How to Secure Your Home Network: A Router Checklist You Can Finish in One Evening

Global Router Editorial Team · Published · 8 min read

Illustration: a router with a shield inside a house outline
Contents
  1. What You Are Protecting Against
  2. Steps 1–4: Lock Down the Router
  3. Steps 5–7: Secure the Wi-Fi
  4. Steps 8–10: Switch Off Risky Features
  5. Steps 11–12: Separate and Watch Your Devices
  6. Tips That Matter Less Than You Think
  7. How to Check Your Work
  8. Frequently asked questions

Your router is the front door of every device in your home: laptops, phones, cameras, the TV and the doorbell. Most of the protection it can give is switched off or left on factory defaults when it arrives. The checklist below follows the minimum steps recommended by CISA, the U.S. Cybersecurity and Infrastructure Security Agency, and puts them in the order you meet them in the router’s settings. You need about an hour and access to the router’s admin page; if you do not know its address, see what is my router IP.

What You Are Protecting Against

Home networks are rarely attacked by someone parked outside. The real risks are more mundane: a router with a default admin password or old firmware that is taken over from the internet and used in a botnet; a weak Wi-Fi password that a neighbour or passer-by guesses; and cheap smart devices with poor security that become a way into the rest of the network. Each step below closes one of these doors.

Steps 1–4: Lock Down the Router

1. Change the admin password. The password that opens the router’s settings is not the Wi-Fi password. If it is still the default from the label or from a public list — and our default login pages show how easy those are to find — anyone on your network can change your settings. Use a long, unique password and store it in a password manager. Step by step: how to change the router admin password.

2. Update the firmware and switch on automatic updates. Router updates close known security holes that attackers scan the internet for. Many current routers can update themselves; turn that option on. See how to update router firmware.

3. Check whether your router still gets updates. Manufacturers stop releasing firmware for older models. If the last update for your model is several years old, the router will not be patched against new vulnerabilities, and replacing it is a security decision, not just a speed upgrade; see how often you should replace your router.

4. Keep the router where others cannot reach it. Anyone who can press the reset button can return the router to its defaults and log in with the password printed on the label. In a shared house or office, keep it out of public areas.

Steps 5–7: Secure the Wi-Fi

5. Use WPA3 or WPA2-AES. In the wireless security settings, choose WPA3-Personal, or WPA2/WPA3 mixed mode if older devices need it. CISA calls WPA3-Personal and WPA2 with AES the only safe options; WEP, WPA and WPA2-TKIP are outdated. If your router offers none of the good options, it is time for a new one. See WPA2 vs WPA3.

6. Set a strong Wi-Fi password. CISA suggests a passphrase of five to seven unrelated words, at least 16 characters long, that you do not use anywhere else. Our Wi-Fi password generator creates one in your browser, and how to change your Wi-Fi password shows where to enter it. After the change, every device has to reconnect — which also kicks off anyone who knew the old password.

7. Rename the network. A default name such as the brand plus a few characters tells others which router you have. Choose a neutral name without your surname, address or flat number.

Steps 8–10: Switch Off Risky Features

8. Turn off WPS. The push-button and PIN pairing feature is convenient, but the PIN mode can be attacked. If you do not use it, switch it off; see what is WPS on a router.

9. Turn off remote management. This setting lets the router’s admin page be reached from the internet. Unless you really manage the router from outside, keep it off. If your router has an app that works through the manufacturer’s cloud, that is a different feature; secure that account with a strong password and two-factor authentication.

10. Decide about UPnP. Universal Plug and Play lets devices open ports in the router by themselves. CISA recommends disabling it because malware can use the same mechanism. The trade-off is that game consoles rely on it for an Open NAT. If nobody in your home plays online, turn UPnP off. If someone does, a safer middle ground is to switch it off and forward only the ports the console needs; see NAT type strict and how to port forward.

Steps 11–12: Separate and Watch Your Devices

11. Put smart devices and visitors on the guest network. Cameras, plugs, speakers and TVs only need internet access, not access to your laptop. A guest network with its own password keeps them apart from your main devices. CISA recommends exactly this for smart-home and other IoT devices. See how to set up a guest Wi-Fi network.

12. Check the device list now and then. The router’s list of connected devices shows anything you do not recognise. Our guide on who is connected to my Wi-Fi explains how to identify devices, and the MAC address lookup tells you the manufacturer behind an unknown entry.

The devices themselves still need their own care: keep phones and computers updated, change default passwords on cameras and other gadgets, and remove apps and devices you no longer use.

Tips That Matter Less Than You Think

Some popular advice adds little protection.

Hiding the network name does not stop anyone who wants to find it; the network still shows up in Wi-Fi scanners, and hidden networks can cause connection problems. See should you hide your Wi-Fi network.

MAC address filtering sounds strict, but MAC addresses are easy to copy, and modern phones use a random MAC per network, so the list needs constant upkeep. A strong WPA2 or WPA3 password does the same job better.

Changing the router’s IP address from 192.168.1.1 to something else only hides the admin page from people who are already on your network and could find the new address in seconds.

A VPN on the router protects your traffic from your provider and on the way to the VPN server, but it does nothing for a weak admin password or old firmware. See our guide to VPN on a router if privacy is your goal.

How to Check Your Work

When you have finished, sign in to the router again and look at the status page: firmware version and date, wireless security mode, and whether WPS, UPnP and remote management are off. Then check what is visible from the internet: the port checker shows whether common ports on your public IP address answer. On a typical home network with UPnP and port forwarding off, they should all be closed.

Set a reminder to repeat the check every few months and after each router update.

Frequently asked questions

What is the most important step to secure a home network?

Changing the router’s admin password and keeping its firmware updated. Together they close the most common way routers are taken over.

Is WPA2 still safe for home Wi-Fi?

WPA2 with AES and a strong password is still considered safe. WPA3 is better; use it if all your devices support it, or the WPA2/WPA3 mixed mode if some do not.

Should I turn off UPnP?

If nobody needs it, yes — CISA recommends disabling it. Game consoles use it for an Open NAT; in that case, forwarding only the ports the console needs is a safer alternative.

Does a guest network make my network more secure?

Yes. Devices on the guest network can reach the internet but not your main devices, which limits the damage if a smart gadget is compromised.

How do I know if someone has hacked my router?

Warning signs are settings you did not change, a new admin password you did not set, unknown devices in the device list, or DNS servers you did not choose. Reset the router to factory settings, update the firmware and set it up again with new passwords.

Sources

Read next

  • What Is UPnP? Should You Turn It On or Off?

    UPnP lets devices open ports on your router automatically — handy for game consoles and media servers, risky if a device is compromised. How it works, what uses it, the security trade-off, UPnP vs port forwarding, and how to turn it on or off.

  • What Is DMZ on a Router? DMZ Host Explained (and the Risks)

    A router’s DMZ host forwards all incoming traffic to one device, removing the router’s firewall for it. What it does, when it helps (gaming, double NAT), the risks, safer alternatives, and how to set it up on TP-Link, NETGEAR and ASUS.

  • Does My Router Have a Firewall? Router Firewall Explained

    Almost every home router has a firewall: NAT plus an SPI firewall that blocks unsolicited incoming traffic. How to check it is on, what it does not protect against, IPv6, and whether you need a separate firewall.