How to Secure Your Home Wi-Fi Router: The 30-Minute Lockdown

Patrol Blog · 11 November 2026 · Reading time: about 5 minutes

Every phone in the house, every laptop, the TV, the doorbell camera — all of it rides on one box in the corner. Learning how to secure your home wifi router is how you lock the door those devices share.

The job takes about half an hour, once: passwords first, encryption next, updates after that, then the doors nobody uses.

How to secure your home wifi router: start with the two passwords

A router holds two different passwords, and mixing them up is the first household mistake. The Wi-Fi password lets a device join the network. The admin password opens the settings page — the page that can change everything else, the Wi-Fi password included. Whoever holds the admin login can undo every other protection on the box.

Open the router's app, or type its address into a browser on a device already connected at home. The address and the factory login sit on the sticker on the box. Sign in, then change the admin username and password to something unique — never your name, your address, or the router brand. The Federal Trade Commission gives that same first step.

For the Wi-Fi password itself, the Cybersecurity and Infrastructure Security Agency suggests a passphrase built from five to seven unrelated words, at least 16 characters long, used for this network and nothing else. Long beats clever here.

Rename the network too. The factory name can advertise the exact router model, and a model name tells an attacker which known holes to try first. Pick a name with no personal information in it.

WPA3 vs WPA2 for home wifi: pick the strongest setting on the list

Encryption scrambles the traffic between your devices and the router. CISA is blunt about the menu: WPA3 Personal and WPA2 with AES are the only two forms it counts as safe. An open network, WEP, the original WPA, or WPA2 with TKIP is out of date.

WPA3 vs WPA2 for home wifi settles like this. Choose WPA3 Personal if every device you own can join it — it is the newer, stronger standard. If an older laptop or camera refuses to connect, look for a WPA2/WPA3 mixed or transition mode, which lets new devices run WPA3 while the old one keeps WPA2. WPA2 with AES on its own is still acceptable. WEP and the first WPA are not; the FTC calls both outdated and insecure, and if a router offers nothing better even after an update, the box itself needs replacing.

Update the firmware — and know when the box is done

Firmware is the router's own software. Updates close holes that attackers already know about. In the settings, look for a firmware update section, install what it finds, and switch on automatic updates if the box offers them. If your internet company supplied the router, ask whether it pushes updates on its own.

There is a hard end to updating. On 7 May 2025 the FBI warned that criminals were taking over end-of-life routers — models the maker no longer sells, supports, or patches — and renting them out as proxies to hide their own traffic. The malware, a variant of TheMoon, needs no password at all: it scans for open ports and sends a command. The FBI says routers dated 2010 or earlier likely get no updates anymore. A box that old is not a router to secure. It is a router to replace.

Close the side doors: remote management, WPS and UPnP

Three convenience features widen the attack surface, and most households never use them.

Remote management lets somebody sign in to the settings page from the internet. Turn it off. The compromised routers in the FBI warning had remote administration switched on, and the Bureau's fix list starts with disabling it, saving the change, and rebooting.

WPS — Wi-Fi Protected Setup — joins a device with a button press or a short PIN. CISA tells households to disable it: the shortcut raises the odds of an unauthorized join.

UPnP lets smart devices open connections on their own. CISA's guidance is to turn it off too, because attackers can use it to spread malware between devices and control them remotely. If a new gadget needs UPnP to join, switch it on for the setup, then back off.

How to check who is on your wifi

Finish with a headcount. The FTC's route is simple: open the router's web interface and look for the list labelled connected devices, wireless clients, or DHCP clients. That list is your roll call.

Work down it and name every entry — phones, laptops, the TV, the printer, the camera, the speaker. Rename the ones you know, in the app if it allows it, so next month's list reads faster. An entry you cannot place is a finding, not a shrug: change the Wi-Fi password, reconnect your own devices, and watch the list.

Give visitors the guest network, if your router offers one, with its own long password. CISA puts smart-home gadgets on that side of the wall too — a cheap camera then cannot wander over to your laptop.

The home wifi security checklist, on one pass

Admin password changed, and different from the Wi-Fi password. Network renamed, with nothing personal in it. Encryption set to WPA3 Personal, or WPA2 with AES. Firewall on. Firmware current, automatic updates on where offered. Remote management, WPS and UPnP off. Device list read, every entry named. Guest network running for visitors and gadgets. Then sign out of the admin page.

That lockdown pairs with the second lock on the accounts themselves — this patrol's guide to how to set up two-factor authentication covers that order, email first. The officer's beat is set out on the About page. If your device list shows an entry you cannot clear, put the story in front of this patrol through report a tether. Patrolling the online borders, one tether at a time.