How to Secure Your Home Wi-Fi Router: A Checklist From CISA's Guidance

Your router connects every device in your home to the internet, so it's worth half an hour of attention. This checklist follows home network guidance from CISA, the US Cybersecurity and Infrastructure Security Agency. CISA has moved that page to its archive, but the basic advice below is still standard practice. Your router's manual or your ISP can tell you where each setting is.

CISA rejects two common assumptions: that a home network is too small to be a target, and that devices are secure enough straight out of the box.

The checklist

1. Change the admin password. CISA notes that default credentials may be published online or printed on the device itself.
2. Update the firmware, and turn on automatic updates if your router has them. CISA calls regular updates one of the most effective steps you can take.
3. Use the strongest Wi-Fi encryption your router offers (WPA3 where available), with a strong, unique Wi-Fi password.
4. Rename the network (SSID). CISA says default names often reveal the maker or model, which helps attackers look up known flaws. Don't use your name or address either.
5. Turn off WPS. CISA explains that a design flaw in WPS PIN authentication makes the PIN much faster to brute-force.
6. Turn off UPnP if you don't need it. CISA warns that malware can use it to get around the router's firewall.
7. Make sure the router's firewall is on. CISA notes that some firewall features, even the firewall itself, may be off by default.
8. Turn off features you don't use (remote administration, for example). Each one adds to the attack surface.

Beyond the router

CISA also recommends updated security software on your devices, a firewall on each computer, and regular encrypted backups.

More: How-To.