Secure your Wi-Fi network by using WPA2 or WPA3 encryption, setting a strong unique Wi-Fi password and a separate router admin password, keeping firmware updated, turning on a guest network, and disabling WPS and remote management. These 15 tips will help you lock hackers out.
To secure your Wi-Fi network from hackers, start with strong encryption, unique passwords, current router firmware, and safer access settings. These protections matter because an intruder on your home network may intercept traffic, reach connected devices, or misuse your internet connection.
The 15 tips below are ordered from the changes that matter most to optional extras.
If you are connected but nothing loads, that is a different problem: see Wi-Fi connected but no internet.
Common Wi-Fi Security Risks
Before changing any settings, it helps to understand what you are protecting against. Wi-Fi hacking covers a few distinct threats:
Eavesdropping: On an unsecured or poorly encrypted network, nearby attackers can intercept and read data in transit, including login credentials and personal communications.
Man-in-the-middle attacks: By positioning themselves between your device and the network – often via a rogue access point – attackers can intercept and alter data before it reaches its destination.
Network intrusion: Weak passwords or default settings let attackers join your network directly, reach other connected devices, and use your bandwidth or storage.
Attackers can also try to knock a network offline entirely; see how denial of service attacks work.
1. Change the Default Router Login and Wi-Fi Password
Routers ship with two separate credentials, and both need changing from their defaults:
The Wi-Fi password – what your devices use to join the network. Make it long and unique; avoid dictionary words or anything guessable.
The router admin password – what protects the router’s settings page. This is a different credential and is often left on its factory default, which is public knowledge for most router models and one of the easiest ways in for an attacker.
Change both, log out of the admin page once you are done, and avoid reusing either password anywhere else.
2. Use WPA2 or WPA3 Encryption Correctly
Encryption is what actually scrambles the data travelling between your devices and your router. WPA3 is the current standard – it has been mandatory for Wi-Fi-certified devices since 2020 and is supported by essentially every router sold today – and it closes several weaknesses in the older WPA2.
If every device on your network supports WPA3, enable WPA3-only for the strongest protection.
If you still have older devices that only support WPA2, use WPA2/WPA3 mixed mode rather than dropping encryption entirely; a well-maintained WPA2 network with a strong password is still far better than an open one.
Avoid WEP and open networks altogether – both are obsolete and easily broken.
3. Rename Your Network (SSID)
Change your network name (SSID) from the manufacturer default, which often reveals the router brand and sometimes the model – information that helps an attacker target known vulnerabilities. Pick a name that does not include your address, name, or other identifying details.
Some routers let you hide the SSID from the list of visible networks. This can reduce casual visibility, but it is not real security – tools that scan for Wi-Fi traffic can still find a hidden network, and it makes reconnecting your own devices more annoying. Treat it as an optional, low-value extra rather than a real defense.
4. Update Your Router’s Firmware Regularly
Firmware updates patch known security vulnerabilities in the router itself.
Turn on automatic updates if your router supports them; if not, check the manufacturer’s site periodically, and register your router for update notifications where that option exists.
An unpatched router is one of the more common ways attackers get a foothold on an otherwise well-configured network.
The same applies to your browser, as the recent Chrome zero-day CVE-2026-85046 showed.
5. Set Up a Separate Guest Network
A guest network gives visitors internet access without putting them on the same network as your computers, phones, and smart-home devices. Give it its own SSID and password, and turn on guest or client isolation if your router offers it, so guest devices cannot see or reach your main devices.
Forgot the password you set? Here is how to find a Wi-Fi password already saved on a Windows PC.
6. Turn Off WPS and UPnP
WPS (Wi-Fi Protected Setup) lets you connect a device without typing the password, using a button or an 8-digit PIN.
The PIN method has a well-documented flaw: routers verify it in two halves rather than as one code, which sharply cuts down the combinations an attacker needs to try and makes it vulnerable to brute-force attacks.
The FTC recommends turning off WPS; at minimum, avoid the PIN method and only use the push-button option when actively pairing a device.
UPnP (Universal Plug and Play) lets devices on your network automatically open ports on your router. It is convenient for some smart-home and gaming devices, but it also lets malware do the same thing without asking. Unless you specifically need it, turn it off.
Not every attack comes through the router: QR code scams trick you into opening a fake site yourself.
7. Use a VPN for Extra Protection
A VPN encrypts traffic between your device and the VPN server, which is most valuable on networks you don’t control – public Wi-Fi at a cafe or airport, for example.
On a home network that already uses WPA2/WPA3 encryption and a strong password, a VPN adds a smaller, optional extra layer rather than fixing a real gap. Choose a reputable provider with a clear no-logs policy if you decide to use one.
If you decide to use one, compare the best free VPNs, and note that some sites block VPN traffic.
8. Monitor Network Activity and Review Router Logs
Most routers record connected devices and, in some cases, login attempts.
Check it occasionally for devices you don’t recognize or repeated failed login attempts to the admin page.
Some routers and mesh systems include an app that lists connected devices in real time, which makes this easier to do regularly rather than only when something already seems wrong.
9. Secure Every Device Connected to Your Network
Internet of Things (IoT) devices – smart thermostats, cameras, plugs, and appliances – are frequently the weakest link on a home network, since many ship with weak default credentials and receive infrequent updates. Reduce the risk by:
Changing default passwords on every smart device, not just the router.
Keeping IoT devices on the guest network or a separate segment where your router supports it, so a compromised smart device cannot reach your computers or phones.
Installing firmware updates for these devices when the manufacturer releases them.
10. Consider MAC Address Filtering
MAC address filtering restricts your network to a list of approved device addresses.
It adds a small extra hurdle, but it is not a strong control on its own – a MAC address can be seen in plain traffic and spoofed by anyone motivated enough to try.
Use it as an optional extra layer alongside a strong password and encryption, not as a replacement for either.
11. Turn Off Remote Management
Remote management lets you configure the router from outside your home.
It is convenient but expands your attack surface – anyone who finds your router’s public interface can try to log in to it. Leave it off unless you have a specific, ongoing need for it.
12. Turn On Your Router’s Firewall
A built-in firewall filters unwanted incoming and outgoing traffic, and most routers include one. Make sure it is enabled – it is on by default on most modern routers, but it is worth checking, especially after a factory reset or a firmware update.
13. Add 2FA on Your Router’s Manufacturer Account, Where Available
Wi-Fi itself has no concept of two-factor authentication for the devices joining it – that is not a setting your router offers for network access.
What is real: many routers and mesh systems, especially app-managed ones like eero or Google/Nest Wifi, are administered through a cloud account with the manufacturer.
If your router works this way, turn on 2FA for that account – it protects whoever can remotely reconfigure your network, which matters just as much as the Wi-Fi password itself.
Not sure which 2FA method to use? Here is how the different options actually compare.
14. Use a Password Manager for Router and Wi-Fi Credentials
Between the Wi-Fi password, the router admin password, and any manufacturer account login, a home network involves more credentials than most people want to memorize. A password manager generates and stores long, unique passwords for each one, so you never reuse weak passwords or write them down somewhere insecure.
A closer look at what actually makes a password manager worth using.
15. Teach Your Household Safe Wi-Fi Habits
Technical settings only go so far if the people using the network undermine them.
Walk your household through the basics: use strong, unique passwords; avoid clicking suspicious links; and don’t share the Wi-Fi password outside the home without good reason. Awareness closes gaps that no router setting can.
How to Secure Your Wi-Fi Network: Quick Checklist
A condensed version of everything above, in the order it is easiest to work through:
- Change the router admin password and the Wi-Fi password
- Turn on WPA2 or WPA3 encryption (WPA3 if every device supports it)
- Rename the network (SSID) away from the default
- Update the router’s firmware, and turn on auto-updates if available
- Set up a guest network for visitors and IoT devices
- Turn off WPS and UPnP
- Turn off remote management unless you need it
- Confirm the router’s firewall is on
- Enable 2FA on the manufacturer account, if your router has one
- Review connected devices periodically for anything unfamiliar
Securing your network is one part of staying safe online – here is how to spot and stop scams too.
Our complete Windows 11 security checklist, with links to every security guide.
Frequently Asked Questions
How do I know if my Wi-Fi network has been hacked?
Watch for unusual network activity, noticeably slower internet speeds, or unfamiliar devices connected to your network. Checking your router’s connected-devices list periodically is the easiest way to catch this early.
Can using a public Wi-Fi network increase the risk of hacking?
Yes. Public Wi-Fi networks are often unsecured, making them prime targets for attackers. A VPN can help reduce this risk when you have to use one.
What should I do if I suspect my Wi-Fi network has been hacked?
Change your Wi-Fi and router admin passwords immediately, update the router’s firmware, and disconnect any devices you don’t recognize from the network.
Are all IoT devices vulnerable to hacking?
Not all, but many lack strong built-in security. Changing default passwords, keeping firmware updated, and isolating them on a guest or separate network meaningfully reduces the risk.
How often should I update my router firmware?
Install a firmware update whenever your router manufacturer releases one, ideally through automatic updates if your router supports them, so you always have the latest security patches.
