One problem nowadays is there's quite a strong social pressure to provide your WiFi password to any reasonably close friends or relatives who visit. A reasonably safe answer might be to scan their devices for malware first, but people might be offended by that. And in any case, if the friend were reasonably scurity-aware him/herself, he'd not want to trust my scanning software, especially if I wanted to plug in any flash drives etc.
I've addressed this problem myself by configuring a separate 'guest lan', where devices can access the internet but are isolated each other and isolated from my own machines. Still there's been times where guests wanted access to the core network, say to access the media server show us some holiday photos, and then it gets awkward...