How to secure your home Wi-Fi router and smart devices

Why the router matters

Every phone, laptop, TV, camera and smart speaker in your home connects through the router. If someone controls it, they can see which sites you visit, redirect you to fake versions of real sites, or use your connection to attack others. A weak router is also an easy way for malware to reach every device on your network.

The problem is that routers are set up once, often by a technician or from a box the internet company sent, and never looked at again. They ship with default passwords, features switched on that most people never use, and software that quietly becomes out of date.

Before you start: how to open the settings

You need to get to your router’s admin page. The usual way is to open a web browser on a device connected to your home network and enter the router’s address, often something like 192.168.1.1 or 192.168.0.1. The address and the default login are normally printed on a sticker on the router. Some routers use a phone app instead. If you cannot find it, your internet provider’s support page will list the steps for your model.

Menu names vary between brands, so use the names below as a guide and look around. If you ever get stuck or lose access, a factory reset restores the defaults, but it also erases your settings, so write down anything you need first.

The checklist

This follows the guidance in CISA’s “Project Upskill” home Wi-Fi module, published for people who may be targeted by online threats. It is a sensible minimum for everybody.

1. Change the router’s admin login. Replace the default username and password with a long, random, unique password that you use nowhere else. This is the password that lets someone change every other setting. Store it in a password manager.
2. Update the firmware. Check for updates regularly and turn on automatic updates if your router supports them. Updates fix security holes. If your router no longer receives updates, replace it.
3. Rename your network, without personal details. Change the default name, and do not include your surname, address or flat number.
4. Use a strong Wi-Fi passphrase. CISA suggests a memorable passphrase of five to seven unrelated words, at least 16 characters long, that you do not use anywhere else. Our passphrase generator can make one.
5. Choose the right encryption. Use WPA3 Personal, or WPA2 with AES. Open networks and older settings (WEP, WPA, and WPA2 with TKIP) are unsafe. If your router cannot do better, ask your internet provider for an upgrade, or buy a new router.
6. Turn off remote management. This stops the router’s settings being changed from the internet.
7. Turn off WPS. Wi-Fi Protected Setup (the “push button” pairing feature) can make unauthorised access easier.
8. Turn off UPnP after setting up your devices. Universal Plug and Play lets devices open doors in your router automatically. CISA notes it can be abused to spread malware and take control of devices.
9. Keep the router somewhere secure. Anyone with physical access can factory reset it and use the default settings.
10. Turn on the guest network. Give it its own strong, unique password.

Smart devices: cameras, speakers, plugs and TVs

Smart home devices are convenient and often poorly protected. Many have weak default passwords, rarely get updates, and can be a stepping stone to the computers and phones on your network.

• Use the guest network for smart devices. CISA suggests putting visitors and smart home devices that only need internet access on the guest network. This keeps them separate from your laptop and phone, so a hacked camera cannot easily reach your files.
• Change default passwords on cameras and anything else with a login, and give each one a unique password.
• Update them through the app. Turn on automatic updates where you can.
• Buy from makers that publish updates and have a clear support period. Avoid unbranded devices with no way to update.
• Turn off features you do not use, such as remote access, microphones and cameras.
• Remove old devices you no longer use. An unused camera still has a connection.

Signs your router might be compromised

• Your browser sends you to odd pages, or shows security certificate warnings on well-known sites.
• Your internet is suddenly much slower for no reason, or the router’s lights flicker when nothing is in use.
• The router’s settings have changed, such as a different DNS server you did not choose, or you are locked out of the admin page.
• Devices you do not recognise appear in the router’s list of connected devices.

If you suspect a problem, factory reset the router, update the firmware immediately, then set it up again with new passwords. Change the passwords for important accounts from a different, trusted network such as your phone’s mobile data. If you are worried about a specific scam, our first 24 hours checklist is a good next stop.

What the settings mean, in plain English

• Firmware: the router’s built-in software. Updating it fixes security holes, the same way phone updates do.
• WPA2 and WPA3: the ways your Wi-Fi is scrambled so others cannot read it. WPA3 is the newer, stronger one.
• SSID: your Wi-Fi network’s name.
• Guest network: a separate Wi-Fi network that gives internet access but keeps devices away from your main one.
• Remote management: lets the router’s settings be changed from outside your home.
• WPS: a quick-pairing feature using a button or short PIN. Convenient, but it can be abused.
• UPnP: lets devices ask the router to open ports automatically. Handy for gaming and cameras, but it can be misused by malware.
• DNS: the “phone book” your devices use to turn website names into addresses. If an attacker changes it, they can send you to fake sites.

Setting up a router the right way from the start

If you have a new router, or a replacement, do these in order before you connect anything else:

1. Connect it and open the admin page. Change the admin password first.
2. Update the firmware straight away, because the version in the box may already be old.
3. Set the Wi-Fi name and passphrase, and choose WPA3 or WPA2-AES.
4. Turn off remote management, WPS and (once your devices are working) UPnP.
5. Set up the guest network and move smart devices and visitors onto it.
6. Turn on automatic updates if they are offered, and note down when you should next check.
7. Take a screenshot or write down your settings, and keep them with your password manager, in case you need to reset later.

If your internet provider supplied the router and manages it remotely, ask them what you can change. You may have fewer options, but the Wi-Fi password and guest network are almost always yours to control.

A word on public Wi-Fi

At cafes, hotels and airports you are sharing a network with strangers. Modern websites encrypt your traffic, so ordinary browsing is much safer than it used to be, but you should still avoid entering sensitive details if you can use mobile data instead. Be careful with networks that look like the venue’s but have a slightly different name, and avoid any “log in to continue” page that asks for more than an email address. Fake Wi-Fi is one way attackers try to sit between you and the internet.

Sources

• CISA: Project Upskill, Module 5: Securing your home Wi-FiAccessed October 12, 2026

Published October 12, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.