4.2 Home Wifi Security

Core Concepts: Protect Your Data, Minimize Your Exposure
Your home WiFi network is the gateway to everything in your digital life, your computers, phones, tablets, smart home devices, security cameras, and more. A compromised network means all your devices are at risk. Worse, your neighbors or someone parked outside could be using your internet for illegal activities, and it would trace back to you.
Securing your home WiFi doesn't require deep technical expertise. Most protection comes from changing a few default settings that take 15-30 minutes to configure.
4.2.1. Understanding WiFi Security Risks
Common WiFi threats:


Unauthorized access: Neighbors or attackers using your WiFi without permission


Traffic interception: Attackers reading data sent over unsecured WiFi


Man-in-the-middle attacks: Attackers positioning themselves between you and the internet


Router vulnerabilities: Unpatched routers with known security holes


Compromised IoT devices: Smart devices used to attack other devices on your network


Evil twin networks: Fake networks that impersonate your WiFi


4.2.2. The Basics


Change your router’s default admin password


Use WPA3 or WPA2/WPA3 mixed mode


Create a strong WiFi password


Keep router firmware updated


Use a custom network name (SSID)


Change Your Router's Default Admin Password
This is the single most important thing you can do. Routers typically come with default passwords like "admin/admin" or "admin/password" that are publicly known. Anyone on your network can access your router's settings with these defaults.
Some more modern routers like what you would get from your Internet Service Provider (ISP) may come with a unique password on a sticker on the back of the device. It is still a good idea to change this password.
How to access your router:


Open a web browser


Type your router's IP address in the address bar


Usually 192.168.1.1 or 192.168.0.1


Check the sticker on your router


Look it up online (https://router-network.com/default-ip-addresses)




Log in with the default credentials (check router manual, sticker, or https://routerpasswords.com)


Change the admin password:


Look for "Administration," "Management," or "System" settings


Find "Change Password" or "Admin Password"


Create a strong, unique password (16+ characters)


Store it in your password manager


Save/Apply changes


Use WPA3 or WPA2 Encryption
WiFi encryption protects your wireless traffic from being read. WPA3 is the newest and most secure, but not all devices support WPA3 yet. WPA2/WPA3 (mixed mode) is fine if you have devices on your home network that don’t support WPA3.
How to enable:


In router settings, look for "Wireless Security" or "WiFi Security"


Set Security Mode to:


WPA3-Personal (best, if available)


WPA2/WPA3 Mixed Mode (good compatibility)


Save changes


NEVER use:


WEP - Completely broken, can be cracked in minutes


WPA1 (original) - Outdated and insecure


Open/None - Anyone can connect without a password


Create a Strong WiFi Password
Your WiFi password (also called the network key or passphrase) protects who can connect to your network.
Password requirements:


Mix of letters, numbers, and symbols OR simple but long


Not your address, phone number, or birthdate


How to change:


In router settings, find "Wireless Security" or "WiFi Password"


Enter your new strong password


Save/Apply


You'll need to reconnect all your devices with the new password


Tip: Consider creating a passphrase from 4-5 random words: "Correct-Horse-Battery-Staple-47!" is both strong and easier to type on phones than random characters.
Keep Router Firmware Updated
Router firmware is like the operating system for your router. Manufacturers release updates to fix security vulnerabilities.
How to update:


In router settings, look for "Firmware Update," "Router Update," or "Administration"


Check for updates


If available, click Update/Upgrade


Wait for update to complete (don't unplug router during update!)


Router will restart automatically


Enable automatic updates if available:


Many modern routers can auto-update


Look for "Automatic Firmware Updates" setting


Enable it (likely already enabled by default)


If no auto-update: Check manually every 3 months.
Use a Custom Network Name (SSID)
Your network name (SSID) shouldn't reveal your router model or personal information.
Why change it:


Default names like "NETGEAR-5G" or "Linksys" tell attackers what router you have


Attackers can look up known vulnerabilities for that specific model


Makes your network easier to identify among neighbors


What NOT to use:


Your name or address: "Smith Family WiFi" or "123 Main St"


Anything personally identifiable


Provocative or offensive names (neighbors can see it)


Good options:


Random words: "BlueElephant" or "QuietMountain"


Numbers/letters: "Network7845"


Anything generic and non-identifying


How to change:


Router settings > Wireless Settings > SSID or Network Name


Enter new name


Save/Apply


Reconnect devices to the new network name


4.2.3. Better Protection

Disable WPS (WiFi protected setup)
Set up a guest network
Disable remote management
Disable Universal Plug and Play (UPnP)
Review connected devices regularly

Disable WPS (WiFi Protected Setup)
WPS was designed to make connecting devices easier, but it has a critical security flaw that makes it easy to crack your WiFi password.
Why disable it:


WPS PIN can be brute-forced in hours


Once cracked, attacker has your WiFi password


No legitimate reason to keep it enabled


How to disable:


Router settings > Wireless or WPS settings


Find "WPS" or "WiFi Protected Setup"


Disable it (turn off)


Save/Apply


Set Up a Guest Network
A guest network gives visitors internet access without exposing your main network and devices.
Benefits:


Guests can't see your computers, phones, or shared files


Infected guest devices can't spread malware to your devices


You can give out the guest password without compromising your main network


Can disable guest network when not needed


How to set up:


Router settings > Wireless Settings > Guest Network


Enable Guest Network


Set a different SSID (network name): "Guest" or "Visitors"


Set WPA2/WPA3 encryption


Create a separate guest password (simpler than main network is OK)


Enable "Client Isolation" or "AP Isolation" if available (prevents guest devices from seeing each other)


Save/Apply


What to put on guest network:


Visitor devices


Smart home devices (doorbell, thermostat, smart lights)


Disable Remote Management
Remote management allows you to access router settings from outside your home network. Unless you specifically need this, disable it.
Why disable:


Opens your router to the entire internet


Attackers can try to access your router from anywhere


Most people never need this feature


How to disable:


Router settings > Administration or Advanced Settings


Find "Remote Management" or "Remote Administration"


Disable it


Save/Apply


Disable Universal Plug and Play (UPnP)
UPnP allows devices to automatically open ports in your router. This is convenient but can be exploited by malware.
Why disable:


Malware can use UPnP to open ports and bypass your firewall


Creates security holes without your knowledge


Most services work fine without it


How to disable:


Router settings > Advanced Settings or WAN settings


Find "UPnP" or "Universal Plug and Play"


Disable it


Save/Apply


Note: Some gaming consoles and P2P applications prefer UPnP. If you have issues, you can manually configure port forwarding instead, or enable UPnP again.
Review Connected Devices Regularly
Check what's connected to your network to spot unauthorized devices.
How to check:


Router settings > Connected Devices, Attached Devices, or Device List


Review the list of connected devices


Look for:


Unknown device names


More devices than you expect




If you find an unknown device:


Disconnect it from the router interface


Change your WiFi password immediately


Do this monthly: Set a calendar reminder to review connected devices.
4.2.4. Extra Credit


Use VLANs to segment your network


Install a custom router


Use VLANs to Segment Your Network
VLANs (Virtual LANs) separate devices into isolated network segments. This is advanced but powerful.
Example segmentation:


VLAN 1: Trusted devices (computers, phones)


VLAN 2: Smart home/IoT devices (can't access VLAN 1)


VLAN 3: Guest network


Benefits:


Compromised IoT device can't access your computers


Better control over device communication


Improved network performance


Requirements:


VLAN-capable router (not all consumer routers support this)


Managed network switch (if hardwired devices)


Technical knowledge to configure properly


Note: This is advanced. Most people should use guest networks instead, which provide similar isolation with much easier setup. You will need to search online to contact an IT support person for specific instructions for your equipment.
Install a Custom Router
You can turn any PC into a custom router by installing open source router software, such as OPNSense. This is relatively advanced, so not for the faint of heart, but worth the effort if you are willing to learn a bit about networking and OK with spending a few hundred dollars for a truly secure, custom solution. You can view my guide on TheDen Home Network Runbook if you are curious about what is involved.