Security & Privacy
A friendly, jargon-free guide to securing your home Wi-Fi, covering passwords, router settings, guest networks, and simple habits that keep your home safe.
The five settings that actually protect a home network are a changed router admin password, WPA3 (or WPA2 with AES) encryption, WPS switched off, remote management disabled, and current firmware. Everything else people fuss over, such as hiding the network name, MAC filtering, or turning down the signal, is either security theater or a rounding error, so spend your afternoon on the five that count.
Before you change anything, you need the router's admin panel, and that is a different login from the Wi-Fi password you type into your phone. The admin panel is the control room. The Wi-Fi password just opens the door to the internet.
To reach the panel, you need your router's local IP address:
ipconfig, and read the "Default Gateway" line. It is almost always 192.168.1.1, 192.168.0.1, or 10.0.0.1.Type that address into any browser. Many ISP routers also have a companion app (Xfinity, AT&T Smart Home Manager, and similar) that does the same job.
Now the important part. Routers ship with a default admin login printed on the sticker, historically things like admin/admin or admin/password. Those defaults are catalogued in public lists that attackers reference by model number, so if yours is still a dictionary word, change it immediately. Newer ISP units often ship with a unique random admin password on the label, which is genuinely fine, but write it somewhere safe because a factory reset restores it.
Encryption is what stops a neighbor or a parked car from reading your traffic. Here is the short ranking of what you might see in the dropdown:
WPA3 uses a handshake called SAE (Simultaneous Authentication of Equals) that resists the offline guessing attack WPA2 is vulnerable to. With WPA2, an attacker captures the four-way handshake and grinds it against wordlists on their own hardware, at their leisure. WPA3 closes that door.
The realistic setting for most people is WPA2/WPA3 mixed mode, sometimes labeled "transition mode." It lets a newer laptop use WPA3 while a 2017 smart plug or an old e-reader falls back to WPA2, so nothing on your network stops working.
WPA2 and WPA3 allow passphrases of 8 to 63 characters, and length beats complexity every time. A four-word passphrase like cobalt-harbor-mixer-quiet has far more real entropy than P@ss1!, and it is dramatically easier to type into a smart TV with a remote. Because the main attack is offline guessing, a long passphrase is what makes cracking infeasible rather than merely slow. Avoid your street name, birthday, or anything you have reused on another account.
These two toggles remove the most common remote-attack surfaces, and almost nobody needs either feature on.
WPS (Wi-Fi Protected Setup) is the "press a button to connect" feature, but its 8-digit PIN method has a structural flaw. The router checks the PIN in two halves and the last digit is a checksum, which collapses the real search space to roughly 11,000 combinations. The Pixie Dust attack recovers the PIN on many routers in seconds. Find it under Wireless settings and switch it off. You can still connect any device by typing the Wi-Fi password normally.
Remote management (also called "Remote Administration" or "Web access from WAN") lets you log into the admin panel from anywhere on the internet. Unless you have a specific reason, disable it so the login is reachable only from inside your home. It usually lives under Administration or Advanced.
While you are there, consider turning off UPnP if you do not game online or run servers. UPnP is convenient because it lets consoles auto-open ports, but it also lets any device punch holes in your firewall without asking. If something breaks after disabling it, you can switch it back.
Most routers can broadcast a second network with its own name and password, and this is one of the most underused features you have. Turn on the guest network, and look for a related toggle called AP isolation or client isolation, which stops devices on that network from reaching each other or your main devices.
This does two useful things. Guests get online without ever learning your primary password, and anything on the guest network is walled off from the laptop, network drive, and printer on your main one.
The best use, though, is smart home gear. A cheap smart bulb or an off-brand camera may stop receiving firmware updates within a year or two, and those devices are a classic weak link. The Mirai botnet famously recruited exactly this kind of hardware. Putting them on the guest or IoT network means a compromised bulb cannot pivot to the machine holding your tax returns. One caveat: some smart-home apps need your phone and the device on the same network to pair, so set the device up first, then move it over.
A router is a small, always-on Linux computer, and it needs security patches like any other. If your router offers automatic updates (common on eero, Google Nest Wifi, and newer ASUS and Netgear models), turn them on. If not, check Administration > Firmware Update every couple of months; each update quietly closes flaws you would otherwise never hear about.
The larger risk is age. Manufacturers stop shipping patches after a support window, often three to five years. A 2015 router with a known, unpatched vulnerability is a liability that no setting can fix. If yours is past end-of-life, replacing it with a current Wi-Fi 6 (802.11ax) model buys you both real security updates and a genuine speed bump.
This is not security. Your router still announces its presence in every frame; hiding the name only keeps it out of the pick list, and tools like Kismet reveal it instantly. Worse, your own devices then constantly probe for the hidden name, which can leak it. Do rename a default SSID like NETGEAR58 or ATT4g8H, though, because those advertise your exact model and hand an attacker a list of exploits to try.
MAC addresses travel unencrypted in every Wi-Fi frame, so anyone nearby can read an allowed address and clone it in a single command. It is a genuine maintenance headache for essentially zero protection.
Plenty of people rotate the Wi-Fi password but leave the admin login at its default. The admin panel is exactly what a nosy houseguest already on your network, or an attacker, would use to redirect your DNS, open ports, or lock you out.
If your router already supports WPA3, absolutely turn it on. But WPA2 with a long passphrase is still strong, so WPA3 alone is not a reason to replace a router that is otherwise recent and still getting firmware updates. Age and support status matter more than the encryption label.
It is the single highest-value optional step. Cheap cameras, plugs, and bulbs are the devices most likely to go unpatched, and isolating them means one weak gadget cannot reach your computers or phones. If your router supports a guest or IoT network, use it.
There is no fixed schedule; a long, unique passphrase does not "wear out." Change it when someone who had it moves out, when you suspect it was shared too widely, or after a device on the network was compromised. Routine monthly changes mostly just annoy your household.
It does nothing meaningful for security, since attacks do not wait for a schedule, and it interrupts overnight firmware updates and backups. If you want less nighttime signal or screen time, use a schedule for specific devices instead of powering down the whole router.
Theo writes about online safety the way a good friend would — clearly, calmly, and without trying to scare you. He's interested in the simple habits that stop most problems, and he thinks staying private online is a skill anyone can learn.
Keep reading
A reassuring, jargon-free guide to spotting fake online stores, covering the warning signs in prices, contact details, payment options, and reviews.
Theo Vance
A calm, jargon-free guide to protecting your privacy on your phone, covering app permissions, location sharing, lock screens, and trimming back data tracking.
Theo Vance