Your home WiFi network is the gateway to every device in your house — your computers, phones, smart TVs, security cameras, and smart home devices. A compromised network lets attackers monitor your traffic, access shared files, intercept passwords, and even pivot to attack devices on your internal network. This guide covers every step to lock it down.
Step 1: Change the default router admin password
Every router ships with a default admin username and password — usually something like admin/admin or admin/password. These defaults are publicly documented. Anyone on your network (including someone who has guessed your WiFi password) can log into your router's admin interface and change its settings.
How to fix it: Log into your router (usually at 192.168.1.1 or 192.168.0.1), find the admin password setting, and change it to a unique 16+ character password. Save this in your password manager.
Step 2: Use WPA3 (or WPA2 with a strong password)
The security protocol your router uses determines how resistant your network is to password-guessing attacks.
- WPA3 — Best. Eliminates offline dictionary attacks entirely. Enable if your router supports it.
- WPA2 — Secure with a strong password (16+ characters, mixed types). Vulnerable to offline brute-force if the password is weak.
- WPA — Outdated. Avoid.
- WEP — Completely broken. Replace your router if this is the only option.
Find this setting in your router's wireless security section. Use WPA3 or WPA2/WPA3 transition mode. Never use WPA or WEP.
Step 3: Set a strong WiFi password
Even with WPA2, a 16+ character random password is effectively uncrackable by brute force. A GPU cluster testing a billion passwords per second would need billions of years to crack a truly random 16-character password.
Avoid: dictionary words, names, addresses, common substitutions (p@ssw0rd), birth years, and any password under 12 characters.
Use: a randomly generated password from our WiFi Password Generator, or a 6-word Diceware passphrase.
Step 4: Create a separate guest network
When guests connect to your main WiFi, they share your network with your computers, NAS drives, printers, and smart home devices. A compromised guest device can attack other devices on the same network.
Most modern routers support a guest network — a separate SSID on the same router that's isolated from your main network. Guests get internet access but can't reach your main devices.
How to enable it: Look for "Guest Network" or "Guest WiFi" in your router's wireless settings. Give it a different name and password from your main network. Enable "Client isolation" or "AP isolation" to prevent guest devices from seeing each other.
This also applies to IoT devices (smart bulbs, thermostats, cameras). Put them on the guest network or a dedicated IoT SSID to isolate them from your computers.
Step 5: Disable WPS
WPS (Wi-Fi Protected Setup) lets devices connect by pressing a physical button or entering an 8-digit PIN. The PIN method has a well-known vulnerability: the 8-digit PIN is verified in two 4-digit halves, reducing the search space from 10⁸ to 10⁴ + 10³ = 11,000 combinations. Tools like Reaver can crack WPS PINs in hours.
Find "WPS" in your router settings and disable it. You don't need it — entering a password manually is slightly less convenient but far more secure.
Step 6: Update your router firmware
Router firmware vulnerabilities are regularly discovered and patched. Many users never update their router firmware, leaving known vulnerabilities open for years.
How to update: Log into your router's admin interface and look for a "Firmware Update" or "Software Update" section. Many modern routers support automatic updates — enable this if available. If your router is more than 5 years old and no longer receives firmware updates, consider replacing it.
Step 7: Review connected devices
Your router's admin interface shows every device currently connected to your network. Periodically review this list to spot unfamiliar devices.
Look for "Connected Devices," "Client List," or "DHCP Leases" in your router settings. If you see a device you don't recognize, change your WiFi password immediately — this forces all devices to re-authenticate.
Step 8: Use a strong DNS provider
Your DNS provider knows every website you visit. Your ISP's default DNS often logs this data and may sell it. Switching to a privacy-focused DNS provider like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) offers better privacy and can block malicious domains at the DNS level.
Set custom DNS in your router's WAN or Internet settings, not just on individual devices — this protects everything on your network.
Step 9: Consider your router's physical location
WiFi signal extends outside your home. A router placed near a window or exterior wall broadcasts your network further, increasing the range within which someone could attempt to connect. Placing your router near the center of your home minimizes outdoor signal and maximizes indoor coverage.
WiFi security checklist
Frequently asked questions
How can I tell if someone is using my WiFi without permission?
Log into your router's admin interface and check the connected devices list. Compare against the devices you own. You can also use a network scanner app (like Fing) on your phone — it shows every device on your network with its IP address, MAC address, and often its device name.
Does hiding my WiFi SSID make it more secure?
Only marginally. Hiding your SSID (making your network not broadcast its name) adds a small layer of obscurity, but any WiFi scanner can detect hidden networks. An attacker targeting your network will find it. A strong password provides far more security than SSID hiding.
Should I use MAC address filtering?
MAC filtering adds administration overhead without meaningful security. MAC addresses are broadcast in plain text and can be spoofed in seconds by any attacker who sees a legitimate device's MAC address on your network. It's not worth the maintenance burden for the minimal security benefit.
How often should I change my WiFi password?
There's no need to change it on a schedule if it's strong. You should change it when: you suspect it was compromised, you see unfamiliar devices connected, you've shared it with someone who no longer needs access, or you're changing routers. A strong random 16+ character password doesn't become weaker over time if it hasn't been exposed.