To secure your home Wi-Fi router, change the default admin password, update the firmware, switch to WPA3 or WPA2 encryption, turn off WPS and remote management, and put smart devices on a guest network. These steps take about 30 minutes and protect every device in your home. This checklist walks through each one in order of impact.
Key takeaways
- The router admin password and the Wi-Fi password are different; change both.
- Firmware updates fix known security flaws, so turn on automatic updates if your router offers them.
- Use WPA3, or WPA2 with AES if WPA3 is not available.
- Put smart TVs, cameras and speakers on a separate guest network.
Why should you secure your home Wi-Fi router?
Your router is the front door to every device in your home, including work laptops, phones and cameras. An insecure router lets attackers see traffic, change DNS settings to send you to fake websites, or use your connection for crime.
Remote work makes this a business issue too. CISA’s home network security guidance recommends the same basics this checklist covers. See also our guide to protecting data in hybrid work.
How to secure your home Wi-Fi router in 10 steps
Work through these steps in order. The first five fix the weaknesses attackers exploit most often.
- Change the admin password. The login for the router settings page often ships with a default printed on the box.
- Update the firmware. Check the manufacturer’s app or settings page and enable automatic updates.
- Use WPA3 encryption, or WPA2-AES if your devices do not support WPA3.
- Set a long Wi-Fi password of at least 14 characters.
- Turn off WPS, the push-button pairing feature, which has known weaknesses.
- Disable remote management so the settings page is only reachable from inside your home.
- Create a guest network for visitors and smart home devices.
- Turn off UPnP unless a specific device needs it.
- Review connected devices monthly and remove anything you do not recognize.
- Replace end-of-life routers that no longer receive security updates.
Which router settings matter most?
The settings that matter most are encryption type, admin access, WPS, remote management and firmware updates. The table below shows the safe choice for each, in line with CISA guidance on securing wireless networks.
| Setting | What it does | Safe choice |
|---|---|---|
| Security mode | Encrypts Wi-Fi traffic | WPA3, or WPA2-AES |
| Admin password | Protects the settings page | Unique, 14+ characters |
| WPS | Push-button pairing | Off |
| Remote management | Settings access from the internet | Off |
| UPnP | Lets devices open ports automatically | Off unless required |
| Automatic updates | Installs security fixes | On |
| Guest network | Separates untrusted devices | On, for smart devices and visitors |
Why put smart devices on a guest network?
A guest network keeps smart TVs, cameras, plugs and speakers away from your laptops and phones. Many smart devices get few security updates, so isolating them limits the damage if one is compromised.
This is the home version of network segmentation, explained in network segmentation vs microsegmentation. The same idea protects businesses from attackers moving between systems.
When should you replace your router?
Replace your router when the manufacturer stops releasing firmware updates for it, usually after five to seven years. An unsupported router keeps any flaw discovered later, which attackers can scan for automatically.
Check the manufacturer’s support page for an end-of-life notice. When buying, choose a model that supports WPA3 and offers automatic updates, and ask your internet provider whether their router receives updates.
Frequently asked questions
Is hiding my Wi-Fi network name (SSID) worth it?
Hiding the network name adds very little protection, because the name is still broadcast when devices connect and free tools can reveal it. A strong password with WPA3 or WPA2 encryption matters far more.
How often should I change my Wi-Fi password?
Change it when you suspect someone unwanted has it, after a guest or tenant leaves, or when you replace the router. A long, unique password does not need changing on a fixed schedule.
Is my internet provider’s router secure?
Provider routers are often updated automatically, which helps, but they still ship with default settings. Change the admin password, check the encryption mode and turn off features you do not use.
Does a VPN replace router security?
No. A VPN encrypts traffic from one device to the VPN server, but it does not protect the router itself or the other devices on your network. Secure the router first.
Next steps
Securing your home Wi-Fi router takes about half an hour and protects every device you own, including the work laptop on your kitchen table. Start with the admin password and firmware update today. For a wider view of your security, take the free Cybersecurity Readiness Assessment or browse our cybersecurity guides.
