Router Security Checklist: 12 Settings to Protect Your Home Network

Your router is the gateway to your entire home network. If it is misconfigured or running outdated firmware, an attacker might gain access to your Wi-Fi, intercept traffic, or reach devices like cameras and smart TVs.

In this article you will learn:

• The highest impact router security settings to review first
• Which features are convenient but risky (WPS, UPnP, remote management)
• How to secure Wi-Fi with modern encryption and guest networks
• Simple habits that keep your router safer over time

1. Change the router admin password (and username if possible)

This is the most important step. Many routers ship with common credentials like admin/admin.

Do this:

• Set a strong, unique admin password (not the same as your Wi-Fi password).
• If your router allows it, change the default admin username.

2. Update firmware and enable auto-updates (if available)

Firmware updates fix security vulnerabilities and stability issues.

Checklist:

• Check the router admin panel for updates.
• Enable automatic updates if the vendor supports it.
• If your router no longer receives updates, consider replacing it.

3. Use WPA3 (or WPA2-AES) and avoid legacy modes

For Wi-Fi encryption:

• Prefer WPA3-Personal.
• If WPA3 is not supported, use WPA2-AES.
• Avoid mixed/legacy options like WPA/WPA2 with TKIP.

4. Disable WPS (Wi-Fi Protected Setup)

WPS is designed for convenience, but it can be abused.

If you don’t actively use WPS, disable it.

5. Disable remote administration (WAN access)

Many routers offer "Remote Management" or "Web Access from WAN".

Best practice:

• Keep router administration accessible only from your LAN.
• If you truly need remote access, prefer a VPN into your home network rather than exposing the router admin panel.

6. Review (and usually disable) UPnP

UPnP helps devices open ports automatically (consoles, apps, IoT). It can also allow unwanted port exposure.

Practical approach:

• If you don’t need UPnP, disable it.
• If you do need it for gaming or specific apps, keep it on but monitor your port mappings and consider limiting it if your router supports that.

7. Create a guest network for visitors

A guest network isolates visitors from your main devices.

Good guest settings:

• Separate SSID and password
• Client isolation enabled (guests can’t talk to each other)
• No access to your LAN (if the router offers that option)

8. Segment smart home / IoT devices if you can

IoT devices often have weaker security.

If your router supports it, use:

• Separate guest SSID for IoT devices, or
• VLANs / multiple SSIDs (advanced routers)

This reduces the impact if one device is compromised.

9. Check DNS settings (avoid suspicious DNS hijacks)

Attackers and some malware target routers to change DNS settings.

Verify:

• DNS servers are set to your ISP, the router default, or a reputable provider.
• There are no unknown DNS IP addresses configured.

10. Disable unused services (FTP, SMB, cloud admin)

Some routers expose extra services:

• USB file sharing (SMB/FTP)
• Media servers
• Vendor cloud management

If you don’t use a feature, disable it. Less exposed surface means fewer risks.

11. Back up your configuration (after hardening)

After you configure security settings, export a backup of your configuration.

This helps you recover quickly after a factory reset or router replacement.

12. Periodically review connected devices and logs

Once a month (or when something feels off), check:

• The list of connected clients
• Unknown devices or suspicious names
• Security logs (if available)

If you see unknown devices:

1. Change Wi-Fi password.
2. Change admin password.
3. Update firmware.

Summary

Securing your router is mostly about removing default settings and disabling risky conveniences: change admin credentials, keep firmware updated, use WPA3/WPA2-AES, disable WPS and remote management, and isolate guests/IoT. A few minutes of configuration can prevent most common home-network security problems.