To secure your home WiFi, change the router’s default admin password, turn on WPA3 encryption (or WPA2/WPA3 if older devices need it), use a long, unique WiFi password, keep the router’s firmware updated, and put smart devices and guests on their own separate networks. Those five steps block most of the ways people get into home networks. The rest of this guide shows how to do each one and adds a few steps for homes with lots of smart devices.
Why home WiFi security matters
Your WiFi connects your computers and phones, and also your cameras, door locks, thermostat and alarm. Someone who gets onto your network can try to reach any of those devices, watch unencrypted traffic, or use your connection for things you would never want tied to your address. Smart devices are a common weak point, since many ship with default passwords and some stop getting security updates after a few years.
Before you start
Find your router’s admin address and login, usually on a label on the router or in its app. Note your current network name (SSID), the security type and the firmware version. Look at the list of connected devices and make sure you recognize them. If the manufacturer no longer releases firmware updates for your router, plan to replace it. No setting can fix a router that is no longer patched.
Step-by-step guide to securing your home WiFi
Step 1: Change the router’s admin password
The admin password controls the router’s settings, and it is separate from the WiFi password. Default admin logins are often printed online for every model. Sign in to the router or its app and set a strong, unique admin password. While you are there, turn off remote administration from the internet unless you use it, and turn on two-factor authentication for the router’s cloud account if it has one.
Step 2: Update the firmware
Firmware updates patch security holes. Turn on automatic updates if the router offers them. If it doesn’t, check for updates every month or two. Do the same for mesh nodes and access points, which have their own firmware.
Step 3: Turn on strong encryption
- WPA3 is the current standard and the best choice. It is required for the 6 GHz band on WiFi 6E and WiFi 7.
- WPA2/WPA3 mixed mode lets older devices connect with WPA2 while newer ones use WPA3. Use it if some devices can’t join a WPA3-only network.
- WPA2 alone is acceptable for older equipment.
- WEP, the original WPA, and open networks should never be used.
Step 4: Set a strong WiFi password and a plain network name
Use a WiFi password of at least 12 characters. A passphrase of several unrelated words is long and easy to type into a TV. Pick a network name that doesn’t include your family name, address or the router model.
Step 5: Separate smart devices and guests
Create a guest network for visitors so their devices can reach the internet but not your computers, printers or cameras. Put smart devices (cameras, plugs, speakers, TVs and appliances) on a network of their own too. Many routers allow this with a second guest network. Business-grade systems do it properly with VLANs. If one smart device is compromised, the damage stays on that network.
Step 6: Turn off features you don’t use
Turn off WPS, the push-button pairing feature, since it has a history of security problems. Check whether UPnP is on. It lets devices open ports on your router by themselves, which is convenient but risky. If you turn it off, test your cameras, game consoles and video calls afterward, since some rely on it.
Protecting smart home devices from hackers
- Change the default password on every device that has one, including cameras and network video recorders.
- Use a different password for each device and app account, and keep them in a password manager.
- Turn on two-factor authentication for every smart home account that offers it, especially cameras, locks and the alarm.
- Keep device firmware and apps updated, and turn on automatic updates where you can.
- Buy from manufacturers that publish a support period and release security updates. Retire devices that no longer get them.
- Don’t forward ports on your router to reach cameras or recorders from outside. Use the manufacturer’s secure app or a VPN into your home network instead.
- Check your router’s list of connected devices now and then, and look in each app’s activity log for logins you don’t recognize.
A note on VPNs: a VPN app on your phone or laptop protects your traffic on public WiFi in hotels and coffee shops. It doesn’t secure your home network or your smart devices. At home, the steps above matter much more.
How do you know if your WiFi has been compromised?
Warning signs include devices you don’t recognize on the network, router settings you didn’t change, smart devices acting on their own, unexpected login alerts, or a network that is suddenly much slower. If you suspect a problem:
- Change the router admin password and the WiFi password from a device you trust.
- Update the router’s firmware. If the settings have been tampered with, reset the router to factory defaults and set it up again.
- Change passwords on your smart home accounts and email, and check that two-factor authentication is on.
- Run a malware scan on your computers.
Questions we hear often
How often should I update my router’s firmware?
As soon as updates come out. Automatic updates are the easiest way. If your internet provider supplied the router, it may update on its own, but check the settings to confirm.
Does a guest network make my WiFi more secure?
Yes. It keeps visitors’ devices, and any malware on them, away from your computers, files and cameras.
Can smart devices be hacked even with strong passwords?
Yes, if the device has a software flaw that hasn’t been patched. That is why updates and a separate network for smart devices matter as much as passwords.
When a professionally managed network makes sense
Most homeowners can handle the steps above with a modern router in an afternoon. A professionally designed network makes sense when you have dozens of smart devices, cameras and locks you rely on, people working from home, or a large house that needs several access points. An installer can set up VLANs for smart devices and guests, keep firmware current across every piece of equipment, and spot problems early. For the basics of how a home network fits together, see our smart home network setup guide. If your network has slowed down as you added devices, our post on how smart devices affect WiFi speed explains why.
Planning a home network project?
We design and install secure whole-home networks, with separate networks for smart devices and guests, for homes across Greater Boston, the South Shore and Rhode Island. Book a free consultation or read more about our smart home WiFi and networking.
