Every device in your home talks to the internet through one box: your router. If someone controls it, they can watch, redirect or block everything that passes through. Half an hour of settings makes it a locked front door instead of an open one.
About 12 minutes to read30 to 45 minutes to set upBeginner
Before you start
Do this from a computer or phone connected to your home network, ideally by cable or close to the router. Write down the current settings before changing anything, and keep the router's sticker or manual handy. Some changes disconnect every device, so pick a time when nobody is in the middle of a video call.
1Get into your router and change its password
Your router has two different passwords: the Wi-Fi password that devices use to join, and the admin password that controls the router's settings. Many routers still use a default admin password printed in the manual or on the sticker, which anyone who gets onto your network can look up.
Do this
Find how to sign in: look on the sticker on the router for a web address (often 192.168.0.1 or 192.168.1.1) or the name of a phone app. Many newer routers and mesh systems, such as Eero, Google Nest Wifi and Deco, are managed only through their app.
Sign in, and change the admin password to a long, unique one stored in your password manager.
If your internet provider supplied the router, check their app or website: they may manage some settings for you.
If the app account offers two-step verification, turn it on: whoever controls that account controls your router.
2Update the firmware, or replace the router
A router's software is called firmware, and like any software it has security flaws that get fixed in updates. Routers are a favourite target because they are always on, rarely updated and sit between you and everything else.
In the router's settings or app, look for Firmware update, Software update or Administration, install anything available, and turn on automatic updates if offered.
Mesh systems and routers from your internet provider usually update automatically. Check the app or ask the provider to confirm.
If the manufacturer has stopped releasing updates (look up your model's support page), or the router is old enough that it cannot use WPA2 or WPA3 security, replace it. Many internet providers will swap an old router for free.
Don't interrupt an update
Leave the router alone until it finishes and restarts on its own. Switching it off midway can leave it unusable.
3Lock down the Wi-Fi itself
Best
WPA3The current standard. Choose “WPA3” or “WPA2/WPA3 mixed” (also called transition mode) so older devices can still connect.
Good
WPA2 (AES)Still fine with a strong password. Avoid “TKIP” options if you see them.
Replace
WEP, WPA, or no passwordCan be broken in minutes or let anyone in. If these are your only options, the router needs replacing.
Do this
Set the security mode to WPA3, or WPA2/WPA3 mixed.
Use a Wi-Fi password of at least 12 characters, ideally three or four random words, and not the one printed on the sticker if the sticker is visible to visitors.
Give the network a name that doesn't identify you: avoid your surname, house number, flat number or router model.
Reconnect each device with the new password. It's also a good moment to notice devices you no longer use.
Myth
Hiding your network name, or only allowing approved device addresses (MAC filtering), adds little real security: both are easy to get around and make the network harder to use. A strong password and WPA2 or WPA3 are what protect you.
4Turn off risky extras
Routers come with convenience features that also make life easier for attackers. Turn these off unless you know you need them:
WPS (Wi-Fi Protected Setup): the push-button or PIN shortcut for joining the network. The PIN method in particular has known weaknesses.
Remote management (also called remote administration or web access from the internet): lets the router's settings page be reached from outside your home. Manage it from home, or through the manufacturer's app, instead.
UPnP (Universal Plug and Play): lets devices on your network open holes in the router's firewall automatically. Some games consoles and video calling apps use it; turn it off, and turn it back on only if something you rely on stops working.
Port forwarding rules you don't recognise: delete them. Each one exposes a device inside your home to the internet.
Want to see what your connection exposes from the outside? Our Security page links to free checks of your own connection.
5Put guests and smart devices on their own network
Most routers can run a separate guest network. Devices on it can reach the internet but not your computers, phones or shared files. That limits the damage if a visitor's phone or a poorly secured gadget is compromised.
Do this
Turn on the guest network, with its own name and password, and make sure “allow guests to see each other” or “access local network” is off.
Give visitors the guest password, not your main one.
Move smart TVs, speakers, cameras, doorbells, plugs and other internet-connected gadgets onto the guest network where they still work. (Some, such as printers or speakers you stream to from your phone, need to stay on the main network.)
For every smart device: change any default password, turn on its automatic updates, and remove ones you no longer use.
6Know what's connected
Your router's app or settings page lists every connected device, often under Devices, Clients or Attached devices. Have a look every few months.
Rename devices you recognise (for example “Kitchen speaker”) so unknown ones stand out.
Many devices show only a cryptic name or a manufacturer. Unplug or switch off things one at a time to work out what is what.
If something doesn't belong
Block or remove the device in the router's app.
Change the Wi-Fi password and the router admin password, then reconnect your own devices.
Check for firmware updates, and for settings you didn't make: new port forwarding rules, changed DNS servers or remote management switched on.
If you suspect the router itself was tampered with, reset it to factory settings and set it up again from this module.
Check your understanding
Which password protects your router's settings?
The admin password. It is separate from the Wi-Fi password, and often left at a default that anyone can look up.
Which Wi-Fi security setting should you choose?
WPA3, or mixed mode. WEP and old WPA can be broken quickly, and hiding the network name does not protect it.
Why put smart devices on the guest network?
To contain them. Smart gadgets are often the least secure things in a home. Keeping them separate limits what an attacker can reach.
Your checklist
Your ticks are saved only in this browser. Nothing is sent anywhere.
This module is general educational information, not professional advice, and following it cannot guarantee your network will not be compromised. Router menus and feature names vary by manufacturer and internet provider; follow their current instructions, and contact your provider before changing a router you rent from them. Products are named as examples only; Rondel Group is not affiliated with them.