How to Secure Your Home Wi-Fi Router: The 9-Setting Checklist That Actually Matters

If you want to secure your Wi-Fi router, start with this uncomfortable fact: the box your internet provider gave you, or the one you bought in 2021 and never thought about again, is the most powerful computer in your house. Every phone, laptop, camera, doorbell, TV, and speaker you own passes its traffic through it. And it ships with settings chosen for convenience, not safety. The good news is that locking it down is a one-afternoon job, and almost all of it is in nine settings you will never touch again.

The 9-setting checklist, up front

1. Change the admin password from the factory default.
2. Change the Wi-Fi password if it is printed on a sticker on the box.
3. Update the firmware, and enable automatic updates.
4. Turn on WPA3 encryption (or WPA2/WPA3 mixed mode).
5. Turn off remote administration.
6. Disable WPS and UPnP unless you specifically need them.
7. Create a separate guest network for visitors and smart devices.
8. Rename the SSID so it does not advertise your router's model.
9. Set encrypted DNS so your ISP cannot log every site you visit.

If that list is all you take from this guide, you are already more secure than most households. The rest of this article explains why each one matters and how to do it without breaking anything.

Secure your Wi-Fi router: the two passwords everyone confuses

A router has two passwords, and people conflate them. The Wi-Fi password lets a device join the network. The admin password lets someone log into the router itself and change everything, including where your traffic goes. The admin password is the one that matters most, and it is the one most often left as "admin" and "password", which are public knowledge, not secrets.

Open your router's admin page (usually 192.168.1.1 or 192.168.0.1 in a browser), log in, and change the admin password first. Make it long rather than complicated: a four-word passphrase beats an eight-character scramble for resisting guesses, a point CISA's password guidance and NIST SP 800-63B both emphasize. Then change the Wi-Fi password too if it is the one printed on the box. A passphrase you can remember is one you will actually use everywhere.

Update the firmware, then stop thinking about it

Router firmware is the router's operating system, and manufacturers release updates to patch security holes. Unpatched routers are how botnets grow: an old firmware with a known flaw, sitting on a public IP address, will eventually be found by automated scanners. If your router supports automatic updates, turn them on. If not, set a monthly calendar reminder to check manually. This takes two minutes and is the single highest-value habit in this whole guide.

If your router has not received a firmware update in over a year, check whether the manufacturer has end-of-lifed it. A router with no updates is not a router you can secure. It is a router you need to replace, and we will come back to that.

Switch on WPA3 and retire the museum pieces

WPA3 is the current Wi-Fi encryption standard and what you should be using in 2026. If your router and devices support it, enable it. If an older device cannot connect with WPA3, use WPA2/WPA3 mixed mode as a bridge. What you should never use: WEP or WPA, which are crackable in minutes, or an open network.

While you are in the wireless settings, disable WPS. Wi-Fi Protected Setup exists to make connecting easy with a PIN, and that PIN has a well-documented brute-force weakness. If you are not actively using it, turn it off. No convenience is worth an always-open side door.

Lock down the extras: remote admin, UPnP, and the guest network

Two features ship on for reasons that serve the manufacturer, not you. Remote administration lets anyone on the internet try to log into your router's admin page. Disable it unless you have a specific reason you remote-manage your network (and if you do, you already know how to do it over a VPN). UPnP lets devices on your network silently open ports to the internet without asking. Some gaming consoles and peer-to-peer apps use it; if nothing you own needs it, disable it.

Then set up the guest network, which nearly every modern router supports. Put visitors and all smart-home devices on it, separated from your main network. The cheap smart bulb with firmware from 2019 cannot be trusted with access to your laptop. A guest network means that when one device gets compromised, the blast radius stops there. This single setting dramatically limits what an attacker can reach.

Rename your SSID while you are at it. A network called "Linksys-AX5400" tells a stranger your exact hardware model, which tells them which vulnerabilities to try. A neutral name tells them nothing. Do not use your family name or street address either.

The annual 20-minute audit

Security is a process, not a one-time project. Once a year, log back into your router and check three things. First, the connected-devices list: anything you do not recognize gets investigated and, if it is not yours, blocked. Second, your firmware date: still being updated is still being protected. Third, the router's age. The 2026 rule of thumb is that a router with Wi-Fi 6 or Wi-Fi 7 and current updates is fine; a box that stopped receiving updates is a liability with antennas.

Pair this with good account hygiene and you are most of the way to a hardened home. When your devices are on a clean network, upgrades like switching to passkeys and backing up your 2FA before your phone dies handle the account side. The network side is the afternoon you have been putting off. Go do it this weekend.