Router Security Basics: Settings to Check Before You Connect

Why router security matters

A router is the front door to your home network. Every phone, laptop, smart speaker, thermostat, and streaming device connects through it, so a misconfigured router can expose those devices to outside traffic. The good news is that the basics are simple: check encryption, change the default password, update firmware, and turn off features you do not use.

This checklist is written for someone setting up a new router or reviewing one that has been online for a while. It is not a substitute for your router's manual, but it covers the settings that make the biggest difference.

Use WPA3 encryption

The most important wireless security setting is the encryption method. According to Wi-Fi Alliance, WPA3 is mandatory for Wi-Fi CERTIFIED devices and offers more robust authentication, increased cryptographic strength, and protections from password guessing attempts. If your router and devices support WPA3, choose WPA3-Personal for a home network. WPA3 also requires Protected Management Frames, which help protect management traffic from eavesdropping and forging.

Avoid older security modes such as WEP and WPA. Wi-Fi Alliance says WPA3 networks disallow outdated legacy protocols. If you have a very old device that only works with WPA2, you may need to keep WPA2 enabled for that device, but consider replacing the device or moving it to a guest network.

Change the router admin password

Many routers ship with a default password printed on the label. Anyone who knows the model can look up that default, so change it before connecting more than a test device. Use a long passphrase that is easy for you to remember and hard for someone else to guess. Do not reuse your Wi-Fi password as the admin password, and do not reuse any password from another account.

If your router has a separate administrator username, change that too. The default username is often "admin." A unique username makes it harder for someone to automate a login attempt. For a deeper password refresher, NIST's cybersecurity and privacy pages link to an explainer titled "How Do I Create a Good Password?"

Check for firmware updates

Router firmware is the software that runs the router. Manufacturers release updates to fix bugs and close security holes, so an unpatched router can stay vulnerable even when every setting looks correct. Check the router admin panel for a firmware update option, and install new firmware as soon as it is available. Many routers can check automatically; enable that if it exists.

Firmware updates can also add support for newer Wi-Fi features or fix compatibility issues. If the router model is no longer receiving updates, it may be time to replace it. For a deeper look, see router firmware updates explained.

Review remote management and UPnP

Remote management lets you log in to the router from outside your network. That is convenient, but it also exposes the router admin interface to the internet. Unless you need it, keep this feature off. When you do need remote access, use a VPN to reach your home network instead of opening the admin page directly.

Universal Plug and Play, or UPnP, lets devices open ports automatically. Software like game consoles and cameras sometimes ask for it, but a misconfigured UPnP service can let an attacker open a path into your network. Disable UPnP unless you have an application that genuinely needs it, and see port forwarding explained when you need to open a port manually.

• Disable remote management when you are not using it.
• Disable UPnP by default, then re-enable it only for an app that requires automatic port forwarding.
• If you need to expose a service, use a specific port forward instead of placing the device in the DMZ.

Set up a guest network

A guest network separates visitors and less trusted devices from your main devices. Internet of Things gadgets like cameras, lights, and smart speakers can be put on the guest network so that a vulnerability in one device does not give an attacker access to your laptop and phone. Most modern routers include a guest network option in the admin panel.

Give the guest network its own passphrase, and if the router offers a choice, use WPA3 or WPA2 on it. Avoid an open guest network unless the space is truly public, and if you do run an open network, Wi-Fi Alliance's Wi-Fi Enhanced Open technology provides unauthenticated data encryption for that scenario. For more, see guest network explained.

Look for Wi-Fi CERTIFIED devices

When shopping for a router, check for Wi-Fi CERTIFIED branding. According to Wi-Fi Alliance, WPA3 is mandatory for Wi-Fi CERTIFIED devices, and Protected Management Frames are required for all new certified devices. That does not guarantee every manufacturer configures the router securely out of the box, but it means the hardware is designed to support modern Wi-Fi security.

Compare routers by standard, speed class, and coverage in the Wi-Fi 6 buying guide or the Wi-Fi 7 buying guide. If you are building a system with multiple access points, the mesh router guide is a good place to start.

What to pick for your use

Questions

What is the most important router security setting?

Use WPA3 encryption and change the default admin password. WPA3 is mandatory for Wi-Fi CERTIFIED devices, and a unique admin password stops someone from walking into the router settings with the factory credential.

Should I disable WPA2 if WPA3 is available?

If every device on the network supports WPA3, use WPA3-Personal. Older devices may need WPA2, so check device settings before disabling it. Wi-Fi Alliance says WPA3 networks disallow outdated legacy protocols, so moving old devices to a guest network or replacing them is worth considering.

How do I know whether my router supports WPA3?

Check the router specification page, the box, or the admin panel. Wi-Fi CERTIFIED devices must support WPA3. If the router only lists WPA2, it cannot run WPA3.

How often should I check for firmware updates?

Check when you first set up the router and then whenever the admin panel tells you an update is available. Enable automatic updates if the router supports them. Stop using a router that no longer receives updates, because unpatched firmware is a long-term risk.

Should I use a guest network for smart home devices?

It is a good idea. A guest network isolates devices that rarely need to talk to your main computers. Put cameras, lights, speakers, and other Internet of Things devices there, and keep the main network for devices that store personal data.

What is Wi-Fi Enhanced Open?

Wi-Fi Enhanced Open provides unauthenticated data encryption for open networks, preserving the convenience of no password while reducing the risks of an unsecured public network. It is useful for public or visitor networks, not a replacement for WPA3 at home.