To secure a home network that is already running, list every device connected to it, update the router's firmware or replace the router if its maker has stopped supporting it, set a unique admin password, turn off remote administration, UPnP and WPS, use a filtering DNS resolver, and move smart devices and work laptops onto separate networks.
This guide is about hardening what you already have, in the order that finds problems fastest, with the evidence for each step. Setting up a new router on day one, choosing Wi-Fi encryption settings and improving coverage are separate jobs; they get a line here only where they matter.
Home network security in one checklist
Most of these steps take a few minutes in the router's admin page or app. The sections below explain each one.
| Step | Where you do it | What it prevents |
|---|---|---|
| 1. List every connected device | Router app or admin page | Unknown devices, and forgotten ones still online |
| 2. Confirm the router still gets firmware updates | Maker's support page | Known flaws that will never be fixed |
| 3. Set a unique admin password, remote admin off | Router admin page | Takeover of the router from the internet |
| 4. Turn off UPnP and WPS unless you use them | Router admin page | Ports opened without asking you, PIN guessing |
| 5. Check that the firewall is on | Router admin page | Unsolicited traffic from the internet |
| 6. Move smart devices to a guest network or VLAN | Router admin page | A compromised camera reaching your laptop |
| 7. Set a filtering DNS resolver, and check it stays | Router DNS settings, a test page | Malware and phishing domains, hijacked lookups |
| 8. Give work devices a network of their own | Router, plus the employer's IT team | A home compromise reaching the employer's data |
| 9. Repeat the checks every few months | Your calendar | New devices, new flaws, settings that have changed |
Take stock of every device on your network
You cannot protect a device you do not know is there. CISA's home network guidance includes watching for unknown devices joining your network, and the router already keeps the list. Open its app or admin page and find the section called connected devices, attached devices, clients or DHCP clients. Each entry shows a device name, a local IP address and a MAC address, the hardware address a device uses on the local network.
Go through the list and match every entry to something in the house. Unrecognized entries usually fall into one of three groups:
- A phone, tablet or computer using a private address. iPhones, iPads, Macs and other Apple devices identify themselves to each Wi-Fi network with a different address and may rotate it, so a familiar phone can show up as a new device.
- Something forgotten. An old tablet in a drawer, a smart plug, a printer, a games console or a TV that still connects every night.
- Something that should not be there. A neighbour who knows the Wi-Fi password, or a device someone added without telling you.
Look hardest at cheap streaming boxes and no-name gadgets. In March 2026 the FBI warned that criminals route their traffic through home connections turned into residential proxies, using compromised TV streaming devices, picture frames and projectors, and that some of these devices ship with malware that survives a factory reset. It singled out streaming boxes that promise free sports, TV shows and films.
Give every legitimate device a clear name in the router, so the next review takes a minute. Remove anything you no longer use, and if a device you cannot explain keeps appearing, change the Wi-Fi password and reconnect only what you recognize. Anything on the same network as your laptop can also attempt snooping on it, which is why an unexplained device matters more than the bandwidth it uses.
A network scanner gives a second view of the same list. Phone apps such as Fing do this, and on a computer Nmap's -sn option lists the hosts that respond without scanning their ports. Only scan networks you own:
# Replace the range with your own network's, shown in your router's LAN settings
nmap -sn 192.168.1.0/24
Check whether your router still gets updates
The router matters most because it faces the internet and every other device depends on it. When a router reaches end of life (EOL), its maker stops releasing firmware, and every flaw found after that date stays open. US agencies and their partners have warned about exactly this repeatedly since 2024:
- January 2024. The US Justice Department announced a court-authorized operation that removed malware from hundreds of US home and small office routers that the Chinese state group Volt Typhoon used to disguise its hacking. The vast majority were Cisco and NetGear routers vulnerable because they had reached end of life.
- May 2025. The FBI warned that criminal proxy services were exploiting end-of-life routers with variants of TheMoon malware, including routers with remote administration turned on. TheMoon needs no password: it scans for open ports and sends a command to a vulnerable script. The FBI added that routers dated 2010 or earlier are likely no longer updated.
- February 2026. CISA's Binding Operational Directive 26-02 ordered US federal civilian agencies to inventory end-of-support edge devices, a category that names routers, and to remove all of them within 18 months.
- April 2026. The FBI, the NSA and partners in 15 countries warned that Russia's military intelligence service, the GRU (APT28), had been compromising routers worldwide, including TP-Link models through CVE-2023-50224, and rewriting their DNS settings. The advice for home routers began with upgrading end-of-support devices.
A hijacked router usually goes unnoticed. It keeps working for you while it relays someone else's traffic, and the websites on the receiving end record your address, not the criminal's. Compromised routers are also recruited into botnets used for DDoS attacks, one of the outcomes the Canadian Centre for Cyber Security lists for a compromised router.
To check yours:
- Read the model number from the label on the router, along with a hardware version if the label shows one.
- Look it up on the maker's support site. The Canadian Centre for Cyber Security suggests checking the vendor's end-of-life product list, and treating a router with no update in several months as a candidate for replacement.
- Compare the firmware version in the router's admin page with the latest one listed, and install the update. Turn on automatic firmware updates if the router offers them.
- Ask your internet provider if it supplied the router. The FTC suggests checking whether the provider sends updates automatically.
Warning
Settings cannot make an unsupported router safe. If the maker lists your model as end of life, or has published no firmware for a long time, replace it, and set the new one up securely from day one rather than copying the old configuration across.
Lock down the router's admin access
The router has two passwords, and the FTC asks you to change both: the Wi-Fi password that devices join with, and the admin password that controls every setting, including the Wi-Fi password itself. Whoever holds the admin password can undo everything else in this guide.
- Use a unique, random admin password. The FBI recommends at least 16 and no more than 64 characters, never reused. Keep it in a password manager. Change the default admin username too, if the router has one.
- Protect the app account. If your router is managed through the maker's app and an online account, that account is the admin password: give it a unique password and turn on two-step verification if it is offered.
- Turn off remote administration. It may be called remote management, remote access or web access from WAN. Turn it off, save, and reboot, as the FBI advises. If you need to change settings while away, a maker's app that signs in through your account is usually a narrower door than an admin page open to the whole internet.
- Turn off management services you do not use. The Canadian Centre for Cyber Security recommends disabling SNMP, a management protocol that can hand out details of your network's configuration.
- Log out when you finish, so a session left open in a browser does not keep admin rights.
Manufacturers are being pushed the same way: a January 2024 Secure by Design alert from CISA and the FBI urged router makers to automate updates and to put the web management interface on the local network side by default. Until every router works that way, the setting is yours to check.
Turn off UPnP and WPS unless you need them
Routers ship with conveniences that make setup easier and the network weaker. The FTC recommends turning off remote management, WPS and UPnP; here is what the other two do.
| Feature | What it does | The risk | Keep it on only if |
|---|---|---|---|
| UPnP | Lets devices find each other and open paths through the router by themselves | Malware on the network can use it to bypass the router's firewall and open devices to remote control | A game, console or app you rely on fails without it, and you cannot forward its ports by hand |
| WPS | Joins a device with a button press or an eight-digit PIN | The PIN method can be guessed by someone within range | A device has no other way to join; use the button, briefly |
| Port forwards and DMZ | Sends traffic from the internet straight to one device | That device faces the internet directly, with no router in the way | You created the rule and still use it |
The UPnP and WPS risks are well documented. CISA explains that malware inside a network can use UPnP to get around the router's firewall, and that a design flaw in WPS PIN authentication tells an attacker when the first half of the eight-digit PIN is correct, which cuts the guessing work dramatically on the many routers that lack a proper lockout after failed attempts.
Expect one side effect: some games and voice chat apps complain about a strict NAT type once UPnP is off. Forward only the ports the game's publisher documents, to that one console, rather than switching UPnP back on for every device in the house.
Make sure the router firewall is on
Most routers have a built-in firewall, and the FTC asks you to confirm it is switched on. CISA notes that some firewall features, including the firewall itself, may be off by default, and that a well-configured firewall can also stop unwanted software inside the network from reaching out to the internet.
Three settings are worth a look while you are there:
- The firewall for IPv6. If your connection uses IPv6, devices can have globally reachable addresses, and the address translation that incidentally shields IPv4 devices does not apply. Make sure the IPv6 firewall blocks unsolicited inbound connections.
- Port forwards and DMZ. Delete any rule you do not recognize or no longer need. An unexplained rule is also a sign of tampering.
- Firewalls on the devices themselves. A router firewall does nothing about a laptop infected on another network and brought home. Keep each computer's own firewall turned on, and keep every device updated.
Put smart home devices on their own network
Smart devices are often the weakest part of a home network. The UK's National Cyber Security Centre warns that without security updates they become easier to hack, and that a criminal who can guess a device's password can use it to reach your network. Moving them to a separate network does not make a camera any safer, but it limits what a compromised camera can reach.
The Canadian Centre for Cyber Security's guest Wi-Fi guidance describes this directly: smart devices need the internet, but not direct access to your main network, and a guest network or a set of VLANs keeps them apart. You have three ways to do it:
| Option | What you need | Separation | Good for |
|---|---|---|---|
| Guest network | Almost any current router | Good, if guests are blocked from the local network | Most homes |
| A dedicated smart home Wi-Fi | A router or mesh system that offers one | Depends on the router's rules | Homes with many smart devices |
| VLANs | A router, switch and access points that support them | Strongest, with rules you write yourself | Home offices and anyone comfortable with network settings |
Whatever you choose, check the isolation instead of assuming it. The Canadian guidance asks you to make sure devices on the guest network cannot interact with devices on the main one, and to use a separate password for it. Then move the devices over: cameras, doorbells, TVs and streaming boxes, speakers, plugs, bulbs, thermostats and robot vacuums.
Expect one trade-off. Phones find casting targets, speakers and printers on the local network, so separating them can break casting or local control. Keep the handful of devices you control directly from your phone where they work, and move everything that only talks to its maker's cloud service. For choosing, configuring and retiring the devices themselves, see our guide to AI smart home devices.
Filter DNS, and check nobody has changed it
Every device on your network turns names like example.com into IP addresses by asking a DNS resolver, usually whichever one the router hands out. That makes the router's DNS setting both a cheap place to add protection and a valuable target.
Use a resolver that blocks malicious domains
Protective DNS services refuse to resolve domains known to host malware or phishing. Quad9 aggregates threat intelligence from public and private sources and blocks those domains; it does no content filtering. Cloudflare's 1.1.1.1 for Families blocks malware and phishing domains, optionally adult content as well, and answers a blocked lookup with 0.0.0.0 so the device never connects.
| Resolver | IPv4 | IPv6 | How to confirm it works |
|---|---|---|---|
| Quad9 (malware blocking, DNSSEC) | 9.9.9.9, 149.112.112.112 | 2620:fe::fe, 2620:fe::9 | Visit on.quad9.net: "Yes" or "No" |
| Cloudflare, block malware | 1.1.1.2, 1.0.0.2 | 2606:4700:4700::1112, 2606:4700:4700::1002 | malware.testcategory.com must fail to load |
| Cloudflare, malware and adult content | 1.1.1.3, 1.0.0.3 | 2606:4700:4700::1113, 2606:4700:4700::1003 | nudity.testcategory.com must fail to load |
Set the resolver in the router's internet (WAN) or DHCP settings, so every device inherits it, and enter every address listed: Quad9's own setup notes warn that using only one leaves you exposed if that path fails. Then confirm it from a device with the test in the table: on.quad9.net for Quad9, Cloudflare's test domains for 1.1.1.1 for Families, and 1.1.1.1/help if you use Cloudflare's plain 1.1.1.1. A browser or device configured with its own encrypted DNS ignores the router's choice, so set it there too if you want the filtering everywhere.
Check for DNS settings changed by malware
Attackers change DNS for the same reason you do: one setting affects every device. In the campaign the FBI described in April 2026, GRU actors changed routers' DHCP and DNS settings to point at resolvers they controlled. Laptops and phones inherited the change, and the resolvers gave fraudulent answers for chosen services, including Microsoft Outlook Web Access. That enabled adversary-in-the-middle attacks on encrypted traffic whenever a user clicked through the certificate warning, and the GRU harvested passwords, authentication tokens and emails this way. It is a form of eavesdropping that defeats encryption only when someone accepts the warning.
To check yours:
- Look at the router. Open the internet (WAN) settings and the DHCP or LAN settings, and read the DNS servers. They should be empty or automatic (your provider's), or the resolver you chose. An address you did not set is a reason to act.
- Look at a device. On Windows,
ipconfig /alldisplays the full TCP/IP configuration, including the DNS servers for each adapter. On a Mac, open System Settings, then Network, the network service, Details and DNS. Seeing the router's own local address there is normal: the router forwards the questions, so check the router as well. - Run your resolver's test, as above. If you set Quad9 and on.quad9.net says no, something between you and Quad9 has changed.
Important
Do not click through a certificate warning on a site you use every day, such as your email or bank. On a network whose DNS has been changed, that warning is often the only visible sign of the attack. Close the page, and check the router from a device you trust.
If the setting was changed, assume the router is compromised: reset it to factory settings, install the latest firmware, set a new admin password, turn off remote administration and put your resolver back. If the model is out of support, replace it. Then change the passwords of accounts you signed in to since the change, from a network you trust.
Check the security labels before you add another device
Every new device is another thing to audit, so the best time to check its security is before you buy it. Two rules matter as of September 2026:
- UK: the PSTI regime. Since 29 April 2024, manufacturers of consumer connectable products sold in the UK must meet three requirements. Passwords must be unique per product or set by the user, and not based on counters, public information or serial numbers. The maker must say how to report security issues and when to expect a response. And it must publish the minimum period of security updates, with an end date, in terms a non-technical buyer can follow. The NCSC suggests treating that support end date as a use-by date.
- US: the Cyber Trust Mark. The FCC adopted rules in March 2024 for a voluntary label for consumer wireless IoT products, with a QR code that will show details such as the product's support period and whether updates are automatic. The program is still being set up: its first lead administrator, UL Solutions, withdrew effective December 19, 2025, the FCC named the ioXt Alliance effective April 13, 2026, and on August 11, 2026 it opened a filing window for label administrators. The FCC says it will announce when products can apply for the label, so no product can carry it yet. The program also leaves out computers, smartphones and routers; the FCC notes that NIST is working on requirements for consumer routers.
Until labels are common, do the check yourself: find the support end date on the maker's site, prefer devices that update automatically, and plan to replace or isolate a device once its support ends. Our smart home guide also covers the EU's rules.
If you work from home, keep work devices on their own network
A home network that carries work is a target for more than home data. The Canadian Centre for Cyber Security's remote work tips say it plainly: where possible, work only from devices your employer assigns, and remember that a router in your home, which your organization does not support, is yours to secure and maintain. Its guest Wi-Fi guidance lists isolating company access and devices as one use of a separate network at home.
In practice:
- Give the work laptop its own network where the router allows it: a separate Wi-Fi network or VLAN that nothing else in the house joins. If the router can create only one extra network, use it for the smart devices, so the work laptop at least never shares a network with them.
- Let the employer's IT team manage the device. Updates, disk encryption, the VPN and security software are theirs to configure. Do not install personal software on it, lend it to family members or switch its protections off to make something work.
- Use the employer's VPN or approved access for work systems, and report a lost or stolen device to the help desk straight away, as the Canadian guidance advises.
- Tell IT about the home network if you are unsure your router is supported. The same guidance suggests contacting your IT department when in doubt.
The FBI's April 2026 warning about hijacked routers made the same point from the employer's side: organizations that allow remote work should review how employees reach sensitive data, for example through VPNs and hardened application settings, and may consider helping staff upgrade outdated personal devices used for remote access.
If you run the business, our IT support service enrols staff laptops and phones in device management, with Microsoft Intune or Jamf, disk encryption, compliance policies and remote lock and wipe. Our checklist of cybersecurity best practices for small business covers the rest of the baseline.
Keep it secure: a routine for every few months
A home network drifts. New devices join, firmware ages and settings change after a reset or a replacement. Put a reminder in your calendar and repeat the short version:
- Check the router's firmware version and support status, and install updates.
- Review the client list and name or remove anything new.
- Confirm that remote administration, UPnP and WPS are still off and that no unexpected port forwards exist.
- Read the router's DNS settings and run your resolver's test page.
- Reboot the router. The Canadian Centre for Cyber Security suggests routine reboots, because a reboot clears memory and may disrupt implanted malware.
- Update smart devices and retire the ones whose support has ended.
Know the signs of trouble as well. The FBI lists overheating, connection problems and settings you do not recognize as common signs of router malware. If you see them, apply any firmware update, change the admin password and reboot, as the FBI advises, or reset the router and configure it again; if it is out of support, replace it.
If you run a small business and want the same outside view of everything it exposes online, our security testing service discovers domains, IP ranges and cloud accounts from the outside and ranks what it finds by real risk.
