Home Network Security Checklist: Router, Wi-Fi, and IoT

Short answer: Most home network attacks don't break your Wi-Fi password — they exploit a router left on default settings, out-of-date firmware, or a cheap smart device that never gets updates. Work through the checklist below once (it takes about an hour), then revisit it twice a year.

The 15-step checklist

Router basics

1. Change the router admin password. This is different from your Wi-Fi password and protects the settings page. Many routers ship with a default printed on the label.
2. Update the firmware and turn on automatic updates if available. Firmware updates fix real security vulnerabilities.
3. Disable remote administration (sometimes called "remote management" or "web access from WAN") unless you truly need it.
4. Turn off UPnP if you don't need it. It lets devices open ports on your router automatically, which malware can abuse. (Some games and video-call apps use it; turn it back on only if something breaks.)
5. Replace end-of-life routers. If the manufacturer no longer releases updates, the router won't get security fixes. Check the support page for your model.

Wi-Fi

6. Use WPA3 (or "WPA2/WPA3 mixed" if older devices need it). Never use WEP or open networks.
7. Use a long Wi-Fi passphrase — four or more random words is easy to type and hard to crack.
8. Disable WPS. The PIN-based Wi-Fi Protected Setup feature has known weaknesses that can reveal your password.
9. Rename the network to something that doesn't identify you, your address or your router model.

Devices

10. Put smart devices on a separate network. Use your router's guest network or an IoT network for cameras, smart plugs, TVs and speakers, so a compromised gadget can't reach your laptop or file storage.
11. Update or replace smart devices that no longer receive updates, and change any default passwords.
12. Review the connected-devices list in your router's app or admin page. Investigate anything you don't recognize.

Extra protection

13. Use a filtering DNS service such as NextDNS, Control D or Quad9 to block known malware and phishing domains for every device on the network.
14. Turn on your router's firewall (it's usually on by default) and keep it enabled.
15. Back up your router settings after you're done, so you can restore them after a reset.

Which settings matter most?

If you only do three things, do these:

Should you buy a "security router" or firewall box?

Most people don't need one. A modern router from a manufacturer that ships regular updates, configured with the steps above, covers home needs. Dedicated devices like Firewalla or a pfSense box add detailed monitoring and per-device rules — worth it for tech-savvy households, home offices or homes with many smart devices.

What about a VPN on the router?

A VPN on your router encrypts traffic from every device to the VPN provider, which hides it from your internet service provider. It doesn't protect against threats inside your network, such as a compromised smart device. See our NordVPN and ExpressVPN reviews for router support.

Frequently asked questions

How do I know if my router has been hacked?

Warning signs include settings you didn't change (especially DNS servers), unknown devices, a changed admin password, or browsers redirecting to unfamiliar pages. Reset the router to factory settings, update the firmware, then reconfigure it with a new admin password.

Is a guest network enough to isolate smart devices?

For most homes, yes, provided the guest network blocks access to the main network (check the "allow guests to see each other and access my local network" setting is off).

Is WPA2 still safe?

WPA2 with a strong passphrase is still reasonably safe, but WPA3 adds protection against offline password-guessing attacks. Use WPA3 when your devices support it.

Sources

• CISA, Home network security
• NSA, NSA releases best practices for securing your home network
• Wi-Fi Alliance, Wi-Fi CERTIFIED WPA3