Securing Your Home Wi-Fi Network

Most routers work fine "out of the box" — which is exactly the problem. Factory settings favor ease of setup over security, and many people assume their home network is simply too small to fall prey to a cyberattack and that their devices are secure enough right out of the box. This walks you through locking things down, in the order that makes sense whether you're setting up a brand-new router or finally getting around to an old one.

23 items · 6 essential reviewed 17 Aug 2026 6 sources .md .json

0 / 23

Find your router and get logged in

Locate your router and check the labelMost have a sticker listing the default admin login, network name, and sometimes the default Wi-Fi password.
Open the router's admin page in a browser and log in with default credentialsUsually an address like 192.168.1.1 or 192.168.0.1, printed on that same sticker, so you can start changing settings.
Confirm your router isn't past its "end of life" for updates if router more than 5 7 years old or unsupportedMany routers are no longer supported or reached end of life, offering a potential risk.

Lock down the basics — do this first

Change the router admin username and passwordThis is the account that controls every other setting, and leaving it on the factory default is one of the most common ways home networks get taken over. Don't reuse a password from anywhere else.
Set a strong, unique Wi-Fi network passwordThe Wi-Fi network password is the one you use to connect your devices to the network, and a unique and secure Wi-Fi network password prevents strangers from getting onto your network.
Turn on WPA3 (or WPA2 if that's all your router offers)Skip WEP or WPA entirely — older routers have WPA and WEP, which are outdated and not secure. If you don't see WPA2/WPA3 as an option, try updating your router software, then check again, and replace the router if they still aren't available.
Change the default network name (SSID)Skip anything that identifies your address, name, or router brand.
Turn on the router's firewall and confirm it's actually activeNot just present.

Turn off the features that weaken security

Turn off WPS (Wi-Fi Protected Setup)This "push button" pairing feature has known weaknesses that let attackers brute-force their way in.
Turn off remote/router management from the internetUnless you specifically need to administer your router while away from home, this feature just gives attackers another door in.
Turn off UPnP (Universal Plug and Play)It lets devices open ports automatically without asking you, which malware can exploit.
Turn off file-sharing over public/guest connectionsOnly allow file sharing over home or work networks, never on public networks, and password-protect anything you do share.

Keep things updated and patched

Turn on automatic firmware updates for your router, or check for them manually every few monthsRegularly update your router firmware and install automatic updates, if possible.
Update the software and operating systems on connected computers and phonesUpdate your phone's operating system, too, alongside your computer's OS and browser.
Remove old apps, trial software, or unused services on your devicesCISA notes many devices come loaded with "bloatware" that's rarely useful and just adds risk.

Set up separate access for guests and smart devices

Create a guest Wi-Fi network if regularly have visitors connectKeep them off your main network so a compromised guest device can't reach your computers or files.
Put smart-home gadgets on the guest network or a separate IoT network if have several connected smart devicesUseful if you have several connected devices, since a weak link in one cheap gadget shouldn't expose your whole network.
Change the default username and password on every connected device before first useIf your device came with a default username and password out of the box, change them, and don't reuse a password from another account.
Turn on two-factor authentication on device and router accounts where it's offeredUse two-factor authentication for an extra layer beyond the password alone.

Ongoing upkeep

Check the router's connected-devices list every few monthsLook at "connected devices," "wireless clients," or "DHCP clients" in the admin page to spot anything you don't recognize.
Re-check firmware and settings after any router reset or replacementA factory reset wipes your custom password and settings back to defaults.
Avoid logging into sensitive accounts over unknown public Wi-Fi if must use public wifiStick to sites starting with "https" and consider a VPN, since most websites do use encryption to protect your information but not all hotspots are trustworthy.
Note your router model and admin password somewhere safeUse a password manager, not a sticky note, so you're not locked out later.

Progress saves on this device.

Sources & upkeep

All 6 sources are re-checked weekly. When one changes a fact this checklist asserts, the step is edited and the change is logged — the revision history is public.

Different situation? — it only selects from the steps above; nothing new is written.

Essential isn’t a shorter checklist — it’s the same one with the optional steps tucked away. Everything’s still a click away, and the essential marks stay put in anything you make from this, right down to the .json.

A helpful starting point, not professional advice — here’s why.