How to Secure Your Home Wi-Fi Router

Many home routers are set up once and then left on a shelf for years, still running the settings they had on the day they arrived. That box sits between every device in your home and the internet, and it may be the one computer in the house that nobody updates.

Learning how to secure home Wi-Fi mostly means giving that box a short checkup: once properly, then again twice a year. Australia’s Cyber Security Centre (ACSC) advises a router health check at least every six months, and says a router that has stopped getting security updates should be replaced as a priority.¹ The checkup has seven steps:

1. Change the router’s admin password
2. Set the Wi-Fi security to WPA3, or WPA2 with AES
3. Give the Wi-Fi a new name and a long password
4. Update the firmware, then switch on automatic updates
5. Turn off WPS, remote management and features you don’t use
6. Check which devices are connected
7. Replace a router that no longer gets updates

You need the sticker on the router, a phone or laptop, and a little patience with menus. The router is one piece of a bigger picture; if unique passwords and phone updates are not yet habits, begin with the everyday security habits worth setting up first.

Why the router is worth ten minutes of attention

A router is worth securing because it is the gateway between the internet and everything in your home, and it runs around the clock with little attention. Australia’s ACSC warns that an attacker who gets into a router may reach other devices on the network and use them to attack others, and that a physical connection is not needed to try. The danger is less that someone targets you and more that routers are easy to recruit in bulk. The agency says the “set and forget” attitude many people take to routers makes them an attractive target for criminals, who recruit them into botnets: networks of hijacked devices controlled from afar. In one case it cites from 2023, a botnet of tens of thousands of devices, home routers among them, was built by exploiting old flaws in outdated firmware.¹ Nobody picked those households; their routers simply still had old, known holes.

The clearest measure of neglect comes from a German research institute that checked the latest software makers had published for their routers.

The study

Limited evidence

How often home routers got security fixes: Fraunhofer FKIE, Germany, 2020

Researchers at Fraunhofer FKIE downloaded the most recent firmware that seven large makers offered for 127 home routers sold in Europe and analyzed it automatically. 46 of the routers, about a third, had received no security update in the previous year, and many ran old software with hundreds of known flaws. Some makers did far better than others.²

The study is a 2020 snapshot of what makers published, not of what runs in homes, and it left out internet providers’ routers. Even so, find out whether your router is getting fixes rather than assuming it is.

Myth

My home network is too small for anyone to bother attacking.

Fact

An archived 2021 US government guide calls this a common misconception: most attacks are not personal, and any network connected to the internet is more vulnerable.

That fact comes from an archived 2021 guide by the US Cybersecurity and Infrastructure Security Agency (CISA), which names a second common mistake: assuming devices are secure enough straight out of the box.³ The useful question about your own router is whether it still carries old holes that automated scans look for.

How to secure home Wi-Fi, step by step

Securing home Wi-Fi means working through the router’s settings page in a sensible order: lock the settings first, then protect the wireless signal, then remove the extras. The steps follow Australia’s ACSC and the US Federal Trade Commission (FTC), which agree on almost every point. Menu names differ between models, so keep the manual handy.

1. Change the router’s admin password

Every router has two passwords, and the one that matters most is the one people forget exists. The FTC separates the Wi-Fi password, which lets a device join your network, from the admin password, which opens the router’s settings: someone who gets into the settings can change everything else, including the Wi-Fi password, and undo your other precautions.⁴

To get in, connect to the router, type its address (printed on the sticker or in the manual) into a browser, and log in with the details on the same sticker. Some makers also offer an app that does the same job. Once inside, find the page usually labelled admin settings or account management, and change the username too if the router allows it. The ACSC points out that default usernames and passwords may be published online for anyone to see, and they are usually printed on the router itself (or in its manual), readable by anyone who has stood in your hallway.¹

Store the new admin password in a password manager, then log out and back in to check it works.

2. Set the Wi-Fi security to WPA3, or WPA2 with AES

Wi-Fi security settings decide how the signal between your devices and the router is scrambled, and the choice is easy: pick the newest option all your devices support. The ACSC suggests WPA3 first, then a WPA3 “transition mode” if older devices can’t connect, and WPA2 (sometimes shown as WPA2-Personal or WPA2-PSK) if neither is offered.¹ The FTC calls WEP and the original WPA outdated and not secure, and if they are the only options even after a software update, it suggests considering a new router.⁴

Where the menu asks for an encryption type under WPA2, choose AES rather than TKIP. AES is the method at the heart of WPA2; TKIP belongs to the older WPA and is not allowed in WPA3.⁵

3. Give the Wi-Fi a new name and a long password

The Wi-Fi name and password are what a stranger in the street would need to join your network, so both deserve a change from the factory settings. The ACSC notes that a default network name can reveal the router’s make and model to an attacker, and that a weak Wi-Fi password can be trivial to break. It suggests a new name with no personal details and a long, unique password, such as a passphrase of several random words.¹

Length matters more here than you might expect. With WPA2, someone within range can record the moment a device connects and then try guesses on their own computer as fast as it can run, so a short or common password falls quickly; WPA3 was designed to make each guess require contact with the router, though researchers later found design flaws that weaken this.⁵ Say the Wi-Fi password is the family name plus a house number: easy to type, and exactly the kind of guess a cracking tool tries early. Four unrelated words beat it and are still easy to type.

If your router broadcasts separate 2.4 GHz and 5 GHz networks, change the name and password on each one, then reconnect your devices. A password manager that generates long passwords can create and store the new one.

4. Update the firmware, then switch on automatic updates

Firmware updates are how router makers fix security flaws, and a router only gets them if it checks for them or you install them. In the settings, look for a page called firmware, update or administration, note the current version, and run the check. The ACSC describes this route and a manual one, stresses downloading files only from the maker’s official website, and suggests subscribing to the maker’s update alerts if the router can’t update itself.¹

The better long-term fix is to let the router update itself. Some models do: NETGEAR, for example, says automatic updates on the models it lists run overnight, in a three-hour window in the router’s time zone.⁶

5. Turn off WPS, remote management and features you don’t use

Features that make a router easier to use can also make it easier to break into, so switch off the ones you don’t need. The FTC names three to turn off: remote management, Wi-Fi Protected Setup (WPS) and Universal Plug and Play (UPnP).⁴

Remote management lets you change settings over the internet, which also means other people on the internet can try. The ACSC names it among the most common routes by which routers are compromised, and applies the same logic to port forwarding and file-sharing services: if you don’t need them, disable them.¹

WPS is a shortcut for joining the network with a button or an eight-digit PIN instead of the password. In 2011 a researcher showed that the PIN is checked in two halves, which cuts the guessing needed to at most about 11,000 tries; on routers without a lockout, that is little protection.⁷ TP-Link, one of the makers, says the push-button method is lower risk for occasional use and suggests turning WPS off when you aren’t using it.⁸ The simplest choice is to leave it off and type the password.

6. Check which devices are connected

A list of connected devices shows who is using your network. The ACSC suggests looking at it in the router’s settings and, if you see a device you don’t recognize, changing the Wi-Fi name and password so that everything has to reconnect with the new details. Expect some cryptic names, especially for smart speakers; the agency suggests renaming the devices you know so the next check is faster.¹

7. Replace a router that no longer gets updates

A router that its maker has stopped updating will collect known flaws that never get fixed, and no setting can make up for that. The ACSC says makers support a router for a limited time, usually three to five years depending on brand and model, and that one with no update in more than a year is likely at its end of life. Search the maker’s website for your model number to find its support status, and when you replace the router, choose one that updates automatically.¹

The UK’s National Cyber Security Centre (NCSC) offers a useful way to think about it for smart devices: treat the support end date as a “use by” date.⁹ Some countries now push makers to publish that date. Since April 2024, UK law has required makers of connectable consumer products sold there to state a minimum period of security updates, with an end date, and to avoid easily guessed default passwords.¹⁰ Elsewhere, the rules may differ or not exist yet; your government’s cyber-security or consumer-protection body will say which apply to you.

Your router checkup

• Change the admin username and password from the sticker defaults
• Set Wi-Fi security to WPA3, or WPA2 with AES
• Rename the Wi-Fi and set a long passphrase on every band
• Install the latest firmware and turn on automatic updates
• Turn off WPS, remote management and unused services
• Review connected devices and rename the ones I know
• Look up my router's end-of-support date
• Put a six-month router check in my calendar

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

If your router came from your internet provider

A router from your internet provider can be secured with the same steps, but some decisions sit with the provider. Who sends firmware updates, which settings you can change, and whether you may use your own router vary by provider and by country. Picture a box your provider posted four years ago: its menu may have no firmware page because updates come from the provider’s side, or those updates may have quietly stopped.

The FTC suggests asking your provider whether it sends out automatic updates.⁴ The answer is often on the provider’s help pages. The ACSC suggests consulting your provider for advice on compatible replacements if yours has reached its end of life.¹

Four questions cover most of what you need to know, wherever you live: Does the router update automatically? How long will it keep getting security fixes? Will you replace it free when support ends? And can I use my own router instead? Keep the answers with your account number, so the next six-monthly check starts from facts.

Which router settings rest on firm evidence?

The router steps rest on agreement between national cyber-security agencies more than on measurements of what happens in homes. We found no study that compared households that followed them with households that did not, which is why each row below carries its evidence label.

A weak label here means nobody has measured the benefit, not that the step is useless. Checking connected devices has the thinnest backing in the table and costs the least, so do it anyway.

The bottom line

The admin password is the setting to change first, because it guards every other one. After it come WPA3 or WPA2 with AES, current firmware and switching off the shortcuts you don’t use. After that, the job is a six-monthly check and one question to keep asking: is this router still getting security fixes, and if not, when will it be replaced?