Is Your Wi-Fi Safe? A Simple Home Network Security Checklist

Your router is the front door to every device in your home, and most people haven't opened its settings since the day it was installed. The good news: making it safe takes about twenty minutes, and you only have to do most of it once. Work through the checklist below with the router's admin page or app open.

The stakes have grown. The average US internet household now has 17.8 connected devices, according to Parks Associates, and every one of them sits behind that same router.

Before you start: get into the router

Look at the label on the router, or in its app. TP-Link routers, for example, open at tplinkwifi.net or 192.168.0.1 in a browser; Google Nest Wifi and other mesh systems are managed from a phone app instead. If your internet provider supplied the router, its support pages will have the address.

Here's what you're aiming for:

The router settings to look for

Security mode

WPA3 Personal, or WPA2/WPA3 mixed if older devices need it

Wi-Fi password

Long passphrase; the NSA suggests at least 20 characters

Admin password

Changed from the default, different from the Wi-Fi password

WPS

Off

UPnP

Off, unless something you use needs it

Remote management

Off

Firmware updates

Automatic, if offered

Guest or IoT network

On, for smart devices and visitors

The checklist

1. Use WPA3, or at least WPA2. In the wireless security settings, choose WPA3 Personal. If some older devices can't connect, use the WPA2/WPA3 mixed mode. The FTC calls WEP and the original WPA outdated and not secure; if your router offers nothing newer, it's time to replace it. WPA3 has been required for all new Wi-Fi certified devices since July 1, 2020, so anything bought since then should support it.

2. Set a long Wi-Fi password. Length beats cleverness. The NSA's home network guidance recommends a passphrase of at least 20 characters. Four or five unrelated words will do it and are easy to type on a TV remote.

3. Change the admin password. This is a different password from the Wi-Fi one: it protects the router's settings. Older routers often shipped with "admin" as both username and password, which is why the UK has banned guessable default passwords on new connected devices since April 2024. If yours still uses the default, change it now and store it in your password manager.

4. Turn off WPS. Wi-Fi Protected Setup lets devices join with a button or an eight-digit PIN. The PIN design has a well-known flaw that cuts the number of guesses an attacker needs from about 100 million to about 11,000, and many routers don't lock out repeated attempts. You'll barely miss it.

5. Turn off remote management and UPnP. Remote management lets someone change your router's settings from the internet; unless you really need it, switch it off. UPnP lets devices on your network open ports automatically. The FTC and CISA both advise turning it off unless you have a specific need for it.

6. Switch on automatic updates. Router makers fix security holes through firmware updates, but only if they get installed. On a Netgear router you'll find the setting under ADVANCED, Administration, Router Update; Google's Nest Wifi and Google Wifi update themselves automatically. If your router can't update automatically, put a reminder in your calendar to check every few months.

7. Make sure the firewall is on. Almost every router has one, and it's usually on by default. Check anyway, because CISA notes that some firewall features may be turned off by default.

Give smart devices their own network

Smart TVs, cameras, plugs and speakers are convenient, but you have far less control over their security than over your laptop's. The NSA recommends splitting your home network at least into main, guest and IoT networks, so that a compromised gadget can't reach your computers.

Most routers make this easy with a guest network. Create one with its own password, connect your smart devices and visitors to it, and keep your laptops, phones and NAS drive on the main network.

Know when the router has to go

A router that no longer gets updates will eventually be broken into, and it may never show it. In May 2025 the FBI warned that criminals were taking over end-of-life routers to sell as proxies, and that routers from 2010 or earlier likely no longer receive updates. The affected models included a long list of older Linksys routers.

In April 2026 the FBI and partner agencies reported a Russian military intelligence campaign that hijacked TP-Link routers and changed their DNS settings, silently redirecting the traffic of every device behind them. The Justice Department said compromised routers were found in more than 23 states. The FBI's advice was the same checklist as above: update, replace unsupported devices, change default passwords, disable remote management.

So while you're in the settings, look at the DNS servers too. If they show addresses you don't recognize and didn't set, reset the router and update it. If you'd like DNS that also blocks known malicious sites, Quad9 (9.9.9.9) and Cloudflare for Families (1.1.1.2) are free options you can enter in the router.

Finally, if the maker no longer lists firmware updates for your model, or it doesn't support WPA2 at least, replace it. A new router is cheaper than cleaning up after one that's been quietly compromised.

Questions readers ask

Should I hide my Wi-Fi network name?

No. The NSA's home network guidance says hiding the network name adds no real security. Change the name from the default instead, and don't use your surname or address.

Is the router my internet provider gave me good enough?

Often yes, as long as it supports WPA3 or at least WPA2 and your provider keeps it updated. Ask them whether they push firmware updates automatically. If they don't, or the model is old, consider your own router.

How do I know if my router has been hacked?

Warning signs the FBI lists include the router overheating, connection problems and settings you don't recognize. Also check that its DNS settings haven't been changed to servers you didn't choose. If in doubt, reset it to factory settings, update the firmware and set it up again.

How often should I restart my router?

The NSA suggests rebooting your router, and your phones and computers, at least once a week.