Home Network Security Checklist: Router First

The router first, always

Your router is an always-on computer facing the internet, and everything else you own sits behind it. Compromise it and every other precaution is moot, which is why it belongs at the top of any home network security checklist.

Three actions cover most of the risk. Change the administrator password from the default, and make it distinct from your Wi-Fi passphrase — these are two different credentials and people routinely set them the same. Turn on automatic firmware updates, or check manually every few months if the router has no automatic option. Check whether the model is still supported; an unsupported router with known unpatched flaws should be replaced, not tolerated because it still passes traffic.

Close the doors facing outward

The next tier is about what your network offers to the internet unprompted.

• Remote administration. Disable management of the router from the internet side unless you specifically need it. If you do need it, use the manufacturer’s authenticated cloud service rather than an open management port.
• UPnP. This lets any device on your network open a path in from outside, without asking you. Turn it off, and manually forward the one or two ports you genuinely need.
• Port forwarding. Audit what is already forwarded. Old rules from a console, a camera or a game five years ago are still open doors.
• WPS. The push-button pairing convenience has a poor security history. Disable it.
• Unused services. Remote file sharing, media servers and FTP built into routers are frequently enabled by default and rarely used.

Wireless settings that matter

Use WPA3 where every device supports it, and WPA2/WPA3 mixed mode where older devices force the compromise. Never run an open network, and never run the long-obsolete WEP or WPA options if a router still offers them.

Your passphrase should be long rather than complicated — a Wi-Fi passphrase is attacked by offline guessing, where length is what costs the attacker time. Four or five unrelated words beat a short string of symbols, and they are far easier to read aloud to a guest.

Two things widely believed to help do not: hiding the network name and filtering by device address. Both are trivially bypassed and both create real inconvenience, which is a bad trade.

Segment the network

Segmentation is the highest-value structural step available to a household, because the smart home category is where insecure, unsupported devices accumulate. A compromised bulb on an isolated network can attack nothing; the same bulb on your main network can see your file shares.

Most modern routers offer a guest network, which is the simplest way to do this even without full VLAN support — put smart devices on the guest network if that is all you have. Note that some smart home features expect devices and controllers on the same network, so test before committing.

Inventory and retire

Open the router’s list of connected devices and identify every entry. Most people find something they cannot name, and unnamed devices are either forgotten hardware or something that should not be there.

Rename everything as you go, so next year’s audit takes ten minutes. Then decide what to retire: a device no longer receiving updates is a permanent, growing risk, and the ones that matter most are those with cameras, microphones or network access to other devices.

DNS and the easy wins

Setting a filtering DNS resolver at the router blocks known malicious domains for every device in the house, including the ones that cannot run security software. It takes two minutes and it is the single best effort-to-benefit item in this whole home network security checklist.

Two more quick wins. Enable the router’s firewall if it is not on by default, and disable IPv6 only if you understand what you are turning off — a common mistake is securing IPv4 carefully while leaving IPv6 unfiltered. And keep a written note of your router’s admin credentials somewhere offline, because the most common reason people never revisit these settings is that they cannot get back in.

The checklist

• Change the router admin password and keep it distinct from the Wi-Fi passphrase.
• Enable automatic firmware updates and confirm the model is still supported.
• Disable UPnP, WPS and internet-side remote administration.
• Audit existing port forwards and remove anything stale.
• Use WPA3 with a long passphrase — words, not symbols.
• Put smart home devices on a separate network, guest network at minimum.
• Inventory and name every device; retire anything unsupported.
• Set a filtering DNS resolver at the router.

That sequence takes about an hour once and twenty minutes a year afterwards. Nothing on it requires new hardware, and the ordering matters — a home network security checklist that starts with device-level antivirus has started three tiers below where the leverage actually is.