How to secure your home Wi-Fi: a 9-step checklist

The router settings that keep strangers and malware off your network, in order of importance, plus what to do if you think your Wi-Fi was hacked.

Some links are affiliate links, and we may earn a commission at no extra cost to you.

The checklist

Work through these in order. The first five take about 15 minutes in most router apps.

1. Change the router's admin password. The password you use to log in to the router, not the Wi-Fi password. Many routers ship with a default printed on the label.
2. Use WPA3, or WPA2 with AES. Find it under wireless security. Avoid WEP, WPA and TKIP.
3. Set a long Wi-Fi password. Twelve or more characters. A short phrase is easier to type and harder to guess.
4. Turn on automatic firmware updates. Most mesh systems and ISP gateways update on their own; older routers need you to check.
5. Turn off WPS and remote management. Both are common ways in. Use the maker's app instead of remote web access.
6. Put guests and smart devices on a guest network. It keeps visitors and cheap cameras or plugs away from your computers and phones.
7. Rename your network. Leave your name, address and router model out of the network name.
8. Check connected devices every few months. Remove anything you don't recognize, then change the Wi-Fi password.
9. Replace routers that no longer get updates. Check the maker's end-of-life list for your model.

How to get into your router settings

Most routers and ISP gateways have an app: the Xfinity app, My Spectrum, Smart Home Manager for AT&T, My Fios, or the maker's app for eero, Nest, Deco, Orbi and ASUS. For other routers, type the address on the router's label, often 192.168.0.1 or 192.168.1.1, into a browser on a device connected to it.

Extra protection worth turning on

Once the basics are done, these add another layer for every device on your network.

• Your router's security features. Many gateways and mesh systems block known malicious sites; some charge for it.
• A filtering DNS service such as Quad9 or Cloudflare 1.1.1.1 for Families blocks known malware and scam domains for every device.
• A VPN on public Wi-Fi. See do you need a VPN.
• Identity protection. Services such as Aura bundle a VPN, antivirus and credit monitoring if you want them in one app.

If you think your network was hacked

Start over with the router rather than trying to find what changed.

• Reset the router to factory settings with the button on the back, then set it up again with new passwords.
• Update the firmware before reconnecting devices.
• Change passwords for email and banking from a device you trust.
• Replace the router if it no longer gets updates.

Next steps: set up a guest network, and if your router is old, see the best Wi-Fi routers.

Wi-Fi security settings, explained

Your router's security setting decides how well your Wi-Fi traffic is protected. Here is what each option means.

Signs your router may be hacked

Hacked routers rarely announce themselves. Watch for these signs.

• You can't log in with your admin password.
• Websites redirect to pages you didn't ask for, or pop-ups appear on several devices at once.
• The router's DNS settings point to servers you didn't choose.
• Unknown devices appear in the connected list after you change the Wi-Fi password.

Less useful tips you'll see elsewhere

Some common advice adds hassle without adding much security.

• Hiding your network name doesn't stop anyone with free scanning apps, and it makes joining harder.
• MAC address filtering is easy to get around and breaks when phones use private addresses.
• Lowering transmit power barely limits range for an attacker and weakens your own signal.

Questions