How to Secure Your Home Wi-Fi (2026)

Last updated: November 1, 2026

Your home Wi-Fi router is the front door to every phone, laptop, smart TV and doorbell camera in your house, yet most people never change a single setting after the installer leaves. If you’ve been wondering how to secure home Wi-Fi without becoming a network expert, this guide walks you through the eight changes that matter most, in plain English. Every step follows advice from the FCC, CISA and the UK’s NCSC, plus TP-Link, NETGEAR and ASUS help pages.

Quick answer: Sign in to your router’s settings page or app. Change the router’s admin password, and give your network a new name that doesn’t reveal who you are or which router you have. Set the security mode to WPA3 Personal (or WPA2/WPA3, or WPA2 Personal with AES if older devices can’t connect), and use a long, unique Wi-Fi password. Then turn on automatic firmware updates, switch off WPS, remote management and (if you don’t need it) UPnP, put visitors and smart gadgets on a guest network, and check the list of connected devices now and then.

Before You Start

You’ll need a device connected to your router (a laptop on an Ethernet cable is ideal, since changing Wi-Fi settings will disconnect wireless devices), your router’s admin login (often printed on a sticker on the router), and 15 minutes when nobody is mid-call, because the router may restart. Apple also recommends backing up your router’s current settings first, if your router offers that option.

If your router came from your internet provider (common with Xfinity, BT, Sky, Virgin Media, Rogers, Bell and others), some settings may be locked or live in the provider’s app instead. Change what you can, and ask your provider about the rest.

Step 1: Sign In to Your Router

There are two ways in: a web page in your browser, or the router maker’s app.

1. Find the address. Look at the sticker on your router first. Common addresses are 192.168.0.1, 192.168.1.1, 192.168.1.254 and 10.0.0.1. Many brands also use a web address that only works on your home network, such as tplinkwifi.net (TP-Link), routerlogin.net (NETGEAR) or www.asusrouter.com (ASUS).
2. Type it into your browser’s address bar while on your home network.
3. Sign in with your admin username and password.

Prefer an app? TP-Link uses Tether (or Deco for mesh systems), NETGEAR uses Nighthawk, ASUS uses the ASUS Router app, and Google Nest Wifi uses Google Home. If you can’t find your router’s address, our guide on how to see who is connected to your Wi-Fi shows how to look it up on Windows, Mac, iPhone and Android.

Step 2: Change the Router Admin Password

Your router has two different passwords, and people often mix them up:

• The admin password protects the router’s settings page.
• The Wi-Fi password (sometimes called the network key or passphrase) is what you type to join the network.

Default admin logins are widely known. NETGEAR’s help pages, for example, list the default as admin and password. CISA and the FCC both say to change the default admin password.

1. Look for a section such as Administration, System or Management (names vary by brand).
2. Enter the current password, then a new one. Make it long (a phrase of four or more random words works well) and don’t reuse a password from any other account.
3. Save it in your password manager. If you’re not sure your existing passwords are safe, our guide on how to check if your password was leaked shows free ways to check.

Step 3: Rename Your Network (SSID)

Your network name, or SSID, is the name everyone nearby sees in their Wi-Fi list. Default names like “NETGEAR42”, “TP-Link_1A2B” or an internet provider’s name tell an attacker exactly what equipment you have. CISA warns that this makes it easier to look up known weaknesses for that model.

1. Open the Wireless or Wi-Fi settings section.
2. Change the network name to something neutral. Avoid your surname, house number, street or anything that identifies you.
3. Apple recommends using the same name for every band (2.4 GHz, 5 GHz and 6 GHz) so devices connect reliably and can switch between bands.
4. Save, then join the new network name on each device.

Should you hide your network name? No. Apple says hiding the SSID doesn’t stop anyone detecting the network, and it can make your devices reveal your network’s name when you’re out. Strong encryption does the real work.

Step 4: Use WPA3 or WPA2-AES Encryption

Encryption scrambles everything sent over your Wi-Fi so neighbors can’t read it, and it’s what makes your network ask for a password. The FCC notes that routers often come out of the box with encryption turned off, so check.

1. In the Wi-Fi settings, find Security, Security mode, Authentication or Encryption.
2. Choose the best option your router offers, in this order:
   • WPA3 Personal (sometimes shown as WPA3-SAE): the newest and most secure option for home networks.
   • WPA2/WPA3 Personal (also called “transition” or “mixed WPA2/WPA3” mode): uses WPA3 for devices that support it and lets older devices connect with WPA2.
   • WPA2 Personal (AES): fine if WPA3 isn’t available. If there’s a separate encryption or cipher option, pick AES (sometimes labeled CCMP).
3. Avoid WEP, WPA (on its own), TKIP and WPA/WPA2 mixed, and never leave the network Open. Apple lists all of these as weak settings. CISA says that if your router only offers WEP, WPA or WPA2-TKIP, ask your provider for an upgrade or consider a new router.
4. Set a long Wi-Fi password. A random phrase of several words is easy to type on a TV remote and hard to guess.
5. Save, then reconnect. Apple says you may need to “forget” the network on each device and rejoin.

Step 5: Update the Router’s Firmware (and Turn On Auto-Updates)

Firmware is the software that runs your router. CISA calls regular updates one of the most effective steps for home network security, because they fix holes attackers already know about. Paths from the makers’ help pages:

• TP-Link (tplinkwifi.net): Cloud-enabled models show an Update icon at the top right when new firmware is ready, or use Tether: More > System > Firmware Update. Models without Cloud support need a manual upload at Advanced > System > Firmware Upgrade. See TP-Link’s firmware update guide.
• NETGEAR (routerlogin.net): ADVANCED > Administration > Firmware Update (called Router Update on some models), then Check (NETGEAR’s guide).
• ASUS (asusrouter.com): Administration > Firmware Upgrade, where you can also turn on Auto Firmware Upgrade and pick a time (ASUS’s guide).

Turn on automatic updates if available (Apple recommends it), don’t unplug the router mid-update, and only get firmware from the router itself or the maker’s official site, never from an email link.

Is your router too old? If the maker shows no updates for years, or lists it as end-of-life, it may no longer get security fixes. Consider replacing it.

Update your other devices too. If an iPhone update fails for lack of storage, see our guide to free up space on iPhone.

Step 6: Turn Off WPS, Remote Management and UPnP

These features add convenience but open doors you probably don’t need. The FTC and CISA suggest switching them off unless you need them.

WPS (Wi-Fi Protected Setup)

WPS lets a device join with a button press or an 8-digit PIN instead of the password. CISA explains that a design flaw makes the PIN far easier to guess than it looks.

1. Look under Wireless, Wi-Fi or Advanced settings for WPS. On many TP-Link routers it’s at Advanced > Wireless > WPS.
2. Turn WPS off (or at least turn off the PIN method) and save.

On some routers, WPS is unavailable when WPA3 is selected.

Remote management

Remote management (or remote access) lets someone reach the router’s settings from the internet. CISA advises turning it off so only someone on your network can change settings. Look for it under Administration, System or Advanced settings.

UPnP (Universal Plug and Play)

UPnP lets devices open connections through the router’s firewall automatically, and CISA warns that malware can abuse it. The NCSC notes that turning it off may affect some online games, media servers and smart devices.

1. Find UPnP, usually under Advanced, NAT or Network settings.
2. If nobody at home relies on online gaming or a media server, turn it off.
3. If a device needs UPnP during setup, CISA says you can turn it off again afterwards.

While you’re in the advanced settings, check that the router’s built-in firewall is on, and switch off DMZ if it was turned on and you don’t know why.

Step 7: Set Up a Guest Network

A guest network is a second Wi-Fi network with its own name and password. The UK’s Northern Ireland Cyber Security Centre suggests using it for visitors, so you never hand out your main password, and for smart gadgets such as speakers, bulbs and plugs, so a hacked gadget is kept apart from devices holding private data.

1. Look for Guest Network or Guest Wi-Fi in your router settings or app.
2. Turn it on, give it a different name and its own strong password, and use WPA3 or WPA2 security just like your main network.
3. If your router has an option that controls whether guests can reach your local network or see each other (the wording varies by brand, and it’s sometimes called client or AP isolation), keep guests cut off from your local network.

One catch: some smart devices need your phone on the same network during setup, and some router apps (TP-Link’s Tether, for example) don’t work over the guest network.

Step 8: Check Which Devices Are Connected

The final step is to look at the list of devices on your network and make sure you recognize them. Your router’s settings page or app shows this list, usually with each device’s name, IP address and MAC address. NETGEAR calls it Attached Devices, ASUS shows it under Network Map > Clients, and TP-Link’s Tether app shows it under Clients.

Unknown names are often your own gadgets. If you can’t identify something, change your Wi-Fi password and block it. We walk through it, including the limits of blocking by MAC address, in How to See Who Is Connected to My Wi-Fi (and Kick Them Off).

Extra Steps Worth Knowing About

• Don’t rely on MAC address filtering. Apple recommends leaving it off, because MAC addresses can be copied and phones now use private addresses on each network.
• Mind where the router sits. CISA suggests adjusting router placement and, where possible, signal strength so less of your Wi-Fi spreads outside your home.
• Protect your devices too. A secure router can’t stop malware already on a laptop. Our guide to fixing a slow Windows 11 laptop shows how to run a full Windows Security scan.

Your Home Wi-Fi Security Checklist

Setting	What to choose	Why
Admin password	Long, unique, saved in a password manager	Default logins are widely known
Network name (SSID)	Neutral, no name, address or router brand	Doesn’t reveal your equipment or identity
Security mode	WPA3 Personal, WPA2/WPA3, or WPA2-AES	WEP, WPA and TKIP are outdated
Firmware	Latest version, auto-update on	Fixes known security holes
WPS	Off	The PIN method can be guessed
Remote management	Off	Keeps settings off the internet
UPnP	Off unless a game or device needs it	Malware can use it to open ports
Guest network	On, with its own password	Keeps visitors and gadgets separate
Connected devices	Check every few months	Spots devices you don’t recognize

Troubleshooting

Some devices won’t connect after switching to WPA3

• Older devices may not support WPA3. Switch to WPA2/WPA3 mode so newer devices still use WPA3, while older ones connect with WPA2.
• On the device, forget the network and join it again with the new password.

You can’t remember the router admin password

• Check the sticker on the router (if you never changed it) and your password manager.
• Otherwise, the usual fix is a factory reset using the router’s reset button (check the maker’s instructions). It wipes all settings, so you’ll need to redo this guide. If the router is from your provider, contact them first.

A setting in this guide doesn’t exist on your router

• Menu names vary by model and firmware. Search the maker’s support site for your exact model, or ask your provider, since some provider routers hide advanced settings.

A game or smart device stopped working after you turned off UPnP

• Turn UPnP back on. If that fixes it, either leave it on or set up port forwarding for just that device using the maker’s instructions.

The Short Version

Securing your home Wi-Fi takes no special skills: a new admin password and network name, WPA3 or WPA2-AES with a strong password, current firmware, WPS and remote management off, a guest network, and an occasional look at connected devices.

Official sources: CISA: Home Network Security and Apple Support: Recommended settings for Wi-Fi routers and access points. More guides like this are in our Security & Privacy section.

Frequently Asked Questions

See all our router and home network guides on the Home Wi-Fi & Router Security page.

Related guides

• How to See Who Is Connected to My Wi-Fi (and Kick Them Off)
• How to Check if Your Password Was Leaked (2026)
• Windows 11 Laptop Slow? 9 Fixes That Work (2026)