Securing a home Wi-Fi network comes down to ten router settings, and most of them take fifteen minutes once: change the admin password, turn on WPA3 or at least WPA2 with a long passphrase, disable WPS and UPnP, move smart devices onto a guest network, update the firmware. None of them requires new hardware. Here is what to do and why, in order of importance.

1. Change the router's admin password

The Wi-Fi password and the router's admin password are different things. The second is often still the factory default (admin/admin or printed on the sticker), and anyone who joins the network can reconfigure the router: change DNS, open ports, intercept traffic. Open the admin page (usually 192.168.0.1 or 192.168.1.1), find System or Administration, and set a long password; the password generator will make one.

2. WPA3 if supported, otherwise WPA2-AES

In the wireless settings choose WPA3 or mixed WPA2/WPA3. On an older router, WPA2 with AES (CCMP). Do not use WEP or WPA-TKIP; both break in minutes. The Wi-Fi passphrase should be 12 characters or more; a phrase of several words is easier to remember than a string of symbols.

3. Disable WPS

WPS (the "connect with one button" feature, or an eight-digit PIN) is a known hole: the PIN can be brute-forced in hours. Turn WPS off in the wireless settings and connect devices with the passphrase.

4. Disable UPnP

UPnP lets any app on the network open ports on the router to the outside without asking you. Convenient for game consoles, dangerous for everything else: a compromised gadget opens itself a door from the internet. Turn it off; if a console or service needs a port, open it manually.

5. A guest network for smart devices and guests

TVs, robot vacuums, bulbs, cameras and speakers are rarely updated and often vulnerable. Create a guest network with client isolation and put every smart device and every guest on it. Then a hacked bulb cannot see your laptop. Keep the main network for phones and computers.

6. Update the firmware

Router vulnerabilities are found regularly, and manufacturers fix them in updates that nobody installs. Look for Update in the admin page; many models have automatic updates, so turn them on. If the router is more than five years old and no longer gets updates, this is the one item where replacing it is worth considering.

7. Turn off remote management

"Manage from the internet," "cloud access," "remote administration": turn them off unless you use them. The admin page should not be reachable from outside.

8. Change the router's DNS

By default the router hands out the ISP's DNS. Set a public resolver, and an encrypted one if the router supports it. Why, and which to pick, is in what is DNS.

9. Check who is connected

The admin page lists clients: device names, addresses, MAC addresses. An unfamiliar device is a reason to change the Wi-Fi password and enable filtering. How to read the list and what to do about strangers is in who is on my Wi-Fi.

10. Hide the network? No. MAC filtering? Optional

Hiding the network name (SSID) does not protect anything: devices broadcast it anyway, and it just makes your life harder. MAC filtering is weak (addresses can be faked) but keeps casual neighbors out; enable it if you do not mind maintaining the list.

What the router does not protect

Even a perfectly configured router encrypts only the stretch between your device and itself. From there, traffic goes to the ISP as is: the ISP sees site names, DNS queries and volume. What exactly is in what can my ISP see. To cover the whole house at once, a VPN goes on the router itself or on a second router behind it; the trade-offs are in VPN on router vs on each device.

Checklist

  • Admin password changed, long.
  • WPA3 or WPA2-AES, Wi-Fi passphrase 12+ characters.
  • WPS off, UPnP off.
  • Guest network with isolation for smart devices.
  • Firmware updated, auto-update on.
  • Remote management off.
  • DNS set to a public resolver.
  • Client list reviewed.

404 VPN provides WireGuard configurations for routers that support it and apps for everything else, with a kill switch if the tunnel drops. Details on the security page; get started here.