How to secure your home Wi-Fi and router: 9 steps

Your router is the front door to your home network. Online banking, work e-mails and the picture from the camera in your living room all pass through it. Yet many routers still run the factory settings from the day the technician plugged them in. You can do most of the steps below yourself in half an hour; all you need is a computer or phone connected to your home network.

How to get into the router settings

You will find the admin address and the default login details on the label under the router or in the manual. It is usually an address like 192.168.0.1 or 192.168.1.1, which you type into the browser. Some manufacturers offer a mobile app instead of a web admin page. If your router comes from your internet provider, some settings may be locked; it is worth asking your provider’s customer support team which settings you can change.

1. Change the admin password

The password for managing the router is not the same as the Wi-Fi password. Default passwords are often the same for a whole series of devices or easy to look up. Set your own long password and keep it in a password manager or another safe place. Anyone who knows the admin password can redirect your traffic or switch off the security.

2. Turn on WPA3 or at least WPA2 encryption

In the wireless network settings, choose WPA3 security. If an older device does not support it, use the mixed WPA2/WPA3 mode or WPA2 alone with AES encryption. WEP, WPA and WPA2 with TKIP are outdated, so do not use them. An open network without a password does not belong in any home.

3. Set a strong Wi-Fi password

Length matters more than special characters. Several random words in a row, for example three or more, work well. Do not write the password on a note stuck to the router and do not use your name, address or date of birth. If former tenants, tradespeople or neighbours know the password, change it.

4. Switch off WPS

WPS lets you connect a device by pressing a button or entering an eight-digit PIN. The PIN is a known weakness, because on many routers it can be guessed by trial and error. If you do not use the feature, switch it off in the settings. You then connect devices the usual way, with the password.

5. Update the firmware

Manufacturers fix security flaws with firmware updates. In the admin page, look for Update, Firmware or System and turn on automatic updates if the router offers them. When the manufacturer no longer releases updates for your model, the router has reached the end of its life. Even if it still works, it makes sense to replace it, because nobody will fix new flaws.

6. Separate guests and smart devices

Most routers can create a guest network. Visitors get internet access but cannot see your computers, printer or shared drives. You can put smart bulbs, plugs or the TV on the same separate network. If one of these devices had a security flaw, an attacker would find it much harder to get from it to your computers and documents.

Take special care with cameras, baby monitors and other devices with a microphone or picture. When installing them, change the default password, update the app and the firmware and turn on two-factor authentication in the manufacturer's app if it is offered. A device that no longer gets updates should not be reachable from the internet.

7. Switch off what you do not need

• Remote management from the internet: the router should only be manageable from your home network unless you have a specific reason.
• UPnP: it opens ports for apps and games automatically. If you do not need it, switch it off and open ports manually only for specific devices.
• Port forwarding you no longer use, for example for an old camera or a game server.

8. Give the network a sensible name

The network name (SSID) should not reveal your name, flat number or router model. Hiding the network name does not improve security: the network can still be found with ordinary tools, and your devices keep looking for it even when you are away from home. Likewise, MAC address filtering is more of a nuisance than protection, because phones and computers now often use a different, random address for each network.

9. Check the connected devices now and then

The router's admin page shows a list of connected devices. Go through it from time to time and check that you recognise them all. An unknown device may be a forgotten smart plug, but also a neighbour who knows your password. If you are not sure, change the Wi-Fi password and reconnect your devices one by one.

A router from your provider

If the router is on loan from your internet provider, ask whether the provider installs updates remotely. The Wi-Fi password and other settings are still up to you. If you cannot change important options, you can connect your own router or mesh system behind the provider's router. They need to be set up correctly, though, so that the networks do not interfere with each other.