Smart Home & Tech · Privacy and security

Home Wi-Fi Security Checklist: Practical Steps to Protect Your Network

By TechHomeTips Editors Published September 10, 2026 Updated October 27, 2026 4 min read Report a correction

Change the router admin password, use WPA2-AES or WPA3, and isolate guests before you add more devices.

Secure a home Wi-Fi network by changing the defaults, turning on current encryption, and separating guests and smart-home devices from your computers. Do the router changes from an Ethernet cable when you can, so a wireless save does not kick you off halfway through.

Have the router model number, the admin address printed on the label, and the current admin password before you start. This is a household checklist. It is not a penetration test, and it does not describe how to break into a network.

Step 1: Replace the default admin login

  1. Log in with the address and method in the router’s own manual or the ISP’s guide. Do not follow a random “admin URL” from a forum.
  2. Change the admin username if the router allows it, and set a unique passphrase you do not reuse for Wi-Fi or for smart-home apps.
  3. Store it in a password manager or a written note you keep off the fridge. A sticker of the new password on the router undoes the change.

Factory logins such as admin/admin are widely known. Leaving them in place is the gap to close first. CISA also advises changing default passwords and using WPA2 or WPA3 on a home router. Check the current instructions for your own model before changing its settings.

Step 2: Update firmware, then decide if the router is still supported

Apply the update the vendor’s support page or the admin panel offers before you change other settings. If the vendor no longer posts updates for that model, plan a replacement. “Three to five years” is only a rough planning hint. The support page for your model is the source.

Step 3: Turn on WPA3 or WPA2-AES

Use WPA3 if the router and the devices you still need both support it. If a device cannot join WPA3, WPA2 with AES (often labeled WPA2-PSK AES) is the next practical choice. Do not use WEP. Avoid TKIP and mixed modes that keep old encryption turned on. Set a Wi-Fi passphrase that is different from the admin password and at least 12 characters.

Write down which devices only join 2.4 GHz. Changing bands or names can knock those offline until you rejoin them. That is an inconvenience, not a security feature.

Step 4: Rename the network and split guests

Change the default network name so it does not include your street address, your family name, or the router brand. If the router offers a guest network, put visitors there. Turn on client isolation or AP isolation if the manual says that setting stops guests from reaching your computers and each other. Confirm the wording in the manual. Isolation is not the same on every model.

A separate name for smart plugs and cameras is useful when the router can keep that network off your file shares. See how to create a guest network and the smart-home planning guide. Do not assume a second SSID is a full firewall.

Step 5: Turn off features you are not using

  • Turn off WPS. The push-button convenience is not worth leaving the feature enabled after the device has joined.
  • Turn off UPnP unless a current device manual says you need it and you accept that it can open ports. If you do not know which app needs it, leave it off.
  • Turn off remote administration from the internet unless you have a specific need and the vendor’s secure method. Do not expose the admin page to the WAN “just in case.”
  • After any of these changes, confirm you can still reach a known device. If you cannot, undo the last change only, using the manual.

Step 6: Read the device list

Open the connected-device list. Name the phones and laptops you recognize. An unknown entry is a prompt to change the Wi-Fi passphrase and reconnect your own devices, not a prompt to filter MAC addresses as your only control. MAC filtering is easy to defeat and is optional bookkeeping, not encryption.

Step 7: Recheck after outages and new ISP gear

Every month or two, look for a firmware update, scan the device list, and confirm guest isolation is still on. After a power outage or an ISP gateway swap, check the same items again. Some gateways return to defaults. Also confirm you did not leave a DMZ or a port forward you no longer use. If the admin page is unresponsive after an update, or settings revert and unknown devices remain, unplug the router’s WAN connection and contact the vendor or a technician. Do not keep experimenting on a router you think is compromised while it stays online.

Example: one ISP gateway and a handful of plugs

The gateway still has the sticker password for admin and a Wi-Fi name that includes the ISP brand. From a laptop on Ethernet, the owner sets a new admin passphrase, updates firmware, switches encryption to WPA2-AES because one older plug cannot use WPA3, and turns on the guest network with isolation. The plugs stay on the main 2.4 GHz name until the owner has time to move them, which they write down as unfinished. WPS is off. This is a sequence, not proof that the gateway’s “isolation” checkbox works as the owner hopes. They still have to read that model’s manual.

Last updated: October 21, 2026

Last reviewed October 22, 2026. Suggest a correction

Questions readers ask

Is hiding the network name enough?

No. A hidden name is not encryption. Set WPA3 or WPA2-AES and a long passphrase.

Should guests use my main password?

No, when the router offers a guest network. Turn on isolation if the manual documents it.

Do I need a special DNS service?

Not to finish this checklist. A filtering resolver can be a later choice. Do not treat a DNS name as a substitute for encryption and a changed admin password.

What if a smart plug drops off after I change the name?

Rejoin it using the plug’s own instructions. Note whether it needs 2.4 GHz. See smart-home devices that disconnect if it will not stay on.

When do I replace the router?

When the vendor no longer offers firmware for that model, or when it cannot do WPA2-AES. Check the support page, not a fixed number of years.

Sources and methodology

Claims that depend on an outside authority are tied to the references below. Product details change. Confirm the current specification sheet before you buy or install anything.

  1. Telework Essentials: Home Network Security — CISA (government), accessed October 24, 2026. Supports changing default passwords, WPA2/WPA3, disabling WEP/WPA, and avoiding location or router model in the SSID. It does not verify any particular router setting.
  2. Guidelines for Securing Wireless Local Area Networks (WLANs) — NIST (government), accessed October 5, 2026. NIST SP 800-153 guidelines for securing wireless local area networks (WLANs).
  3. Smart Home Device Security — CISA (government), accessed October 5, 2026. CISA tips for securing smart home devices, relevant to IoT network isolation.

Information on this site is for general educational purposes and is not professional advice.

Parent topic: Smart Home & Tech