You secure home Wi-Fi by changing the router admin password, updating the firmware, setting encryption to WPA3 Personal or WPA2 AES, changing the factory network name and Wi-Fi password, and switching off remote management, WPS and UPnP. Those settings close the routes attackers normally use to join or take over a home network.
A router usually still runs the settings it shipped with, and factory credentials are documented and searchable. A network left on defaults can be reached by anyone in range who knows the model number.
Why the router decides your Wi-Fi security
Your Wi-Fi network is the wireless link between your devices and the internet. Unless it is password protected, any device within range can pull the signal and use the connection, according to consumer.ftc.gov. Activity run over your connection can be traced back to you.
Which encryption version you use matters more than password length alone. The Wi-Fi Alliance, which runs the Wi-Fi CERTIFIED programme, requires WPA3 on certified devices, and WPA3 networks disallow outdated legacy protocols and require Protected Management Frames (wi-fi.org).
Close the admin side of the router first
A home router has two passwords doing different jobs. The Wi-Fi password lets a device join the network; the admin password lets someone change every setting, including that one. An attacker who reaches the admin side can undo everything else you set.
- Change the default admin username and password. CISA’s Project Upskill guidance notes that default router information may be publicly available for anyone to find, so leaving it in place gives an attacker a known starting point (cisa.gov).
- Use a different password for the admin account than for the Wi-Fi network, and do not reuse it elsewhere.
- Log out of the admin panel when you finish.
- Keep the router somewhere others cannot reach, because physical access allows a factory reset and the credentials printed on the label.
Set the right encryption and passphrase
Open the wireless security section and check which modes the router offers. Choose WPA3 Personal if your devices support it. If an older phone or printer drops off, a WPA2/WPA3 mixed mode is the usual compromise.
| Mode | Status | What to do |
|---|---|---|
| WPA3 Personal | Current standard | First choice where supported |
| WPA2 AES / PSK | Acceptable with a strong passphrase | Use when WPA3 is unavailable |
| WPA or WPA2 with TKIP | Legacy and weak | Move to AES, or plan a new router |
| WEP or an open network | No meaningful protection | Change immediately |
For the passphrase, long beats complicated. The same CISA guidance suggests five to seven unrelated words, at least 16 characters in total, used on no other account.
Then change the factory network name (SSID). A default name can point at the router model and the weaknesses published against it, and it should never contain your flat number, name or address. Visitors belong on a guest network.
Firmware and the switches most people never touch
Install any pending firmware update from the admin panel and enable automatic updates if the router offers them. Updates carry the patches, and a router that is never updated keeps its documented flaws open.
- Remote management. This lets you log in to the router from the internet. Turn it off so settings cannot be changed from outside your network.
- WPS. The push-button and PIN pairing methods are built around convenience. Disable WPS and pair devices with the passphrase.
- UPnP. Handy for games, but it lets devices open ports by themselves. Turn it off and forward a port manually only when something needs it.
- Firewall. Most home routers include one, so confirm it is enabled.
- Guest network. Keeps visitors, and often smart devices, away from the machines holding your files and accounts.
When the router itself is the problem
If the admin panel only offers WEP or WPA, or the manufacturer has stopped releasing firmware, settings cannot fix the design. Update the software first and check again. If WPA2 or WPA3 still do not appear, replace the device, and pick the next one for WPA3 support and a long support window rather than the fastest advertised speed.
Change the admin credentials, update the firmware, move encryption to WPA3 Personal or WPA2 AES, and switch off remote management, WPS and UPnP. Those few steps cover the routine ways into a home network, and everything after that is maintenance.