How to Secure Your Home Network — Complete Security Checklist

Last Updated: October 2026

Your home network is the gateway to everything you do online — banking, email, smart-home control, work documents, and personal files. Yet most home networks are running with default settings that were designed for convenience, not security. A determined attacker (or even an automated bot) can exploit weak router credentials, outdated firmware, open ports, or unencrypted DNS to intercept your traffic, redirect you to phishing sites, or pivot into your local devices.

This guide is a comprehensive, actionable security checklist. Work through each section to harden your home network against the most common threats. You do not need to be a networking expert — every step is explained in plain language with specific instructions.

1. Change Default Router Admin Credentials

Every router ships with default admin credentials — often something like admin / admin or admin / password. These defaults are publicly documented for every router model. If an attacker can reach your router's admin page (which is possible if they are on your Wi-Fi or if remote management is enabled), they can log in instantly with the default password.

What to do:

1. Log in to your router's admin panel (usually at 192.168.1.1 or 192.168.0.1).
2. Navigate to Administration, System, or Management settings.
3. Change the admin username (if your router allows it — not all do) and password.
4. Use a strong, unique password: at least 16 characters with a mix of uppercase, lowercase, numbers, and symbols. Store it in a password manager.

This single step prevents the most common and most devastating router attack. Without admin access, an attacker cannot change your DNS settings, open ports, install malicious firmware, or monitor your traffic.

2. Use a Strong Wi-Fi Password with WPA3 or WPA2

Your Wi-Fi password is the front door to your network. A weak password can be cracked in minutes using tools that capture the WPA handshake and run offline dictionary attacks. The encryption protocol matters too:

• WEP: Completely broken. Can be cracked in seconds. Never use it.
• WPA (original): Uses TKIP encryption, which has known vulnerabilities. Avoid it.
• WPA2 (AES/CCMP): Strong and widely supported. The minimum you should use.
• WPA3: The latest standard. Uses SAE (Simultaneous Authentication of Equals) instead of the PSK handshake, providing protection against offline dictionary attacks and forward secrecy. Use it if your devices support it.
• WPA2/WPA3 transitional mode: Allows both WPA2 and WPA3 devices to connect. Use this if some of your devices do not support WPA3 yet.

What to do: In your router's wireless settings, set the security mode to WPA3-Personal or WPA2/WPA3-Personal. Set a Wi-Fi password that is at least 16 characters long — a passphrase of random words (e.g., “correct horse battery staple”) is both strong and memorable. Avoid using your name, address, or any dictionary word by itself.

3. Disable WPS (Wi-Fi Protected Setup)

WPS was designed to make connecting devices easier — press a button on the router or enter an 8-digit PIN and the device connects without typing the full Wi-Fi password. Unfortunately, the PIN method has a critical vulnerability: the router validates the first half (4 digits) and second half (3 digits + checksum) of the PIN separately. This reduces the brute-force space from 100 million combinations to roughly 11,000, allowing an attacker to crack the PIN in a few hours with freely available tools like Reaver or Bully.

What to do: Log in to your router and navigate to the WPS or Wi-Fi Protected Setup section. Disable it completely. Even if your router says it has “brute-force protection” or “lockout,” some implementations are buggy and can still be exploited. The safest approach is to turn WPS off entirely.

4. Update Router Firmware Regularly

Router firmware is the software that runs on your router. Like any software, it has bugs and security vulnerabilities that are discovered over time. Manufacturers release firmware updates to patch these vulnerabilities, fix stability issues, and sometimes add new security features. An unpatched router is one of the easiest targets for attackers — many exploits specifically target known vulnerabilities in outdated firmware versions.

What to do:

1. Log in to your router's admin panel.
2. Look for a section called Firmware Update, System Update, or Router Update.
3. Click Check for Updates (or download the latest firmware from the manufacturer's website and upload it manually).
4. If your router supports automatic updates, enable them.
5. Check for updates at least once a month if automatic updates are not available.

Important: Do not interrupt a firmware update in progress. A failed update can “brick” the router (render it non-functional). Connect to the router via Ethernet during the update if possible, and ensure the power supply is stable.

5. Set Up a Guest Network

A guest network is a separate Wi-Fi network with its own SSID and password that isolates guest devices from your main network. Devices on the guest network can access the internet but cannot see or communicate with devices on your primary network — your computers, NAS, printers, and smart-home devices remain hidden.

What to do:

1. In your router settings, find Guest Network or Guest Wi-Fi.
2. Enable it and set a separate SSID (e.g., “MyNetwork-Guest”) and a strong password.
3. Enable client isolation (also called “AP isolation”) so guest devices cannot communicate with each other.
4. Consider setting bandwidth limits on the guest network to prevent guests from consuming all your bandwidth.
5. Optionally set an access schedule so the guest network is only active when needed.

Give the guest network password to visitors, house guests, smart TVs, and any IoT device you do not fully trust. This limits the blast radius if any of those devices are compromised.

6. Disable Remote Management

Remote management (also called “remote administration” or “web access from WAN”) allows you to access your router's admin panel from the internet. While this sounds convenient, it exposes your router's login page to every scanner and bot on the internet. If your admin password is weak (or still the default), attackers can take full control of your router remotely.

What to do: In your router's settings, find Remote Management, Remote Access, or Web Access from WAN and disable it. If you truly need remote access to your router, use a VPN to connect to your home network first, then access the router's admin page from within the VPN tunnel.

7. Use Encrypted DNS (DoH / DoT)

Every time you visit a website, your device sends a DNS query to resolve the domain name to an IP address. By default, these queries are sent in plain text, meaning your ISP, anyone on the same network, and any intermediate network can see exactly which websites you visit — even if the website itself uses HTTPS.

DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt these queries, making them unreadable to eavesdroppers. Most major DNS providers support encrypted DNS:

• Cloudflare: 1.1.1.1 (DoH: https://cloudflare-dns.com/dns-query)
• Google: 8.8.8.8 (DoH: https://dns.google/dns-query)
• Quad9: 9.9.9.9 (DoH: https://dns.quad9.net/dns-query) — also blocks known malicious domains

What to do: You can enable DoH or DoT at two levels:

• Per device: Windows 11, macOS, iOS, and Android all support DoH natively in their network settings. In Windows 11, go to Settings → Network & Internet → Ethernet/Wi-Fi → DNS → set to one of the known DoH servers and select “Encrypted only (DNS over HTTPS).”
• At the router: Some modern routers (ASUS, newer TP-Link, UniFi) support DoH or DoT. Configure the router's DNS settings to use an encrypted upstream server — this protects all devices on the network automatically.

8. Regularly Check Connected Devices

You should periodically review the list of devices connected to your network. Unknown devices could indicate that a neighbor has your Wi-Fi password, a rogue IoT device has connected, or — in a worst-case scenario — an attacker has gained access.

What to do:

1. Log in to your router and find the Connected Devices, Client List, or DHCP Leases page.
2. Review every device. Identify each by its hostname, IP address, and MAC address. Most routers show the device name (e.g., “Johns-iPhone” or “DESKTOP-ABC123”).
3. If you find an unknown device, note its MAC address. You can look up the manufacturer using the first three octets (the OUI) at an online MAC address lookup tool.
4. If the device is unauthorized, change your Wi-Fi password immediately to kick it off and prevent it from reconnecting.
5. Consider enabling MAC address filtering as an additional layer (see below), though this should not be your primary defense.

9. Disable UPnP

UPnP (Universal Plug and Play) allows applications and devices on your network to automatically create port forwarding rules on your router without any authentication. While this makes gaming consoles, media streaming, and voice chat “just work,” it is a significant security risk. Any software on your network — including malware — can use UPnP to open ports and expose services to the internet without your knowledge or consent.

What to do: Log in to your router, find the UPnP setting (usually under Advanced, NAT, or Firewall), and disable it. If specific applications or devices need open ports, set up manual port forwarding rules for only those specific ports. This gives you full control over what is exposed. See our port forwarding guide for step-by-step instructions.

10. Enable the Router's Built-In Firewall

Most routers include a stateful packet inspection (SPI) firewall that monitors incoming and outgoing connections. By default, it blocks unsolicited inbound traffic — only responses to connections your devices initiated are allowed in. This is your first line of defense against port scans, brute-force attacks, and exploitation attempts from the internet.

What to do:

• Verify the firewall is enabled in your router settings (usually under Security or Firewall).
• Set the security level to Medium or High unless you have a specific reason to lower it.
• Enable DoS (Denial of Service) protection if available — this blocks common flood attacks.
• Disable ping response from WAN (also called “WAN ping” or “respond to ping”) to make your router less visible to network scanners.

After configuring the firewall, use our Port Checker tool to scan your public IP and verify that no unexpected ports are open. Any open port is a potential entry point for attackers.

11. Scan for Open Ports

An open port on your public IP address means a service is accessible from the internet. While some open ports are intentional (e.g., a port you forwarded for a game server), unexpected open ports are a security risk. They could be the result of UPnP rules, misconfigured port forwarding, or even malware.

What to do:

1. Visit our Port Checker tool.
2. Your public IP will be detected automatically. Scan common ports like 22 (SSH), 23 (Telnet), 80 (HTTP), 443 (HTTPS), 3389 (RDP), 8080, and 8443.
3. If any ports are open that you did not intentionally forward, investigate immediately. Check your router's port forwarding and UPnP tables.
4. Close any ports you do not need by removing the corresponding port forwarding rules and disabling UPnP.

12. Consider a VPN on Your Router

A VPN (Virtual Private Network) on your router encrypts all internet traffic from every device on your network, routing it through a VPN server before it reaches the open internet. This provides privacy (your ISP cannot see your traffic), security (public Wi-Fi attacks are irrelevant since all traffic is tunneled), and can bypass geographic restrictions.

What to do:

• Check if your router supports VPN client mode. Many ASUS routers, routers running OpenWrt or DD-WRT firmware, and some TP-Link models support OpenVPN or WireGuard client configurations.
• Subscribe to a reputable VPN provider that offers router configuration files (OpenVPN .ovpn or WireGuard .conf).
• Upload the configuration to your router. All traffic from all devices will now be routed through the VPN.
• Be aware that router-level VPN can reduce throughput, especially on routers with slower CPUs. WireGuard is significantly faster than OpenVPN on most hardware.

If your router does not support VPN client mode, you can install a VPN on individual devices or use a dedicated VPN gateway appliance (like a Raspberry Pi running WireGuard) between your router and your devices.

13. Isolate IoT Devices

IoT (Internet of Things) devices — smart bulbs, cameras, thermostats, robot vacuums, smart plugs, voice assistants — are notoriously insecure. Many have minimal security, rarely receive firmware updates, use unencrypted protocols, and communicate with cloud servers you have no control over. If an IoT device is compromised, an attacker can use it as a foothold to attack other devices on your network.

What to do:

• Put IoT devices on a separate network. Use the guest network or, ideally, create a dedicated IoT VLAN if your router supports VLANs. This prevents IoT devices from communicating with your computers, phones, and NAS.
• Disable internet access for IoT devices that do not need it. Many smart-home devices work locally (e.g., Zigbee/Z-Wave hubs, local Home Assistant). Block their internet access at the firewall level if they do not need cloud connectivity.
• Change default passwords on every IoT device. Many smart cameras and home gadgets ship with default credentials that are publicly known.
• Keep IoT firmware updated. Check each device's app or web interface periodically for available updates.

14. Enable Two-Factor Authentication Where Possible

While most home routers do not yet support two-factor authentication (2FA) on the admin panel, some newer models and mesh systems do. If your router supports it, enable it. More importantly, enable 2FA on every online account associated with your network:

• Router manufacturer's cloud account (ASUS AiCloud, TP-Link ID, Netgear account, etc.) — if compromised, an attacker can remotely manage your router.
• ISP account — an attacker could change your DNS, disable your service, or access your billing information.
• Smart-home accounts (Google Home, Amazon Alexa, Apple HomeKit, SmartThings) — these control devices in your home.
• DNS provider account — if you use a third-party DNS service like Cloudflare, NextDNS, or Pi-hole cloud, protect the account with 2FA.

15. Monitor Network Traffic

Monitoring helps you detect anomalies — unusual data transfers, connections to known malicious IPs, or devices sending traffic at odd hours. You do not need enterprise-grade tools to get useful visibility:

• Router traffic logs: Most routers log connections. Enable logging in your router's admin settings and review periodically.
• Pi-hole or AdGuard Home: Running a local DNS sinkhole gives you a dashboard of every DNS query on your network. You can see exactly which domains each device is contacting and block unwanted ones.
• ASUS AiProtection / TP-Link HomeCare: Some routers include built-in intrusion detection and traffic analysis powered by Trend Micro or similar engines.
• Use our SSL Checker to verify that important websites you visit have valid SSL certificates, and our DNS Lookup tool to confirm your DNS is resolving correctly.

16. Physical Security

Do not overlook the physical aspect of network security:

• Place your router in a secure location. Anyone with physical access can reset it to factory defaults (and remove your security settings) by pressing the reset button.
• Disable unused Ethernet ports if your router supports it. An attacker with physical access to an open Ethernet port has a wired connection to your network.
• Label your cables. This makes it easier to audit what is connected and spot unauthorized devices.
• Consider reducing Wi-Fi power. If your Wi-Fi signal extends far beyond your home, neighbors and passersby have more opportunity to attack. Some routers allow you to reduce transmit power.

Complete Home Network Security Checklist

Use this summary as a quick reference. Check off each item as you complete it:

1. Change default router admin username and password.
2. Set Wi-Fi security to WPA3 or WPA2/WPA3 with a strong 16+ character password.
3. Disable WPS.
4. Update router firmware (enable automatic updates if possible).
5. Set up a guest network with client isolation.
6. Disable remote management.
7. Configure encrypted DNS (DoH or DoT).
8. Review connected devices and remove unknowns.
9. Disable UPnP.
10. Enable the router's SPI firewall and DoS protection.
11. Scan for open ports with our Port Checker.
12. Set up VPN on router or individual devices.
13. Isolate IoT devices on a separate network/VLAN.
14. Enable two-factor authentication on all network-related accounts.
15. Monitor network traffic with logs, Pi-hole, or router analytics.
16. Secure the router physically and reduce Wi-Fi transmit power if needed.

Frequently Asked Questions

What is the most important step to secure my home network?

Change the default router admin username and password immediately. Most routers ship with well-known default credentials that attackers know and actively scan for. If someone gains access to your router's admin panel, they control your entire network — they can redirect DNS, open ports, install malicious firmware, or monitor all traffic.

Should I use WPA2 or WPA3 for my Wi-Fi?

Use WPA3 if all your devices support it. WPA3 provides stronger encryption, protects against offline dictionary attacks with SAE (Simultaneous Authentication of Equals), and offers forward secrecy. If some devices only support WPA2, use WPA2/WPA3 transitional mode. Never use WEP or the original WPA — both are trivially broken.

Why should I disable WPS on my router?

WPS has a well-known vulnerability in its PIN-based authentication method. The 8-digit PIN can be brute-forced in hours because the router validates the first and second halves separately, reducing the effective combinations from 100 million to about 11,000. Disabling WPS eliminates this attack vector entirely.

Is it safe to enable UPnP on my router?

UPnP allows devices on your network to automatically open ports on your router without authentication. While convenient for gaming and media apps, it is a significant security risk — malware on any device can use UPnP to expose services to the internet. Disable UPnP and manually forward only the specific ports you need.

How do I check what devices are connected to my network?

Log in to your router's admin panel and look for “Connected Devices,” “Client List,” or “DHCP Leases.” This shows every device's hostname, IP address, and MAC address. Compare the list to devices you recognize. Unknown devices could be neighbors using your Wi-Fi or unauthorized IoT devices.

What is DNS over HTTPS (DoH) and should I enable it?

DNS over HTTPS encrypts your DNS queries inside HTTPS connections, preventing your ISP and network eavesdroppers from seeing which websites you visit. You can enable DoH on individual devices (Windows 11, macOS, iOS, Android all support it) or at the router level. Popular DoH providers include Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9).

Should I set up a guest network?

Yes. A guest network isolates visitors' devices from your main network, preventing them from accessing your computers, NAS, printers, or smart-home devices. Enable client isolation so guest devices cannot communicate with each other either. Use a strong password and consider setting bandwidth limits.

How often should I update my router firmware?

Check for firmware updates at least once a month, or enable automatic updates if your router supports them. Firmware updates patch security vulnerabilities, fix bugs, and sometimes add new features. Unpatched routers are one of the most common entry points for attackers.