# How to secure your home network: harden the router and devices you already have

> Secure the home network you already run: list every device, update or replace the router, switch off risky features, filter DNS and isolate smart devices.

- URL: https://computese.com/how-to-secure-your-home-network/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-08-14
- Updated: 2026-09-25
- Topics: Security, IT support

## In short
- Securing a home network you already run comes down to four jobs: know every device on it, keep the router supported and patched, close the features that expose it, and keep smart devices and work laptops off the network your computers use.
- Replace a router that no longer gets firmware updates. The FBI warned in May 2025 that end-of-life routers were being turned into criminal proxies, and in April 2026 that Russian military intelligence was changing routers' DNS settings.
- Turn off remote administration, UPnP and WPS unless you use them, confirm the router firewall is on, and set a filtering DNS resolver such as Quad9 or Cloudflare's 1.1.1.2, then check now and then that nobody has changed it.
- Put cameras, TVs and other smart devices on a guest network or VLAN, and give an employer's laptop a network of its own, managed by the employer's IT team.
- As of September 2026, UK law requires smart products to publish a security support end date, while the US Cyber Trust Mark is not yet on any product: check the support period yourself before you buy.

To secure a home network that is already running, list every device connected to it, update the router's firmware or replace the router if its maker has stopped supporting it, set a unique admin password, turn off remote administration, UPnP and WPS, use a filtering DNS resolver, and move smart devices and work laptops onto separate networks.

This guide is about hardening what you already have, in the order that finds problems fastest, with the evidence for each step. [Setting up a new router on day one](https://computese.com/how-to-set-up-secure-home-network/), choosing [Wi-Fi encryption settings](https://computese.com/how-to-set-up-secure-home-wi-fi-network/) and [improving coverage](https://computese.com/how-to-improve-wi-fi-signal-strength/) are separate jobs; they get a line here only where they matter.

## Home network security in one checklist

Most of these steps take a few minutes in the router's admin page or app. The sections below explain each one.

| Step                                                | Where you do it                     | What it prevents                                   |
| --------------------------------------------------- | ----------------------------------- | -------------------------------------------------- |
| 1. List every connected device                      | Router app or admin page            | Unknown devices, and forgotten ones still online   |
| 2. Confirm the router still gets firmware updates   | Maker's support page                | Known flaws that will never be fixed               |
| 3. Set a unique admin password, remote admin off    | Router admin page                   | Takeover of the router from the internet           |
| 4. Turn off UPnP and WPS unless you use them        | Router admin page                   | Ports opened without asking you, PIN guessing      |
| 5. Check that the firewall is on                    | Router admin page                   | Unsolicited traffic from the internet              |
| 6. Move smart devices to a guest network or VLAN    | Router admin page                   | A compromised camera reaching your laptop          |
| 7. Set a filtering DNS resolver, and check it stays | Router DNS settings, a test page    | Malware and phishing domains, hijacked lookups     |
| 8. Give work devices a network of their own         | Router, plus the employer's IT team | A home compromise reaching the employer's data     |
| 9. Repeat the checks every few months               | Your calendar                       | New devices, new flaws, settings that have changed |

## Take stock of every device on your network

You cannot protect a device you do not know is there. [CISA's home network guidance](https://www.cisa.gov/news-events/news/home-network-security) includes watching for unknown devices joining your network, and the router already keeps the list. Open its app or admin page and find the section called connected devices, attached devices, clients or DHCP clients. Each entry shows a device name, a local IP address and a MAC address, the hardware address a device uses on the local network.

Go through the list and match every entry to something in the house. Unrecognized entries usually fall into one of three groups:

- **A phone, tablet or computer using a private address.** iPhones, iPads, Macs and other Apple devices [identify themselves to each Wi-Fi network with a different address](https://support.apple.com/en-us/102509) and may rotate it, so a familiar phone can show up as a new device.
- **Something forgotten.** An old tablet in a drawer, a smart plug, a printer, a games console or a TV that still connects every night.
- **Something that should not be there.** A neighbour who knows the Wi-Fi password, or a device someone added without telling you.

Look hardest at cheap streaming boxes and no-name gadgets. In March 2026 the FBI warned that criminals route their traffic through [home connections turned into residential proxies](https://www.ic3.gov/PSA/2026/PSA260312), using compromised TV streaming devices, picture frames and projectors, and that some of these devices ship with malware that survives a factory reset. It singled out streaming boxes that promise free sports, TV shows and films.

Give every legitimate device a clear name in the router, so the next review takes a minute. Remove anything you no longer use, and if a device you cannot explain keeps appearing, change the Wi-Fi password and reconnect only what you recognize. Anything on the same network as your laptop can also attempt [snooping](https://computese.com/understanding-snooping-attacks-how-they-work/) on it, which is why an unexplained device matters more than the bandwidth it uses.

A network scanner gives a second view of the same list. Phone apps such as Fing do this, and on a computer Nmap's `-sn` option [lists the hosts that respond without scanning their ports](https://nmap.org/book/man-host-discovery.html). Only scan networks you own:

```bash
# Replace the range with your own network's, shown in your router's LAN settings
nmap -sn 192.168.1.0/24
```

## Check whether your router still gets updates

The router matters most because it faces the internet and every other device depends on it. When a router reaches end of life (EOL), its maker stops releasing firmware, and every flaw found after that date stays open. US agencies and their partners have warned about exactly this repeatedly since 2024:

- **January 2024.** The US Justice Department announced a court-authorized operation that [removed malware from hundreds of US home and small office routers](https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical) that the Chinese state group Volt Typhoon used to disguise its hacking. The vast majority were Cisco and NetGear routers vulnerable because they had reached end of life.
- **May 2025.** The FBI warned that [criminal proxy services were exploiting end-of-life routers](https://www.ic3.gov/PSA/2025/PSA250507) with variants of TheMoon malware, including routers with remote administration turned on. TheMoon needs no password: it scans for open ports and sends a command to a vulnerable script. The FBI added that routers dated 2010 or earlier are likely no longer updated.
- **February 2026.** CISA's [Binding Operational Directive 26-02](https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices) ordered US federal civilian agencies to inventory end-of-support edge devices, a category that names routers, and to remove all of them within 18 months.
- **April 2026.** The FBI, the NSA and partners in 15 countries warned that Russia's military intelligence service, the GRU (APT28), had been [compromising routers worldwide](https://www.ic3.gov/PSA/2026/PSA260407), including TP-Link models through CVE-2023-50224, and rewriting their DNS settings. The advice for home routers began with upgrading end-of-support devices.

A hijacked router usually goes unnoticed. It keeps working for you while it relays someone else's traffic, and the websites on the receiving end record your address, not the criminal's. Compromised routers are also recruited into [botnets used for DDoS attacks](https://computese.com/understanding-ddos-attacks-how-they-work/), one of the outcomes the [Canadian Centre for Cyber Security lists](https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019) for a compromised router.

![An old router inside a house outline relays a stranger's traffic: a dashed line runs from a distant laptop through the internet cloud into the orange router and out again to a server.](https://computese.com/images/blog/how-to-secure-your-home-network/proxy.7b6057fd75-1536.webp)

*When criminals hijack an unsupported router, their traffic reaches its targets from your home's address.*

To check yours:

1. **Read the model number** from the label on the router, along with a hardware version if the label shows one.
2. **Look it up on the maker's support site.** The Canadian Centre for Cyber Security suggests [checking the vendor's end-of-life product list](https://www.cyber.gc.ca/en/guidance/cyber-security-tips-remote-work-itsap10116), and treating a router with no update in several months as a candidate for replacement.
3. **Compare the firmware version** in the router's admin page with the latest one listed, and install the update. Turn on automatic firmware updates if the router offers them.
4. **Ask your internet provider** if it supplied the router. The [FTC](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network) suggests checking whether the provider sends updates automatically.

> [!WARNING]
> Settings cannot make an unsupported router safe. If the maker lists your model as end of life, or has published no firmware for a long time, replace it, and set the new one up securely from day one rather than copying the old configuration across.

## Lock down the router's admin access

The router has two passwords, and the [FTC](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network) asks you to change both: the Wi-Fi password that devices join with, and the admin password that controls every setting, including the Wi-Fi password itself. Whoever holds the admin password can undo everything else in this guide.

- **Use a unique, random admin password.** The FBI recommends [at least 16 and no more than 64 characters](https://www.ic3.gov/PSA/2025/PSA250507), never reused. Keep it in a password manager. Change the default admin username too, if the router has one.
- **Protect the app account.** If your router is managed through the maker's app and an online account, that account is the admin password: give it a unique password and turn on two-step verification if it is offered.
- **Turn off remote administration.** It may be called remote management, remote access or web access from WAN. Turn it off, save, and reboot, as the FBI advises. If you need to change settings while away, a maker's app that signs in through your account is usually a narrower door than an admin page open to the whole internet.
- **Turn off management services you do not use.** The Canadian Centre for Cyber Security recommends [disabling SNMP](https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019), a management protocol that can hand out details of your network's configuration.
- **Log out when you finish,** so a session left open in a browser does not keep admin rights.

Manufacturers are being pushed the same way: a January 2024 [Secure by Design alert from CISA and the FBI](https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-and-fbi-release-secure-design-alert-urging-manufacturers-eliminate-defects-soho-routers) urged router makers to automate updates and to put the web management interface on the local network side by default. Until every router works that way, the setting is yours to check.

## Turn off UPnP and WPS unless you need them

Routers ship with conveniences that make setup easier and the network weaker. The [FTC](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network) recommends turning off remote management, WPS and UPnP; here is what the other two do.

| Feature               | What it does                                                                 | The risk                                                                                             | Keep it on only if                                                                            |
| --------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- |
| UPnP                  | Lets devices find each other and open paths through the router by themselves | Malware on the network can use it to bypass the router's firewall and open devices to remote control | A game, console or app you rely on fails without it, and you cannot forward its ports by hand |
| WPS                   | Joins a device with a button press or an eight-digit PIN                     | The PIN method can be guessed by someone within range                                                | A device has no other way to join; use the button, briefly                                    |
| Port forwards and DMZ | Sends traffic from the internet straight to one device                       | That device faces the internet directly, with no router in the way                                   | You created the rule and still use it                                                         |

The UPnP and WPS risks are well documented. [CISA explains](https://www.cisa.gov/news-events/news/home-network-security) that malware inside a network can use UPnP to get around the router's firewall, and that a design flaw in WPS PIN authentication tells an attacker when the first half of the eight-digit PIN is correct, which cuts the guessing work dramatically on the many routers that lack a proper lockout after failed attempts.

Expect one side effect: some games and voice chat apps complain about a strict NAT type once UPnP is off. Forward only the ports the game's publisher documents, to that one console, rather than switching UPnP back on for every device in the house.

## Make sure the router firewall is on

Most routers have a built-in firewall, and the [FTC](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network) asks you to confirm it is switched on. [CISA notes](https://www.cisa.gov/news-events/news/home-network-security) that some firewall features, including the firewall itself, may be off by default, and that a well-configured firewall can also stop unwanted software inside the network from reaching out to the internet.

Three settings are worth a look while you are there:

- **The firewall for IPv6.** If your connection uses IPv6, devices can have globally reachable addresses, and the address translation that incidentally shields IPv4 devices does not apply. Make sure the IPv6 firewall blocks unsolicited inbound connections.
- **Port forwards and DMZ.** Delete any rule you do not recognize or no longer need. An unexplained rule is also a sign of tampering.
- **Firewalls on the devices themselves.** A router firewall does nothing about a laptop infected on another network and brought home. Keep each computer's own firewall turned on, and [keep every device updated](https://computese.com/how-to-update-your-computer-or-phone/).

## Put smart home devices on their own network

Smart devices are often the weakest part of a home network. The UK's [National Cyber Security Centre](https://www.ncsc.gov.uk/guidance/smart-devices-in-the-home) warns that without security updates they become easier to hack, and that a criminal who can guess a device's password can use it to reach your network. Moving them to a separate network does not make a camera any safer, but it limits what a compromised camera can reach.

The [Canadian Centre for Cyber Security's guest Wi-Fi guidance](https://www.cyber.gc.ca/en/guidance/guest-wi-fi-itsap80023) describes this directly: smart devices need the internet, but not direct access to your main network, and a guest network or a set of VLANs keeps them apart. You have three ways to do it:

| Option                       | What you need                                        | Separation                                         | Good for                                                  |
| ---------------------------- | ---------------------------------------------------- | -------------------------------------------------- | --------------------------------------------------------- |
| Guest network                | Almost any current router                            | Good, if guests are blocked from the local network | Most homes                                                |
| A dedicated smart home Wi-Fi | A router or mesh system that offers one              | Depends on the router's rules                      | Homes with many smart devices                             |
| VLANs                        | A router, switch and access points that support them | Strongest, with rules you write yourself           | Home offices and anyone comfortable with network settings |

Whatever you choose, check the isolation instead of assuming it. The Canadian guidance asks you to make sure devices on the guest network cannot interact with devices on the main one, and to use a separate password for it. Then move the devices over: cameras, doorbells, TVs and streaming boxes, speakers, plugs, bulbs, thermostats and robot vacuums.

Expect one trade-off. Phones find casting targets, speakers and printers on the local network, so separating them can break casting or local control. Keep the handful of devices you control directly from your phone where they work, and move everything that only talks to its maker's cloud service. For choosing, configuring and retiring the devices themselves, see our guide to [AI smart home devices](https://computese.com/how-ai-driven-smart-home-devices/).

## Filter DNS, and check nobody has changed it

Every device on your network turns names like `example.com` into IP addresses by asking a DNS resolver, usually whichever one the router hands out. That makes the router's DNS setting both a cheap place to add protection and a valuable target.

### Use a resolver that blocks malicious domains

Protective DNS services refuse to resolve domains known to host malware or phishing. [Quad9](https://quad9.net/support/faq/) aggregates threat intelligence from public and private sources and blocks those domains; it does no content filtering. [Cloudflare's 1.1.1.1 for Families](https://developers.cloudflare.com/1.1.1.1/setup/) blocks malware and phishing domains, optionally adult content as well, and answers a blocked lookup with `0.0.0.0` so the device never connects.

| Resolver                              | IPv4                     | IPv6                                       | How to confirm it works                    |
| ------------------------------------- | ------------------------ | ------------------------------------------ | ------------------------------------------ |
| Quad9 (malware blocking, DNSSEC)      | 9.9.9.9, 149.112.112.112 | 2620:fe::fe, 2620:fe::9                    | Visit on.quad9.net: "Yes" or "No"          |
| Cloudflare, block malware             | 1.1.1.2, 1.0.0.2         | 2606:4700:4700::1112, 2606:4700:4700::1002 | malware.testcategory.com must fail to load |
| Cloudflare, malware and adult content | 1.1.1.3, 1.0.0.3         | 2606:4700:4700::1113, 2606:4700:4700::1003 | nudity.testcategory.com must fail to load  |

Set the resolver in the router's internet (WAN) or DHCP settings, so every device inherits it, and enter every address listed: [Quad9's own setup notes](https://quad9.net/service/service-addresses-and-features/) warn that using only one leaves you exposed if that path fails. Then confirm it from a device with the test in the table: [on.quad9.net](https://quad9.net/support/faq/) for Quad9, Cloudflare's test domains for 1.1.1.1 for Families, and [1.1.1.1/help](https://developers.cloudflare.com/1.1.1.1/check/) if you use Cloudflare's plain 1.1.1.1. A browser or device configured with its own encrypted DNS ignores the router's choice, so set it there too if you want the filtering everywhere.

### Check for DNS settings changed by malware

Attackers change DNS for the same reason you do: one setting affects every device. In the campaign the FBI described in April 2026, [GRU actors changed routers' DHCP and DNS settings](https://www.ic3.gov/PSA/2026/PSA260407) to point at resolvers they controlled. Laptops and phones inherited the change, and the resolvers gave fraudulent answers for chosen services, including Microsoft Outlook Web Access. That enabled adversary-in-the-middle attacks on encrypted traffic whenever a user clicked through the certificate warning, and the GRU harvested passwords, authentication tokens and emails this way. It is a form of [eavesdropping](https://computese.com/understanding-eavesdropping-attacks-how-they-work/) that defeats encryption only when someone accepts the warning.

![A laptop and a phone send a lookup to the home router, whose settings now point to an orange rogue DNS server instead of the usual resolver. Its answer leads the phone to a look-alike server with an open padlock.](https://computese.com/images/blog/how-to-secure-your-home-network/dns.c47b3ab3eb-1536.webp)

*Change one setting on the router and every device that trusts it gets the attacker's answers.*

To check yours:

1. **Look at the router.** Open the internet (WAN) settings and the DHCP or LAN settings, and read the DNS servers. They should be empty or automatic (your provider's), or the resolver you chose. An address you did not set is a reason to act.
2. **Look at a device.** On Windows, `ipconfig /all` [displays the full TCP/IP configuration](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig), including the DNS servers for each adapter. On a Mac, open System Settings, then Network, the network service, Details and [DNS](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac). Seeing the router's own local address there is normal: the router forwards the questions, so check the router as well.
3. **Run your resolver's test**, as above. If you set Quad9 and on.quad9.net says no, something between you and Quad9 has changed.

> [!IMPORTANT]
> Do not click through a certificate warning on a site you use every day, such as your email or bank. On a network whose DNS has been changed, that warning is often the only visible sign of the attack. Close the page, and check the router from a device you trust.

If the setting was changed, assume the router is compromised: reset it to factory settings, install the latest firmware, set a new admin password, turn off remote administration and put your resolver back. If the model is out of support, replace it. Then change the passwords of accounts you signed in to since the change, from a network you trust.

## Check the security labels before you add another device

Every new device is another thing to audit, so the best time to check its security is before you buy it. Two rules matter as of September 2026:

- **UK: the PSTI regime.** Since [29 April 2024](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime), manufacturers of consumer connectable products sold in the UK must meet three requirements. Passwords must be unique per product or set by the user, and not based on counters, public information or serial numbers. The maker must say how to report security issues and when to expect a response. And it must publish the minimum period of security updates, with an end date, in terms a non-technical buyer can follow. The NCSC suggests treating that [support end date as a use-by date](https://www.ncsc.gov.uk/guidance/smart-devices-in-the-home).
- **US: the Cyber Trust Mark.** The FCC adopted rules in March 2024 for a voluntary label for consumer wireless IoT products, with a QR code that will show details such as the product's support period and whether updates are automatic. The program is still being set up: its first lead administrator, UL Solutions, [withdrew effective December 19, 2025](https://docs.fcc.gov/public/attachments/DA-26-18A1.pdf), the FCC named the ioXt Alliance effective April 13, 2026, and on August 11, 2026 it opened a filing window for label administrators. The [FCC says](https://www.fcc.gov/CyberTrustMark) it will announce when products can apply for the label, so no product can carry it yet. The program also leaves out computers, smartphones and routers; the FCC notes that NIST is working on requirements for consumer routers.

Until labels are common, do the check yourself: find the support end date on the maker's site, prefer devices that update automatically, and plan to replace or isolate a device once its support ends. Our [smart home guide](https://computese.com/how-ai-driven-smart-home-devices/) also covers the EU's rules.

## If you work from home, keep work devices on their own network

A home network that carries work is a target for more than home data. The Canadian Centre for Cyber Security's [remote work tips](https://www.cyber.gc.ca/en/guidance/cyber-security-tips-remote-work-itsap10116) say it plainly: where possible, work only from devices your employer assigns, and remember that a router in your home, which your organization does not support, is yours to secure and maintain. Its [guest Wi-Fi guidance](https://www.cyber.gc.ca/en/guidance/guest-wi-fi-itsap80023) lists isolating company access and devices as one use of a separate network at home.

In practice:

1. **Give the work laptop its own network** where the router allows it: a separate Wi-Fi network or VLAN that nothing else in the house joins. If the router can create only one extra network, use it for the smart devices, so the work laptop at least never shares a network with them.
2. **Let the employer's IT team manage the device.** Updates, disk encryption, the VPN and security software are theirs to configure. Do not install personal software on it, lend it to family members or switch its protections off to make something work.
3. **Use the employer's VPN or approved access** for work systems, and report a lost or stolen device to the help desk straight away, as the Canadian guidance advises.
4. **Tell IT about the home network** if you are unsure your router is supported. The same guidance suggests contacting your IT department when in doubt.

The FBI's April 2026 warning about hijacked routers made the same point from the employer's side: organizations that allow remote work should [review how employees reach sensitive data](https://www.ic3.gov/PSA/2026/PSA260407), for example through VPNs and hardened application settings, and may consider helping staff upgrade outdated personal devices used for remote access.

![One home router serves two separate networks: a camera, TV and speaker on one side, and a work laptop alone on the other, whose orange tunnel runs through the internet to an office server.](https://computese.com/images/blog/how-to-secure-your-home-network/work.e6098a4187-1536.webp)

*A separate network and the employer's own tunnel keep a compromised camera at home away from work accounts.*

If you run the business, our [IT support service](https://computese.com/services/it-support/) enrols staff laptops and phones in device management, with Microsoft Intune or Jamf, disk encryption, compliance policies and remote lock and wipe. Our checklist of [cybersecurity best practices for small business](https://computese.com/cybersecurity-best-practices/) covers the rest of the baseline.

## Keep it secure: a routine for every few months

A home network drifts. New devices join, firmware ages and settings change after a reset or a replacement. Put a reminder in your calendar and repeat the short version:

1. Check the router's firmware version and support status, and install updates.
2. Review the client list and name or remove anything new.
3. Confirm that remote administration, UPnP and WPS are still off and that no unexpected port forwards exist.
4. Read the router's DNS settings and run your resolver's test page.
5. Reboot the router. The Canadian Centre for Cyber Security suggests [routine reboots](https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019), because a reboot clears memory and may disrupt implanted malware.
6. Update smart devices and retire the ones whose support has ended.

Know the signs of trouble as well. The FBI lists [overheating, connection problems and settings you do not recognize](https://www.ic3.gov/PSA/2025/PSA250507) as common signs of router malware. If you see them, apply any firmware update, change the admin password and reboot, as the FBI advises, or reset the router and configure it again; if it is out of support, replace it.

If you run a small business and want the same outside view of everything it exposes online, our [security testing service](https://computese.com/services/security-testing/) discovers domains, IP ranges and cloud accounts from the outside and ranks what it finds by real risk.

## Key terms
- **End-of-life (EOL) router**: A router its maker no longer supports: no new firmware and no security patches, so any vulnerability found after that date stays open for good.
- **Remote administration**: A router setting, also called remote management or remote access, that makes the admin page reachable from the internet instead of only from inside your home.
- **UPnP (Universal Plug and Play)**: A feature that lets devices on a network find each other and ask the router to open a path through its firewall, without anyone approving the change.
- **WPS (Wi-Fi Protected Setup)**: A shortcut for joining Wi-Fi with a button press or an eight-digit PIN instead of the password. The PIN method has a design flaw that makes it guessable.
- **Network segmentation**: Splitting one home network into separate networks, such as a guest network or VLANs, so a compromised device can reach the internet but not your computers.
- **VLAN (virtual LAN)**: A separate logical network carried over the same router, switch or access point. Rules decide which VLANs may talk to each other.
- **Protective DNS**: A DNS resolver that refuses to look up domains known to serve malware or phishing, such as Quad9 or Cloudflare's 1.1.1.1 for Families.
- **DNS hijacking**: Changing which DNS resolver a router or device uses, so an attacker's server answers every lookup and can send chosen sites to a server of its own.
- **Residential proxy**: A service that routes someone else's internet traffic through a home connection, so websites see the home's address instead of the real sender's.

## Common questions

### How do I know if my router is end of life?

Find the model number on the router's label and look it up on the maker's support site. An end-of-life or end-of-support notice, or no firmware release in a long time, means it is no longer maintained. The FBI says routers dated 2010 or earlier are likely no longer updated; if your provider supplied the router, ask the provider.

### Should I turn off UPnP on my router?

Yes, unless something you use needs it. UPnP lets devices inside your network open paths through the router's firewall without asking you, and malware can use it the same way. If a game or console stops working, forward only the ports its maker documents, or turn UPnP back on and keep the firmware current.

### Is a guest network enough to separate smart home devices?

For most homes, yes, as long as devices on the guest network cannot reach the main network. Check that setting rather than assuming it, because routers differ. A VLAN gives the same separation with finer control, on routers that support it.

### How can I tell if my router has been hacked?

The FBI lists overheating, connection problems and settings you do not recognize as common signs. Also check the DNS servers in the router's settings, look for port forwards or admin accounts you did not create, and treat certificate warnings on familiar sites as a warning sign. If anything is off, update or reset the router, set a new admin password and replace it if it is out of support.

### Do I need a VPN to secure my home network?

No. A VPN encrypts traffic between one device and the VPN provider; it does not patch the router or isolate a vulnerable camera. Use the VPN your employer provides for work, and be wary of free VPN apps: in March 2026 the FBI warned that some enrol devices in residential proxy networks without the user's consent.

### Which DNS resolver should I use at home?

A resolver that blocks known malicious domains is a cheap extra layer. Quad9 (9.9.9.9 and 149.112.112.112) and Cloudflare's 1.1.1.1 for Families (1.1.1.2 and 1.0.0.2 for malware blocking) are two free options. Set it on the router so every device inherits it, then confirm it: on.quad9.net answers yes or no for Quad9, and Cloudflare's malware.testcategory.com test domain should fail to load.

## Sources
1. [Home Network Security](https://www.cisa.gov/news-events/news/home-network-security), CISA
2. [Use private Wi-Fi addresses on Apple devices](https://support.apple.com/en-us/102509), Apple Support
3. [Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals (I-031226-PSA)](https://www.ic3.gov/PSA/2026/PSA260312), FBI Internet Crime Complaint Center
4. [Nmap Reference Guide: Host Discovery](https://nmap.org/book/man-host-discovery.html), Nmap Project
5. [U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure](https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical), US Department of Justice
6. [Cyber Criminal Proxy Services Exploiting End of Life Routers (I-050725-PSA)](https://www.ic3.gov/PSA/2025/PSA250507), FBI Internet Crime Complaint Center
7. [BOD 26-02: Mitigating Risk From End-of-Support Edge Devices](https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices), CISA
8. [Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information (I-040726-PSA)](https://www.ic3.gov/PSA/2026/PSA260407), FBI Internet Crime Complaint Center
9. [Routers cyber security best practices (ITSAP.80.019)](https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019), Canadian Centre for Cyber Security
10. [Cyber security tips for remote work (ITSAP.10.116)](https://www.cyber.gc.ca/en/guidance/cyber-security-tips-remote-work-itsap10116), Canadian Centre for Cyber Security
11. [How To Secure Your Home Wi-Fi Network](https://consumer.ftc.gov/articles/how-secure-your-home-wi-fi-network), US Federal Trade Commission
12. [CISA and FBI Release Secure by Design Alert Urging Manufacturers to Eliminate Defects in SOHO Routers](https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-and-fbi-release-secure-design-alert-urging-manufacturers-eliminate-defects-soho-routers), CISA
13. [Smart devices: using them safely in your home](https://www.ncsc.gov.uk/guidance/smart-devices-in-the-home), National Cyber Security Centre (UK)
14. [Guest Wi-Fi (ITSAP.80.023)](https://www.cyber.gc.ca/en/guidance/guest-wi-fi-itsap80023), Canadian Centre for Cyber Security
15. [Frequently Asked Questions](https://quad9.net/support/faq/), Quad9
16. [Set up Cloudflare 1.1.1.1 resolver](https://developers.cloudflare.com/1.1.1.1/setup/), Cloudflare Docs
17. [Service Addresses & Features](https://quad9.net/service/service-addresses-and-features/), Quad9
18. [Verify connection](https://developers.cloudflare.com/1.1.1.1/check/), Cloudflare Docs
19. [ipconfig](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig), Microsoft Learn
20. [Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac), Apple Support
21. [The UK Product Security and Telecommunications Infrastructure (Product Security) regime](https://www.gov.uk/government/publications/the-uk-product-security-and-telecommunications-infrastructure-product-security-regime), GOV.UK
22. [Public Notice DA 26-18: Filing window for Lead Administrator applications, U.S. Cyber Trust Mark Program](https://docs.fcc.gov/public/attachments/DA-26-18A1.pdf), Federal Communications Commission
23. [U.S. Cyber Trust Mark](https://www.fcc.gov/CyberTrustMark), Federal Communications Commission