How to Secure Your Home Router: A Settings Checklist

Five settings do most of the work of securing a home router. In priority order:

1. Change the admin password (and the default network name).
2. Use WPA3, or WPA2/WPA3 if older devices need it.
3. Keep the firmware updated, automatically if possible.
4. Turn off remote management, WPS and UPnP.
5. Give guests a separate network.

Each step below says what to do and whose guidance it follows. You’ll find these settings in your router’s app or web admin page; the exact menu names vary by brand.

Step 1: change the admin password and network name

Your router’s default login details may be publicly available, so change them. The FTC advises changing the default administrative username, password and network name to something unique. The admin password protects the router’s settings; it’s different from your Wi-Fi password, and it should be different in value too.

When you finish changing settings, log out of the admin page, as the FTC suggests.

Step 2: use WPA3 (or WPA2/WPA3)

The FTC and CISA both advise WPA3 Personal or WPA2, with CISA specifying WPA2 using AES. Apple recommends WPA3 Personal, or WPA2/WPA3 Transitional for compatibility with older devices.

• Why WPA3: WPA3 support has been required in all new Wi-Fi CERTIFIED devices since 2020, and the Wi-Fi Alliance recommends using it whenever possible.
• If older devices can’t connect: transition mode lets WPA2 and WPA3 devices share the same network.
• If your router only offers older options: CISA says a network that’s open, or that only uses WEP, WPA or WPA2 with TKIP, is a reason to ask your provider for an upgrade or buy a new router.

Step 3: keep the firmware updated

Updates fix security flaws. CISA says routine updates protect you against known vulnerabilities, and notes that some routers can install updates automatically. Apple recommends turning automatic firmware updates on. If your router can’t update automatically, the FTC suggests registering it with the manufacturer so you hear about new updates.

If you’re in the US and own a router produced abroad, the FCC’s 2026 rule doesn’t stop it getting security updates: routers authorized before the rule may keep receiving updates that protect consumers at least until 1 January 2029. The FCC router rule explained has the details.

Step 4: turn off remote management, WPS and UPnP

The FTC advises turning off three features that can weaken security:

• Remote management lets the router’s settings be reached from the internet. Change settings from inside your home network instead.
• Wi-Fi Protected Setup (WPS) connects devices with a button or PIN instead of the password.
• Universal Plug and Play (UPnP) lets devices open connections through the router on their own.

Step 5: give guests a separate network

The FTC suggests a guest network with its own name and password, so fewer people have your main Wi-Fi password.

Two settings that don’t help much

Some popular tips make little difference. Apple recommends leaving both of these off:

• Hiding your network name doesn’t improve security, and Apple notes it can expose privacy information.
• MAC address filtering is easy to get around because MAC addresses are easily spoofed.

When to replace your router

A router that no longer gets security updates should be replaced. CISA notes that end-of-support devices don’t receive security updates and urges replacing them. Check your manufacturer’s support pages for your model’s status, and when you buy, prefer a maker that publishes how long it supports each model. How to choose a Wi-Fi router covers that.

The checklist

If devices start dropping after you change security settings, Wi-Fi keeps disconnecting can help you find out why.