Secure your home Wi-Fi in 15 minutes

You don’t need a lab or a new router to make home Wi-Fi harder to get into. The steps below are the ones CISA recommends as a minimum: change the default router login, use modern encryption, give the network its own strong password, turn on a guest network, and keep the firmware current. Want a quick checklist? Try Is my Wi-Fi secure?.

Menu names vary by router brand and by whether your internet provider supplied the box. Look for the same idea, and use the manufacturer’s or ISP’s help page if a label doesn’t match. You’ll need to be on your own Wi-Fi to do this, and you should save the new passwords in a password manager as you go.

1. Open the router’s admin page

Find the admin page, then sign in. The usual path is:

1. Find the router’s address (often printed on a sticker, or shown as the Default Gateway on your PC). See Find your router’s admin page.
2. Type that address in a browser. If the page doesn’t load, try http:// in front of the address, not https://.
3. Sign in with the admin username and password. If you never changed them, they’re often on the sticker or in the ISP’s setup sheet. Those defaults are also easy for other people to look up, which is why the next step matters.

If this is an ISP-managed gateway and you can’t reach an admin page, use the provider’s app or ask them how to change the Wi-Fi password and encryption. Don’t guess repeatedly and lock yourself out.

2. Change the default admin password

This is the password that lets someone change the router, not the password people type to join Wi-Fi. CISA’s guidance is to change the default username and password to something long, random, and unique.

Look for Administration, System, Management, or Router password. Set a new password you don’t use anywhere else. If the router lets you change the admin username too, do that.

Write it down in your password manager before you click Save. If you forget this one, the usual recovery path is a factory reset, which wipes the rest of your settings too.

3. Use WPA3, or WPA2 AES if that’s all you have

Open the wireless or Wi-Fi security settings. Set the encryption to WPA3 Personal if the router and your devices support it. If WPA3 isn’t available, use WPA2 AES (you may also see WPA2-PSK, WPA2 Personal, or WPA2-PSK (AES)).

CISA treats WPA3 Personal and WPA2 AES as the two options that are still acceptable for a home network. Avoid:

• An open network (no password)
• WEP
• WPA (the original)
• WPA2-TKIP or a TKIP-only option

If the only choices are those older modes, ask your provider about an upgrade, or consider a newer router. After you change the security type, every device will need the Wi-Fi password again.

4. Change the default Wi-Fi name and password

If the network is still named after the manufacturer or the ISP (NETGEAR42, ATT-WiFi, and the like), change the SSID, which is just the Wi-Fi name. Don’t put your name, street, or apartment number in it.

Then set a new Wi-Fi password. CISA suggests a memorable passphrase of five to seven unrelated words, at least 16 characters, and not reused on other accounts. This is a different password from the admin login in step 2.

Some routers let you set different names for 2.4 GHz and 5 GHz. That’s fine, and it makes it easier to tell which band you’re on. Use a strong password on both.

5. Turn on a guest network

If your router offers a Guest, Guest network, or Guest Wi-Fi option, turn it on and give it its own name and a different strong password. Visitors use that one. See Set up a guest Wi-Fi network for the details, including what should stay on your main network (work laptops and printers you need to reach).

CISA also recommends putting internet-only smart home devices on the guest network when you can, so they don’t sit next to your laptops and shared files.

6. Check for firmware updates

Look for Firmware, Router update, System update, or Administration. Check for an update and install it if one is waiting. Some routers can apply updates automatically; turn that on if you see it and you’re comfortable with a brief restart.

You may need to restart the router afterward. Give it a few minutes, then confirm you can still sign in to the admin page and join the Wi-Fi.

7. Turn off extra doors if you can find the settings

These two are worth changing if the menu is easy to find. Skip them rather than guessing if you can’t see a clear switch:

• Remote management, Remote access, or Remote administration: this lets someone reach the admin page from the internet. CISA recommends turning it off unless you have a specific reason to use it.
• WPS (Wi-Fi Protected Setup), often a button on the router: it’s convenient and has a known weakness in the PIN method. CISA recommends disabling it.

If you also see UPnP and you don’t need it for a device you’re setting up, CISA recommends turning it off. Some devices need it only during setup.

Keep the router itself somewhere you control. Anyone who can press the physical Reset button can wipe it back to the default password on the sticker.

What not to do

• Don’t leave the default admin password in place, even if the Wi-Fi password is strong. Those are two different logins.
• Don’t use WEP or an open network “just for a minute.”
• Don’t put your full name or address in the Wi-Fi name.
• Don’t factory-reset the router to start this checkup unless you already can’t sign in.

Still stuck?

If you’d rather walk through the admin menus together, I can connect remotely. Support is after-hours, nationwide, with local help in the Dallas–Fort Worth area. Details are on the Work with me page.

Sources checked

• Module 5: Securing Your Home Wi-Fi (CISA)
• Securing Wireless Networks (CISA)
• Home Network Security (CISA)
• Wi-Fi and your home layout (Microsoft Support) (current standard is WPA3; avoid WEP)