Because access points on the same channel share airtime rather than adding capacity, so beyond a certain density they compete with each other.

Wireless is a shared medium. Only one device on a given channel in a given area can transmit at a time; everything else waits. Two access points on the same channel within hearing range of each other do not double the capacity, they halve each one's share of it.

There are a limited number of non-overlapping channels, particularly in the 2.4 GHz band where there are effectively three. Once every channel is in use in an area, another access point can only reuse one already in use nearby.

The symptom is a network that gets slower after equipment is added, which is counter-intuitive and therefore usually misdiagnosed.

The correct responses are to reduce transmit power so cells are smaller and reuse works, to use the 5 GHz and 6 GHz bands where there are far more channels, and to place access points by measurement rather than by filling gaps on a plan.

Far fewer than the datasheet's client limit suggests - plan on a few dozen active devices, and by application rather than by headcount.

An access point may advertise support for several hundred associated clients. That is an association limit, not a performance figure. All associated devices share the same airtime.

The practical figure depends entirely on what they are doing. Devices checking mail and browsing occasionally are cheap; a room of people on video calls is expensive, because video is continuous and sensitive to jitter.

Older and slower devices cost more than their share, since a device transmitting at a low rate occupies the channel for longer to send the same data - one distant legacy device can measurably reduce the throughput available to everyone else on that radio.

So design by area and activity: a lecture theatre, an open office and a warehouse with a handful of scanners need entirely different densities even at similar headcounts.

5 GHz for most traffic, 6 GHz where devices support it, and 2.4 GHz kept for the devices that have no alternative.

2.4 GHz travels furthest and penetrates walls best, which sounds like an advantage and is mostly a liability: with only three non-overlapping channels and interference from every other device in the band, it is congested almost everywhere. Its reach also means neighbouring cells interfere at greater distances.

5 GHz has many more channels, so cells can be smaller and reused more freely. Its shorter range is an advantage indoors. Some channels are subject to radar-avoidance rules which occasionally force a channel change.

6 GHz, where regulations permit it, adds a large amount of clean spectrum with no legacy devices in it - the most significant capacity increase in years, but only for clients that support it.

The usual design keeps 2.4 GHz enabled at low power for legacy and building devices, and carries the real traffic on the higher bands.

Measuring the actual radio environment rather than predicting it - and for anything beyond a small office it repays itself immediately.

A predictive survey models coverage from floor plans and assumed wall materials. It is useful for a first estimate and for costing, and it is only as good as its assumptions about construction.

A physical survey measures. An access point is placed at candidate positions and signal strength and quality are recorded through the area, revealing what the plan cannot: a plasterboard wall with foil backing, a lift shaft, a metal-racked store, a glass partition with a metallic coating.

A post-installation survey validates what was built and is the one most often skipped, though it is where problems are cheapest to fix.

Surveys should also record interference from neighbouring networks and non-network sources.

For a couple of rooms, judgement is adequate. For a building, a warehouse, or anywhere with high density expectations, surveying is what separates a network that works from one that gets rebuilt.

The client decides when to move, which is why the network's job is to make the decision easy rather than to force it.

A device stays associated with an access point until it decides the signal is poor enough to look elsewhere. Different devices make that decision differently, and many are reluctant - the classic 'sticky client' that walks across a building still holding onto the access point it started with.

The network influences this by designing cells that overlap enough for a good alternative to exist but not so much that the original remains usable everywhere, and by not running access points at maximum power, which creates exactly that problem.

Standards help with the handover itself: 802.11r speeds re-authentication so a voice call does not break, 802.11k tells the client which neighbours exist, and 802.11v allows the network to suggest a move.

For voice and for barcode scanning in warehouses, roaming behaviour matters more than raw throughput and should be tested with the actual client devices.

WPA3 where the devices support it, WPA2-Enterprise with 802.1X for corporate access, and a genuinely separate guest network.

A pre-shared key is acceptable for a small site but has an inherent weakness: everyone knows the key, and changing it means reconfiguring every device - so it never changes, and it leaves with every departing employee.

Enterprise authentication uses per-user credentials or certificates against a RADIUS server, so access follows the individual and can be revoked. It also allows the network assignment to depend on who authenticated.

WPA3 improves the cryptography and protects against offline attacks on the pre-shared key. Mixed mode supports older clients while allowing newer ones to use it.

Guest networks should be isolated from internal systems and from each other, rate-limited, and ideally terminated straight out to the internet rather than routed through the corporate network.

Disable legacy WEP and WPA entirely; they are broken rather than weak.

Controller-based for anything above a handful of access points - and the controller can be an appliance, a cloud service or software embedded in the access points themselves.

Standalone access points are configured individually. For two or three that is fine. For twenty it means twenty configurations that will diverge, no coordinated channel and power management, and no view of the estate.

A controller provides central configuration, automatic radio resource management - assigning channels and power across the estate and adjusting when conditions change - assisted roaming, firmware management and monitoring.

The forms differ. A hardware or virtual appliance keeps everything on site. A cloud controller removes the appliance and adds a subscription and an internet dependency for management. An embedded controller elects one access point to coordinate the others, which suits small sites well and costs nothing extra.

All three keep forwarding traffic if the controller is unreachable on modern platforms - but confirm that for the specific product rather than assuming it.