Home tech

How to secure your home Wi-Fi network

By Roof & Router Team. Updated October 19, 2026.

Skip to what to buy (4 types) ↓

How do you secure your home Wi-Fi network?

The FTC, CISA and NSA give nearly the same list. Here it is as a checklist, roughly in order of impact:

The FTC also says to log out of the router’s admin account when you are done changing settings. CISA adds that you should keep the router somewhere others can’t easily reach it. NSA advises rebooting your router, phones and computers once a week.

How do you log in to your router?

Most changes happen in the router’s app or its web page. Some common addresses from manufacturer support pages:

• NETGEAR: routerlogin.net (default user name is admin)
• TP-Link: tplinkwifi.net or 192.168.0.1
• ASUS: asusrouter.com or the router’s LAN IP address
• eero: the eero app

If your internet provider supplied the router, the address and login are usually on a label on the device. While you’re there, check that the router is in a good spot. See our guide on where to place a Wi-Fi router.

WPA2 vs. WPA3: which should you use?

WPA stands for Wi-Fi Protected Access. It is the encryption that scrambles traffic between your devices and the router and decides who can join.

Why WPA3 is better, per the Wi-Fi Alliance:

• Harder password guessing. WPA3 Personal uses a handshake called SAE (Simultaneous Authentication of Equals). An attacker can’t record the handshake and crack the password offline. Each guess requires a fresh, live attempt.
• Forward secrecy. Traffic recorded today can’t be decrypted later, even if someone learns the password.
• Protected management frames (PMF) are required in every WPA3 mode. PMF protects the control messages between devices and the router.

If an older device can’t connect: pick the “WPA2/WPA3” (sometimes called transition) mode. NSA recommends this, and the Wi-Fi Alliance says WPA2 devices can keep using the same password in that mode. CISA says that if WPA3 isn’t available, use WPA2 AES, which may also be called WPA2 Pre-Shared Key (PSK).

If your router only offers WEP or WPA: the FTC says to update the router’s software and check again. If WPA2 or WPA3 still doesn’t show up, consider a new router.

How strong should your Wi-Fi and admin passwords be?

Your router has two passwords, and the FTC says to change both:

• The Wi-Fi password lets devices join the network. NSA recommends a passphrase of at least 20 characters.
• The admin password lets someone change the router’s settings. For passwords in general, the FBI recommends strong, unique, random ones of 16 to 64 characters and says to disable password hints.

The FTC says not to use your name, address or router brand in login names or passwords. CISA says not to use the same username and password for your router account and admin account. The FCC adds that unauthorized users may be familiar with default admin passwords, so change it as soon as the router is installed.

To change the admin password: on ASUS routers, go to Administration, then the System tab. ASUS recommends more than 10 characters with capital letters, numbers and special characters, and no runs like 1234567890 or qwertyuiop. Other brands put it in a similar Administration or System menu.

Should you turn off WPS?

Yes. WPS (Wi-Fi Protected Setup) lets a device join by pressing a button or entering an 8-digit PIN instead of the password. The FTC and CISA both say to turn it off.

The reason is a known flaw. A 2011 CERT/CC advisory found that the router tells an attacker when the first half of the PIN is right, and the last digit is only a checksum. That cuts the possibilities from 10^8 (100 million) to about 10^4 + 10^3 = 11,000 guesses. The advisory’s main workaround is to disable WPS. The advisory says vendors may label the setting “WiFi Protected Setup,” “router PIN” or “external registrar.”

While you’re in the settings, the FTC, CISA and NSA also say to turn off:

• UPnP (Universal Plug and Play): lets devices open connections on their own. NSA says disabling it closes holes attackers could use.
• Remote management: lets anyone change router settings over the internet. The FBI found a new version of the TheMoon malware on old routers that had remote administration turned on.

How do you update router firmware?

Firmware is the router’s built-in software. Updates fix security holes.

1. Turn on automatic updates if your router offers them. NSA recommends it, and CISA notes that some routers offer it.
2. Otherwise update by hand. On NETGEAR routers, log in at routerlogin.net, go to Advanced (or Settings), then Administration, then Firmware Update or Router Update, and click Check. NETGEAR says not to turn off the router until it finishes restarting.
3. Mesh systems often handle this for you. eero says its units can update automatically overnight. Updates take about 15 to 20 minutes, with about 90 seconds of downtime while they reboot. You can set a preferred update time in the app.

The FTC suggests registering your router with the manufacturer so you hear about updates. If your internet provider supplied it, ask whether it sends updates automatically.

When updates stop, replace the router. NSA says routers should be replaced when they reach end of life for support. The FBI says routers dated 2010 or earlier likely no longer get updates. Criminals have hijacked those routers to run proxy services that hide their identity. NSA also suggests using your own router behind an internet provider’s modem. See should you buy your own modem and is Wi-Fi 7 worth it if you’re shopping.

Should you use a guest network for smart devices?

Usually yes. CISA says to connect smart home and other IoT (internet of things) devices to your guest Wi-Fi “if internet access is the only thing they require.” NSA goes further: at minimum, separate your network into primary Wi-Fi, guest Wi-Fi and an IoT network. That keeps a weak smart plug or camera away from your laptops and phones.

Give the guest network its own name and password, the FTC says. That limits who knows your main password and keeps malware on a visitor’s phone off your primary network. To look up or share a password you’ve forgotten, see how to find your Wi-Fi password.

As general advice, if a smart device or hub stops working or becomes hard to control after you move it to the guest network, check the device’s setup guide for its network requirements. Our Matter vs. Zigbee vs. Z-Wave guide explains how hubs connect.

Unwrapping new smart devices for the holidays? The FTC says to change any default username and password that came on the device, update it regularly, and turn off features you won’t use. It also says to disconnect older devices you no longer use. For cameras, see security camera storage options.

How can you tell if someone is on your Wi-Fi?

Check your router’s list of connected devices. TP-Link’s instructions are typical:

• In the app: open Tether, tap Local Device, then Clients. In the Deco mesh app, tap your network, then Clients.
• On the web page: log in at tplinkwifi.net and open Network Map, or the DHCP Client List for MAC addresses.

A MAC address is a hardware ID made of six pairs of characters, like A4:C3:F0:XX:XX:XX. Match unfamiliar entries against your own devices before blocking anything.

If you find a stranger: block the device, then change your Wi-Fi password. TP-Link says some older routers let a blocked device stay connected without internet, and a new password kicks everyone off. Reconnect only your own devices. A blocked device can reappear if it uses a randomized MAC address. TP-Link suggests checking the list monthly.

The FBI lists other warning signs of a hacked router: overheating, connection problems, and settings you didn’t change. If you see these, update the firmware, change the password and reboot.

If your Wi-Fi feels sluggish, an intruder is only one possible cause. See why is my Wi-Fi slow, and mesh Wi-Fi vs. an extender for weak spots.