How to protect your home Wi-Fi: the router settings that matter
A home network is only as secure as the router at the middle of it. Twenty minutes in its settings fixes most of the risk, and a few popular tips are not worth your time.
By the editors of ProtectYour.com Last reviewed 6 min read
Key takeaways
- Change the router's admin password, and use WPA3 (or WPA2 with AES) with a long Wi-Fi password.
- Turn on automatic firmware updates, and replace the router when the maker stops supporting it.
- Turn off WPS, remote management and UPnP unless you know you need them.
- Put visitors and smart gadgets on a guest network so they cannot reach your laptops and phones.
- Hiding your network name and MAC address filtering are not worth the hassle. They stop no one who is determined.
First, get into your router's settings
Most of what follows happens in one place: your router's settings. Newer routers and mesh systems (Eero, Google Nest Wifi, TP-Link Deco, Netgear Orbi and others) use a phone app. Older ones use a web page you reach by typing an address such as 192.168.0.1 or 192.168.1.1 into a browser while connected to the network. The address and default login are usually printed on a sticker on the router.
If your internet provider gave you a combined modem and router (often called a gateway), it may be managed through the provider's app instead. Some providers lock certain settings; more on that below.
Passwords and encryption
1. Change the admin password
The admin password controls the router itself. Older routers shipped with defaults like "admin" that anyone could look up. Many newer ones print a unique password on the sticker. Better, but anyone who has been in your home can read it. Set your own, and store it in your password manager.
2. Use WPA3, or WPA2 with AES
In the wireless security settings, choose WPA3 if your router supports it. If some older devices cannot connect, choose the mixed WPA2/WPA3 mode, or WPA2 (AES) as a fallback. Avoid anything labeled WEP, WPA (without the 2), or TKIP: those are old, broken schemes.
3. Set a long Wi-Fi password
Someone within range can capture the handshake your devices make when they connect and then guess the password offline, as fast as their hardware allows. A long password defeats that. Four or five random words, or a string of 16 or more random characters, is plenty. WPA3 makes this kind of offline guessing much harder, another reason to turn it on.
Free step: rename the network, too
Keep the firmware updated
Router flaws are found regularly, and attackers scan the internet for routers that have not been patched. Botnets built from hijacked home routers are a long-running problem.
- Look for automatic updates or auto-update firmware in the settings and turn it on.
- If there is no automatic option, check for an update in the app or admin page every couple of months.
- Search your router model plus "end of life" on the maker's website. Makers publish lists of models they no longer patch. If yours is on the list, replace it, even if it still works.
When you buy a new router, choose a maker that updates automatically and states how long it supports its products. Mesh systems from the big brands generally handle updates well. Our updates guide covers the rest of your devices.
Features to turn off unless you need them
- WPS (Wi-Fi Protected Setup). Lets a device join by pushing a button or entering an eight-digit PIN. The PIN method has a well-known design flaw that lets attackers guess it quickly. Turn WPS off; typing the password once is not a hardship.
- Remote management (also called remote administration or web access from WAN). Makes the router's admin page reachable from the internet. Unless you need to change router settings while away from home, turn it off. App-based routers that work through the maker's cloud handle this differently and usually more safely.
- UPnP (Universal Plug and Play). Lets devices on your network open ports to the internet by themselves. Game consoles and some video calling or file-sharing apps use it. It is also how a compromised gadget can expose itself. If nobody in the house games online, turn it off and see if anything breaks. If something does, you can turn it back on or forward only the specific ports needed.
Use a guest network for visitors and gadgets
Most routers can run a second, separate network. Devices on it can reach the internet but not the computers, phones and network drives on your main network (check that the "allow guests to see each other and access my local network" option, or similar, is off).
Two good uses:
- Visitors. Give guests the guest password. You do not know what is on their phones, and you will not need to change your main password when a contractor or ex-roommate has it.
- Smart home devices. Cheap cameras, plugs and TVs tend to get the fewest security updates. If one is hijacked, keeping it on the guest network limits what it can reach. Some apps need your phone on the same network to set a device up; you can switch your phone temporarily. More in smart home device security.
Optional: block known bad sites with DNS filtering
Every time a device looks up a website, it asks a DNS server for the address. By default that is your internet provider's server. You can point your router at a filtering DNS service instead, and it will refuse to look up domains known for malware or phishing, for every device on the network.
Popular filtering DNS services
| Service | What it blocks | Worth knowing |
|---|---|---|
| Quad9 | Known malicious domains | Run by a nonprofit foundation; free; no account needed |
| Cloudflare 1.1.1.1 for Families | Malware, with an option to also block adult content | Free; no account; few settings |
| NextDNS | Malware, trackers, ads, and categories you choose | Detailed controls and logs; free tier with a monthly query limit, paid above it |
Set the DNS servers in your router's internet or WAN settings to cover the whole house. Many provider gateways do not allow changing DNS; in that case you can set it on individual devices instead. Filtering catches some phishing, not all, and it can occasionally block a legitimate site. Families wanting stronger content controls should read our parental controls guide.
If your internet provider supplied the router
Provider gateways have upsides: the provider usually pushes firmware updates for you, and support can fix settings remotely. Downsides are fewer settings, slower adoption of WPA3 on older models, and sometimes features you cannot switch off.
You can usually still change the Wi-Fi name and password, the admin password, and turn off WPS. If the gateway is old, ask the provider whether a newer model is available. Some people put the gateway in bridge mode and use their own router behind it; that gives you full control but makes you responsible for its updates.
Two popular tips that are not worth it
Hiding your network name (SSID). A hidden network still transmits, and its name shows up in traffic whenever a device connects. Free tools reveal it in seconds. Meanwhile, your phones and laptops have to keep calling out for the hidden network by name wherever they go. That can make your devices easier to fingerprint. You lose convenience and gain nothing.
MAC address filtering. Allowing only listed device addresses sounds strong, but MAC addresses travel unencrypted over the air and are easy to copy. Modern phones also use a different random MAC address per network by default, so the list breaks whenever a device changes it. A strong WPA3 or WPA2 password does the real work.
Away from home, the risks are different. See is public Wi-Fi safe for coffee shops and hotels.
Common questions
Should I use WPA2 or WPA3?
Use WPA3 if your router and devices support it. If some older devices cannot connect, use mixed WPA2/WPA3 mode or WPA2 with AES. Avoid WEP, original WPA and TKIP.
Does hiding my Wi-Fi network make it safer?
No. A hidden network still shows up to anyone with free scanning tools, and your devices have to broadcast its name to find it. A strong password and WPA3 or WPA2 encryption matter far more.
Should I turn off WPS on my router?
Yes, unless you rely on it. The WPS PIN method has a known flaw that lets attackers guess the PIN quickly. Typing the Wi-Fi password once on each device is safer.
Is a guest network worth setting up?
Yes. It keeps visitors' devices and poorly secured smart gadgets off your main network, so a compromised device cannot reach your computers and phones.
Your next step
Related guides
- Smart home security: how to keep cameras, doorbells, speakers and TVs from spying on youThe weak point in most smart homes is the account in the cloud, not the gadget on the shelf. Secure that first, then cut the features and data sharing you never asked for.
- Is public Wi-Fi safe? The real risks in cafes, hotels and airportsEncryption on almost every website has taken the sting out of most public Wi-Fi warnings. A few real risks remain, and a handful of settings plus your phone's hotspot deal with nearly all of them.
- Why software updates matter, and how to turn them on for every device you ownInstalling updates is the single cheapest security habit there is. Switch on automatic updates everywhere, know when a device stops getting them, and replace it before that happens.
- Parental controls: how to set them up on phones, consoles, Wi-Fi and streamingThe free controls built into your kids' devices cover most families. This guide shows how to turn them on, what each does well, and how to loosen them as your child grows.