A strong Wi-Fi password will not protect a router whose administration page is exposed to the internet. Sign in through your own home network and check whether remote administration is enabled. Unless you have a specific, secured reason to use it, turn it off. Wi-Fi access and router administration need separate attention.
A home network may include phones, laptops, a work computer, a printer, a TV, and small devices you rarely think about after setup. They do not all need the same level of trust. Focus on keeping control of the router, limiting who can join, restricting unnecessary connections between devices, and making recovery possible if something goes wrong.
Start with the equipment and accounts you control
First, identify which device routes traffic to the internet. It might be an all-in-one modem and Wi-Fi router from your provider, or a separate router connected to a modem or optical terminal. If you have two boxes, check which one provides Wi-Fi and which manages the firewall. Changing a setting on the wrong device may have no effect on the network you use.
Look up the router's model, firmware version, and support status in its administration interface or documentation. If it no longer receives security updates, plan to replace it; careful settings cannot fix future software flaws. For provider-managed equipment, ask which updates and security settings the provider controls.
Protect the administration interface
- Change default administrator credentials. Use a long, unique password that differs from your Wi-Fi password. Enable administrator multi-factor authentication if the router supports it.
- Update the router. Enable automatic firmware updates if available, or check the vendor's update mechanism periodically. Install only firmware intended for your exact model, never a file from an unfamiliar source.
- Disable internet-facing administration. Leave remote web administration and remote support access off unless you need them and have deliberately secured them. If you use a vendor app, review the account that protects it and any cloud-management features you have enabled.
- Use encrypted administration. Prefer HTTPS for the local router interface if supported. Do not enter the administrator password on a device you do not trust.
If you use the router's settings backup feature, know where the file goes: it may contain secrets. Store it offline or in protected storage. Note the model and the changes you make so you can rebuild the configuration after a factory reset.
Configure Wi-Fi without relying on obscurity
Use WPA3-Personal if all your devices support it. For older devices, WPA2-AES is a reasonable fallback; WPA2/WPA3 transition mode is another option if your router handles it reliably. Avoid WEP, WPA, and WPA2 modes that use TKIP. Choose a long, unique Wi-Fi passphrase. You can generate and store one in a password manager, or use a long, memorable multiword phrase that you do not reuse elsewhere.
Disable Wi-Fi Protected Setup (WPS), especially PIN-based pairing, if you do not need it. Its convenience can create another route around your passphrase. Give the network a name you recognize, but leave out your address, surname, and router model. Hiding the network name offers little security: connected devices still have to identify the network, and hiding it can make connections less convenient.
For visitors, set up a guest network with its own passphrase. Enable guest isolation or the setting that blocks access to your local network, then check what that setting actually does. Some routers keep guests away from your main devices while still allowing guests to reach one another. A guest network helps with visitor access, but you still need to maintain your own devices.
Put less-trusted devices in the right place
A smart plug may need internet access, but it has no reason to access files on your laptop. If your router offers an IoT network or a guest network that blocks local-network access, try placing smart-home devices there. Test their essential functions afterward: casting, printing, and device discovery may depend on local connections.
Two Wi-Fi names do not necessarily mean the networks are separated. Check the router's isolation settings. If you use VLANs or multiple access points, verify that the firewall rules enforce the separation you intended. For most beginners, a working main network and guest network are more useful than a complicated layout that is hard to maintain.
Once you have named your own equipment, review the router's connected-device list. An unfamiliar entry is not automatically an intruder: device names can be vague, and phones may use randomized Wi-Fi addresses. Compare its connection time and other details with devices you own. If you still cannot identify it, change the Wi-Fi passphrase, reconnect known devices, and see whether the entry returns.
Reduce exposure at the network edge
Most home routers have a stateful firewall that blocks unsolicited incoming connections by default. Keep it enabled. Review port-forwarding rules and remove any you no longer use, such as one left over from a game server, camera, or remote desktop setup. A forwarded port makes a service reachable from outside your home; its safety depends on the service, its authentication, and timely updates.
Universal Plug and Play (UPnP) allows devices to request port mappings automatically. Turn it off if your applications do not need to open incoming ports. If something necessary stops working, check that application's requirements before enabling UPnP again. Likewise, do not use the router's DMZ option, which can direct broad incoming traffic to one device, as a general connectivity fix.
Check IPv6 alongside IPv4. IPv6 devices may have globally routable addresses, though a properly configured router still blocks unwanted inbound traffic. Leave the IPv6 firewall on and review its rules separately if the router shows them. Confirming the firewall's behavior is usually more useful than turning off IPv6 simply because it is unfamiliar.
Understand what DNS settings can and cannot do
The router's DNS setting determines which resolver many of your devices use to look up domain names. A trusted resolver that filters known malicious domains adds a layer of protection, but it will miss some harmful sites; some devices and apps also use their own DNS settings. Changing DNS does not encrypt all browsing traffic or replace browser and device updates. Write down the old settings before switching providers so you can undo the change if it causes trouble.
Keep endpoints from becoming the weak link
Router settings cannot fix an unpatched laptop or an account compromised through a reused password. Enable automatic updates for operating systems, browsers, phones, and smart devices where available. Remove unsupported devices, or keep them isolated and offline when possible. Uninstall unused router companion and smart-device apps that retain access to management accounts.
On each computer, keep the local firewall enabled and use a standard user account for ordinary work when practical. Give important accounts unique passwords and multi-factor authentication. Back up files to storage that is not permanently writable by every network device, and test a sample restore. These steps can limit the damage from a malicious download or stolen account even when your network settings are sound.
A VPN is not a universal home-network security switch. It can protect traffic between a device and the VPN provider, but it will not patch vulnerable devices, prevent unsafe downloads, or separate IoT devices from computers. Use one for a specific need, not in place of routine maintenance.
Check your changes and plan for incidents
After each major change, test with a device you own. Make sure the main Wi-Fi works, guests can reach the internet but not a shared folder on your laptop, and essential smart-device features still function. In the router's administration interface, review firmware status, connected devices, port forwards, and security logs if available. Logs can be noisy and incomplete; a blocked connection alone does not mean you are under attack.
If you suspect an unauthorized device or altered settings, sign in from a trusted computer and save the relevant device list and settings for reference. Then change the router administrator and Wi-Fi passwords, remove unfamiliar port forwards, update firmware, and inspect the devices you reconnect. If you cannot trust the configuration, follow the vendor's factory-reset procedure, update the router, and rebuild only the settings you need. Contact your provider if its equipment or account may be involved.
Set a reminder to check the router every few months. Compare its firmware version and connected-device list with your notes, and remove any port-forwarding rule whose purpose you can no longer identify.
