How to secure a home Wi-Fi router: a practical hardening checklist

The FBI recommends replacing end-of-life routers where possible and applying available firmware patches. Its warning concerns vulnerable devices used as criminal traffic relays; it does not mean every older router is infected. Use the support status of your exact model as the decision criterion. [FBI router advisory](https://www.ic3.gov/PSA/2025/PSA250507).

Prepare a short maintenance record before starting. Write down the model and hardware revision from the label, the installed firmware version from the administration page, and whether the router belongs to your internet provider. Find the official manual and support page yourself. Avoid choosing a firmware download simply because its filename resembles your router name.

For provider-supplied equipment, ask who installs security updates and whether customers can check their completion. Also ask what settings a reset would erase and whether telephone or television service depends on the device. Schedule changes when nobody needs an uninterrupted call, upload or medical appointment.

Our suggested working order is preparation, update, administrator protection, wireless settings, then isolation and verification. Keep the manufacturer's reset instructions available separately. If you cannot confirm support, record that uncertainty and ask the manufacturer or provider; do not interpret an empty update screen as proof that support continues.

The administrator password controls configuration; the Wi-Fi password admits devices to the wireless network. The FTC explicitly distinguishes them. Share the guest Wi-Fi credential with visitors rather than giving them administrative access. Find the management address in the official instructions or your device's network settings instead of assuming that every router uses the same address. [FTC home Wi-Fi guidance](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network).

Save the administrator credential in your password manager and test it by signing out and signing back in. Before changing a username, check whether the interface actually permits it. If the username is fixed, concentrate on the password and access restrictions. Do not reuse the credential for email, shopping or the provider's customer portal.

Review local administration, internet-facing remote administration and cloud management separately. Their names and relationships differ across products. Read the explanation beside each setting, record the previous state, apply the change, and verify that you can still manage the router locally. Ask the ISP before disabling a provider-specific service whose purpose is unclear.

FIDO passkeys offer phishing-resistant authentication and can reside on phones, computers or hardware security keys. If the associated account supports these methods, consider them and test its recovery route. This is an optional account-protection layer, not a claim that your router accepts a security key. Our linked passkey guide explains the choices. [FIDO passkeys](https://fidoalliance.org/passkeys/).

The FTC recommends WPA3 Personal or WPA2 Personal and advises updating or replacing routers that offer only obsolete alternatives. Use the comparison below as a selection guide, then check the manufacturer's documentation for the exact option names. A menu label alone does not tell you whether every older appliance will connect. [FTC encryption advice](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network).

Inventory the devices that matter before applying the change: work laptops, phones, printers, televisions, cameras and household controllers. Our suggested migration method is to update their software where supported, change the router setting, then reconnect one category at a time. Record any device that fails and the manufacturer's stated encryption support.

Choose a network name that does not reveal your surname, address or router brand. Keep the Wi-Fi password separate from administration credentials and enter it only on devices you intend to admit. Store the credential securely rather than leaving an administrator screenshot in a shared photo album. When giving access to visitors, use the guest credential.

If an essential device cannot use your preferred mode, document the exception and review whether a separate supported network is possible. Do not immediately weaken every household device's connection to accommodate one accessory. After reconnecting, test actual tasks such as printing and camera viewing; successful internet browsing alone does not establish that the whole household setup still works.

The FTC recommends guest networking, disabling WPS and UPnP, and enabling the router firewall. The NSA's home-network announcement also identifies wireless segmentation as a protective measure. Translate those recommendations into checks on your own model rather than assuming that a second network name automatically provides separation. [FTC checklist](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network), [NSA home-network announcement](https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3304674/nsa-releases-best-practices-for-securing-your-home-network/).

Look for controls described as guest isolation, local-network access or intranet access. Read the manual's explanation and choose settings that prevent guest access to the private network. Our suggested verification is to connect your own phone as a guest and attempt to open the router administration page and a known private resource. Test only equipment you own.

A failed test is useful evidence but does not prove comprehensive isolation. Check the documented scope, including wireless and wired private devices. For smart-home equipment, decide what must communicate locally before moving it. A controller that needs a local printer, speaker or hub may require a different arrangement; write down the exception rather than opening broad access without a reason.

Apply exposure-reducing changes one at a time. After disabling UPnP, test the household applications that previously depended on automatic connectivity. If something fails, consult its official instructions before restoring the feature or adding a forwarding rule. Record every retained exception with its purpose and a review date. Avoid disabling the entire firewall as a troubleshooting shortcut.

NIST treats wireless security as ongoing configuration, maintenance and monitoring. The FBI identifies unfamiliar setting changes and connectivity problems among possible warning signs and recommends updates, password changes and a reboot when activity is suspicious. A symptom is a reason to investigate, not a diagnosis of compromise. [NIST WLAN lifecycle guidance](https://csrc.nist.gov/pubs/sp/800/153/final), [FBI response advice](https://www.ic3.gov/PSA/2025/PSA250507).

Our suggested acceptance check is practical: reconnect a trusted device, confirm normal internet use, test an important local service, and repeat the guest-access check. Reopen the settings after restarting and compare them with your notes. Review the connected-device list with household members before treating an unfamiliar label as unauthorized access.

Keep a recovery record containing the model, official support route, update responsibility and reset procedure. Store credentials securely and retain any provider details needed to restore service. If you export a configuration backup, check the manual for its contents and storage requirements. A backup can be useful for accidental changes; do not blindly restore a configuration you suspect has been altered.

For suspected compromise, use a separate trusted connection to contact support and recover affected accounts. Record unexpected settings and relevant times before destructive recovery steps. Ask whether the model requires a reset, firmware recovery or replacement; a reboot alone is not evidence that the underlying issue is resolved. Rebuild only known settings and reconnect trusted devices first.

Make a short review appointment after installation and after major provider changes. Confirm that updates still arrive, remove retired devices and obsolete exceptions, and refresh recovery contacts. Router hardening remains useful only while its settings and supporting devices stay maintained.