Home Network Security: The Router Nobody Configures

Additional resource for the lesson “Home Internet Security: Starting With the Router” — Online Security course

The box the internet provider left in the hallway is the most important device in the house, and almost nobody has opened its settings. Home network security starts there, with four changes that take twenty minutes and then hold for years.

A. Why this matters

Your home is not automatically safe because the Wi-Fi has a password. The router, and everything connected to it — computers, phones, a smart TV, a speaker, perhaps a camera or a thermostat — form a small network, and it usually runs exactly as it was delivered.

That matters for two reasons. The router sees all the traffic in the house. And the connected devices vary enormously in how well they are built and how long they are supported.

B. Key concepts

Seven ideas, most of which are single settings.

The router’s administrator password

Separate from the Wi-Fi password. It is the one that lets you into the router’s own settings, and it is often still the default printed on a label.

Why it matters to you: This is the first thing to change and the one most often missed. The Wi-Fi password protects the network; this one protects the network’s controls.

The Wi-Fi password and network name

The password devices use to join, and the name the network broadcasts.

Why it matters to you: Change both from the factory defaults. A default network name tells anyone nearby the exact model, which tells them which known flaws to try.

WPA2 and WPA3

The encryption protecting the wireless connection.

Why it matters to you: Set to WPA3 if the router offers it, WPA2 otherwise. If WEP is still an option in use, this is the moment to change it.

Router firmware updates

The router’s own software, which receives security fixes like anything else.

Why it matters to you: Most modern routers can update themselves — the setting is usually off. This is the single most neglected update in most homes.

The guest network

A second Wi-Fi network, separate from the main one, that most routers can create.

Why it matters to you: Useful for two things: visitors, and connected devices you do not fully trust. A smart bulb on the guest network cannot reach your laptop.

Settings worth switching off

WPS, the one-button pairing feature, and UPnP, which lets devices open ports by themselves.

Why it matters to you: Both trade security for convenience in ways that are rarely worth it at home. Turning them off is a two-minute change with no practical downside.

Connected devices

Smart TVs, speakers, cameras, thermostats, appliances.

Why it matters to you: Each one is a small computer with its own support lifetime. Changing default passwords and keeping them updated matters as much here as on a phone.

C. A practical example: twenty minutes, four settings

A typical household: a router installed by the provider three years ago and never opened since.

What is usually found

• The administrator password is still the one on the label.
• The network name still identifies the provider and the model.
• Firmware auto-update is available and switched off.
• WPS is enabled, and there are eleven devices connected — two of which nobody can immediately identify.

What changes

• A new administrator password, stored in the password manager.
• A network name that says nothing about the hardware.
• Automatic firmware updates on.
• WPS and UPnP off.
• A guest network created, and the TV, speaker and thermostat moved onto it.

The two unidentified devices turn out to be a printer and an old tablet. Which is the usual outcome — and worth confirming rather than assuming.

D. Try it yourself: the router session

Twenty minutes, once. Have your password manager open before you start.

Step 1 — Get in

• The address is usually printed on the router, or is 192.168.1.1 or similar.
• Sign in with the current administrator credentials, also usually on the label.

Step 2 — Change the two passwords

• The administrator password: long, unique, generated, stored in your manager.
• The Wi-Fi password: same treatment, and note that changing it means reconnecting your devices.

Step 3 — The four settings

• Encryption: WPA3 if available, otherwise WPA2.
• Firmware: automatic updates on.
• WPS: off.
• UPnP: off, unless something specific stops working — a games console occasionally needs it.

Step 4 — Create a guest network

• Give it its own password.
• Move connected devices onto it: TV, speaker, thermostat, anything that does not need to reach your computers.

Step 5 — Look at the device list

• Most routers show everything currently connected.
• Identify each one. The companion resource on attack surface covers what to do with the list.

Step 4 is the one people skip and the one that pays back most: it separates the devices you cannot fully control from the ones holding your work and your accounts.

E. Videos, articles and further resources

Independent and institutional sources in English.

CISA — Securing your home Wi-Fi
The settings covered above, documented step by step by the US cyber security agency.
https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5

NCSC (UK) — Smart devices: using them safely in your home
What to change when a connected device arrives, and what to check before buying one.
https://www.ncsc.gov.uk/guidance/smart-devices-in-the-home

FTC — Online privacy and security
Consumer-facing advice on protecting your identity, securing your home network and browsing safely.
https://consumer.ftc.gov/identity-theft-and-online-security/online-privacy-and-security

NCSC (UK) — Cyber security advice for you and your family
The UK national authority’s advice hub for individuals: short, practical guidance written for people who are not IT professionals.
https://www.ncsc.gov.uk/section/advice-guidance/you-your-family

CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world

NCSC (UK) — Install the latest software and app updates
Why the router’s own firmware belongs in your update routine.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/install-the-latest-software-and-app-updates

Links checked in August 2026. Your provider documents its own router models, and the settings above appear under different names depending on the manufacturer.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior

This lesson sits at level FL3 on the Awareness pillar: it asks you to see the home as a network rather than as a Wi-Fi password.

Skills

• Accessing router settings and changing the administrator password.
• Setting encryption, firmware updates and disabling WPS and UPnP.
• Creating a guest network and assigning devices to it.

For professionals and organizations

• Extending the same expectations to home working setups, where the household router carries company traffic.

Awareness

• Understanding that the router sees everything and is usually unconfigured.
• Recognising connected devices as small computers with their own support lifetimes.
• Knowing that a default network name identifies the hardware.

For future instructors and ambassadors

• Asking how many people have opened their router settings. The answer makes the point without argument.

Secure Behavior

• Changing router defaults on installation rather than eventually.
• Keeping connected devices on a separate network.
• Checking the connected device list occasionally.

For organizations

• Providing guidance on home network setup for remote workers (R11, MS10).

G. Questions to sit with

1. Have you ever opened your router’s settings page?
2. Is the administrator password still the one printed on the device?
3. How many devices are connected to your home network right now? Could you name them all?
4. Does your router update its own firmware, or has it been running the same version since installation?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply to the network at home.

The router

• R1, R2, R3 — The administrator and Wi-Fi passwords are credentials like any other: unique, long, in a manager.
• R6 — Keep the firmware updated, with automatic updates on.
• R9 — Connect over HTTPS only, including when accessing the router itself.

The devices on it

• MS10 — Consider a VPN at router level for a more advanced setup.
• R6 — Keep connected devices updated, and check whether they still receive updates at all.
• MS7 — Review the permissions of the apps controlling smart devices.

Minimum commitment: A guest network for connected devices is not in the framework, and is the single most effective step here.

In short

• The router’s administrator password is separate from the Wi-Fi password, and usually still the default.
• Firmware auto-update is normally available and normally switched off.
• A guest network separates devices you cannot control from those you depend on.
• WPS and UPnP trade security for convenience in ways rarely worth it at home.

Related resources in this course

The network, and how exposed it is:

• Attack Surface: Understanding and Protecting Your Home Network
• Wi-Fi Security: When a Connection Is Safe Enough
• Setting Up a VPN on Your Home Router

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.