to routers, firewalls, switches, and wireless controllers.
10. Document the network. The Church should maintain an inventory of major network equipment, WiFi networks, responsible administrators, configuration backups, and procedures for responding to failures or security incidents.

Conclusion

Internet access is now part of the infrastructure supporting worship, education, administration, communication, giving, and hospitality. The goal should therefore not be to choose between security and public access, but to design the network so that both can coexist.

The preferred approach is to maintain a secured Staff network and a separate, isolated Guest network, with additional separation for worship-production, security, and building systems where appropriate. The Guest network can remain simple and convenient for members and visitors while firewall rules and network segmentation prevent those devices from accessing sensitive Church resources.

This approach allows a Church to offer Internet access as a ministry and hospitality resource without unnecessarily exposing its administrative, financial, worship, security, and facilities infrastructure.

For most Church staff, online storage – i.e. Storage Area Networks – is a way to collaborate on planning. You can have a locally shared copy of planning documents, tentative copies of newsletters and bulletins, etc. But is it worth it these days?

With more and more resources found on the Internet, you can have virtually unlimited storage for Church documents. You only need to decide who has access and how is the storage organized. Here are some ideas:

• Organize the documents by Area of Ministry – e.g. Adults, Youth, Children
• Allow staff to access the documents in their Area of Ministry only
• Create a shared Church Administrative calendar, so everyone on staff can see what’s coming up and avoid conflicts

Since the files are on the Internet, they will be accessible online no matter where staff members go.

Of course, you want to make sure that anything that needs to be confidential has added access control. Ideally, you would log who accessed these confidential materials.

With a pandemic in progress, it will be challenging for congregations to continue holding worship services. Perhaps it is time to consider some Worship Alternatives.

The obvious alternative to consider is Live Streaming. This is where you hold the worship service with no one in the sanctuary. However, you broadcast the live video over the internet. This allows people to participate from their homes, or for that matter anywhere on a mobile phone. All they need is an Internet connection. While not quite the same as being there in person, it is a valid alternative. You’ll need to provide links to resources such as hymns and liturgy, either through email or chat. The Good News is that you can participate in the worship service through the stream. You can sing the same hymns, listen to the same sermon. The only thing you can’t do is hug or shake hands with other worshipers in the sanctuary (which might spread the virus). I would recommend that you hug your family instead.

Another alternative is to have the preacher record the sermon and distribute it via the Church web site. Likely you already have the sermons online in some form, either as video or audio files. This would just abbreviate the process, maybe recording the sermon in their office instead of the sanctuary. That way, people will be able to listen to the sermon at home via the Church Web Site. All they need is an Internet connection.

Speaking as one who has listened at home during a long illness, I can attest to the importance of providing these alternatives. In my case, the Tech Team recorded the sermon on CD and brought me a copy every week. Although I could not go to Church, I could still worship. If you provide access to the whole service via streaming, then your remote worshipers will also hear the same announcements, see the people, etc. The Church is the body of Christ wherever and however it worships! (1 Cor 12:27)

Does your Church include multiple buildings and/or multiple locations? Then it is an Internet Campus. This means that you have a network that defines all of the buildings. It may be a subnetwork in the cloud, to which all buildings are connected. Or it may be that you link routers together into a local network that covers your campus.

The advantages to an Internet Campus lie in security and efficiency. When staff in one building want to share information with staff in another building, they can do so quickly through the Internet Campus. They can logically see other equipment across the Internet Campus, such as printers and shared file systems. And they thus move information around more efficiently. If you have a school – i.e. even a preschool – then the Internet Campus supports the weekday programs of that school.

How can we use the internet for evangelism? Putting up a Church website is certainly a start, but how do you make the web site an effective witness? You can and should add social networking, where people can both witness and minister to others. Sharing a witness in a very public arena like the internet can be a little daunting. You will want to make sure that you do the following:

• Focus on Jesus Christ, not personal glory
• Limit personally identifiable information, such as addresses and phone numbers
• Identify scripture passages used and which translation – e.g. NIV

By bearing witness to the saving grace of Jesus Christ, you extend the power of evangelism to the web. That doesn’t mean we have to pursue God.tv, but it does mean we use the communication channels available to spread the Gospel.

How do you learn HTML? HTML stands for HyperText Markup Language. It represents the lingua franca of the Internet. Learning it, in all of its variations, is a mind boggling task. But you can get started on it with a simple editor and a browser running locally. You first have to learn the syntax of the language.

There are a number of excellent introductions to HTML. One is found at W3C School – i.e. the standards body for the Internet. W3C stands for the World Wide Web Consortium, and it has a web site at www.w3c.org that contains the standards. Their introduction to HTML can be found at introduction.