1. Set a Strong Wi-Fi Password (WPA3 or WPA2-AES)
The Wi-Fi password is the front door. Check two things: encryption mode and password strength.
- In wireless settings, choose WPA3 if offered (WPA2/WPA3 mixed mode for older devices). If you see 'WEP' or plain 'WPA' anywhere, the router is ancient or misconfigured — both are crackable in minutes.
- Replace the default or short password with a passphrase of 4+ random words (our passphrase guide). 'correct-horse-quilt-harbor' beats 'Gh7!pQx2' and is typeable on a TV remote.
Every device reconnects once after the change — two minutes of re-entering the new password across your household.
2. Change the Admin Password (and Disable Remote Admin)
The router's admin login is separate from Wi-Fi and ships with famously weak defaults (admin/admin). Anyone on your network — a compromised smart bulb, a visiting laptop with malware — can own a router with default credentials.
- Set a unique admin password; store it in your password manager.
- Turn off 'Remote Management' / 'Remote Access' / 'Cloud access' unless you genuinely administer the network from away. This closes the internet-facing admin page — the single most attacked router surface.
3. Enable Automatic Firmware Updates
Router firmware fixes actively exploited vulnerabilities — in 2024–2026 alone, dozens of critical router CVEs were weaponized within days of disclosure. Yet most home routers run the firmware they shipped with, years out of date.
In Administration or System settings, enable auto-update. If your router lacks the option, calendar a quarterly manual check — or treat the missing option as a replacement signal (see our mesh recommendations for modern hardware that updates itself).
4. Turn Off WPS and UPnP (If Unused)
Two 'convenience' services worth retiring:
- WPS (the push-button pairing): its PIN scheme is brute-forceable in hours. Disable it after all your devices are connected — modern devices don't need it.
- UPnP: lets any internal app punch holes through your firewall automatically — convenient for game consoles, ideal for malware. If you forward ports for specific things, set manual port-forward rules instead and switch UPnP off. If nothing you own needs ports (most households post-2020), just disable it.
5. Create a Guest Network for Smart Devices and Visitors
Put visitors and the 'internet of things' on a guest network — most routers offer one checkbox. Two wins:
- Segmentation: a hacked cheap camera or a friend's malware-infected phone cannot reach your laptops, NAS, or printer. Isolation is the whole game in IoT security (more in our smart home checklist).
- No password sharing: guests get the guest password; you never hand over the main one or rotate it after parties.
Enable 'AP/client isolation' on the guest network if offered — guests then cannot even see each other.
6. Set Your Own DNS (Bonus: It Makes the Whole Home Safer)
In LAN/DHCP settings, replace the ISP's DNS with a filtering resolver — this is the network-level malware blocker from our DNS comparison:
- Quad9 (9.9.9.9): blocks known malicious domains for every device, no account needed.
- Cloudflare (1.1.1.2): malware filtering with Cloudflare speed.
Done once, it protects the TV nobody updates, the console, the kids' tablets — devices that never see a browser extension. Combined with the five changes above, your home network goes from default-insecure to hardened in one sitting.
