4.2 Home Wifi Security

Core Concepts: Protect Your Data, Minimize Your Exposure

Your home WiFi network is the gateway to everything in your digital life, your computers, phones, tablets, smart home devices, security cameras, and more. A compromised network means all your devices are at risk. Worse, your neighbors or someone parked outside could be using your internet for illegal activities, and it would trace back to you.

Securing your home WiFi doesn't require deep technical expertise. Most protection comes from changing a few default settings that take 15-30 minutes to configure.

4.2.1. Understanding WiFi Security Risks

Common WiFi threats:

• Unauthorized access: Neighbors or attackers using your WiFi without permission

• Traffic interception: Attackers reading data sent over unsecured WiFi

• Man-in-the-middle attacks: Attackers positioning themselves between you and the internet

• Router vulnerabilities: Unpatched routers with known security holes

• Compromised IoT devices: Smart devices used to attack other devices on your network

• Evil twin networks: Fake networks that impersonate your WiFi

4.2.2. The Basics

• Change your router’s default admin password

• Use WPA3 or WPA2/WPA3 mixed mode

• Create a strong WiFi password

• Keep router firmware updated

• Use a custom network name (SSID)

Change Your Router's Default Admin Password

This is the single most important thing you can do. Routers typically come with default passwords like "admin/admin" or "admin/password" that are publicly known. Anyone on your network can access your router's settings with these defaults.

Some more modern routers like what you would get from your Internet Service Provider (ISP) may come with a unique password on a sticker on the back of the device. It is still a good idea to change this password.

How to access your router:

• Open a web browser

• Type your router's IP address in the address bar

  • Usually 192.168.1.1 or 192.168.0.1

  • Check the sticker on your router

  • Look it up online (https://router-network.com/default-ip-addresses)

• Log in with the default credentials (check router manual, sticker, or https://routerpasswords.com)

Change the admin password:

• Look for "Administration," "Management," or "System" settings

• Find "Change Password" or "Admin Password"

• Create a strong, unique password (16+ characters)

• Store it in your password manager

• Save/Apply changes

Use WPA3 or WPA2 Encryption

WiFi encryption protects your wireless traffic from being read. WPA3 is the newest and most secure, but not all devices support WPA3 yet. WPA2/WPA3 (mixed mode) is fine if you have devices on your home network that don’t support WPA3.

How to enable:

• In router settings, look for "Wireless Security" or "WiFi Security"

• Set Security Mode to:

• WPA3-Personal (best, if available)

• WPA2/WPA3 Mixed Mode (good compatibility)

• Save changes

NEVER use:

• WEP - Completely broken, can be cracked in minutes

• WPA1 (original) - Outdated and insecure

• Open/None - Anyone can connect without a password

Create a Strong WiFi Password

Your WiFi password (also called the network key or passphrase) protects who can connect to your network.

Password requirements:

• Mix of letters, numbers, and symbols OR simple but long

• Not your address, phone number, or birthdate

How to change:

• In router settings, find "Wireless Security" or "WiFi Password"

• Enter your new strong password

• Save/Apply

• You'll need to reconnect all your devices with the new password

Tip: Consider creating a passphrase from 4-5 random words: "Correct-Horse-Battery-Staple-47!" is both strong and easier to type on phones than random characters.

Keep Router Firmware Updated

Router firmware is like the operating system for your router. Manufacturers release updates to fix security vulnerabilities.

How to update:

• In router settings, look for "Firmware Update," "Router Update," or "Administration"

• Check for updates

• If available, click Update/Upgrade

• Wait for update to complete (don't unplug router during update!)

• Router will restart automatically

Enable automatic updates if available:

• Many modern routers can auto-update

• Look for "Automatic Firmware Updates" setting

• Enable it (likely already enabled by default)

If no auto-update: Check manually every 3 months.

Use a Custom Network Name (SSID)

Your network name (SSID) shouldn't reveal your router model or personal information.

Why change it:

• Default names like "NETGEAR-5G" or "Linksys" tell attackers what router you have

• Attackers can look up known vulnerabilities for that specific model

• Makes your network easier to identify among neighbors

What NOT to use:

• Your name or address: "Smith Family WiFi" or "123 Main St"

• Anything personally identifiable

• Provocative or offensive names (neighbors can see it)

Good options:

• Random words: "BlueElephant" or "QuietMountain"

• Numbers/letters: "Network7845"

• Anything generic and non-identifying

How to change:

• Router settings > Wireless Settings > SSID or Network Name

• Enter new name

• Save/Apply

• Reconnect devices to the new network name

4.2.3. Better Protection

• Disable WPS (WiFi protected setup)
• Set up a guest network
• Disable remote management
• Disable Universal Plug and Play (UPnP)
• Review connected devices regularly

Disable WPS (WiFi Protected Setup)

WPS was designed to make connecting devices easier, but it has a critical security flaw that makes it easy to crack your WiFi password.

Why disable it:

• WPS PIN can be brute-forced in hours

• Once cracked, attacker has your WiFi password

• No legitimate reason to keep it enabled

How to disable:

• Router settings > Wireless or WPS settings

• Find "WPS" or "WiFi Protected Setup"

• Disable it (turn off)

• Save/Apply

Set Up a Guest Network

A guest network gives visitors internet access without exposing your main network and devices.

Benefits:

• Guests can't see your computers, phones, or shared files

• Infected guest devices can't spread malware to your devices

• You can give out the guest password without compromising your main network

• Can disable guest network when not needed

How to set up:

• Router settings > Wireless Settings > Guest Network

• Enable Guest Network

• Set a different SSID (network name): "Guest" or "Visitors"

• Set WPA2/WPA3 encryption

• Create a separate guest password (simpler than main network is OK)

• Enable "Client Isolation" or "AP Isolation" if available (prevents guest devices from seeing each other)

• Save/Apply

What to put on guest network:

• Visitor devices

• Smart home devices (doorbell, thermostat, smart lights)

Disable Remote Management

Remote management allows you to access router settings from outside your home network. Unless you specifically need this, disable it.

Why disable:

• Opens your router to the entire internet

• Attackers can try to access your router from anywhere

• Most people never need this feature

How to disable:

• Router settings > Administration or Advanced Settings

• Find "Remote Management" or "Remote Administration"

• Disable it

• Save/Apply

Disable Universal Plug and Play (UPnP)

UPnP allows devices to automatically open ports in your router. This is convenient but can be exploited by malware.

Why disable:

• Malware can use UPnP to open ports and bypass your firewall

• Creates security holes without your knowledge

• Most services work fine without it

How to disable:

• Router settings > Advanced Settings or WAN settings

• Find "UPnP" or "Universal Plug and Play"

• Disable it

• Save/Apply

Note: Some gaming consoles and P2P applications prefer UPnP. If you have issues, you can manually configure port forwarding instead, or enable UPnP again.

Review Connected Devices Regularly

Check what's connected to your network to spot unauthorized devices.

How to check:

• Router settings > Connected Devices, Attached Devices, or Device List

• Review the list of connected devices

• Look for:

  • Unknown device names

  • More devices than you expect

If you find an unknown device:

• Disconnect it from the router interface

• Change your WiFi password immediately

Do this monthly: Set a calendar reminder to review connected devices.

4.2.4. Extra Credit

• Use VLANs to segment your network

• Install a custom router

Use VLANs to Segment Your Network

VLANs (Virtual LANs) separate devices into isolated network segments. This is advanced but powerful.

Example segmentation:

• VLAN 1: Trusted devices (computers, phones)

• VLAN 2: Smart home/IoT devices (can't access VLAN 1)

• VLAN 3: Guest network

Benefits:

• Compromised IoT device can't access your computers

• Better control over device communication

• Improved network performance

Requirements:

• VLAN-capable router (not all consumer routers support this)

• Managed network switch (if hardwired devices)

• Technical knowledge to configure properly

Note: This is advanced. Most people should use guest networks instead, which provide similar isolation with much easier setup. You will need to search online to contact an IT support person for specific instructions for your equipment.

Install a Custom Router

You can turn any PC into a custom router by installing open source router software, such as OPNSense. This is relatively advanced, so not for the faint of heart, but worth the effort if you are willing to learn a bit about networking and OK with spending a few hundred dollars for a truly secure, custom solution. You can view my guide on TheDen Home Network Runbook if you are curious about what is involved.