# How to set up a secure home Wi-Fi network: the settings that matter

> Secure home Wi-Fi in one pass: WPA3-Personal or transition mode, a long passphrase, WPS off, guest networks, and why hiding the SSID does not help.

- URL: https://computese.com/how-to-set-up-secure-home-wi-fi-network/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-08-28
- Updated: 2026-09-25
- Topics: Security

## In short
- Set the router to WPA3-Personal, or WPA2/WPA3 transition mode while older devices still need WPA2. Never use WEP, WPA, anything with TKIP, WPA/WPA2 mixed mode or an open network.
- WPA3's SAE handshake makes offline password guessing impossible, which a single recorded WPA2 join allows. The passphrase still matters: CISA suggests 5 to 7 unrelated words, at least 16 characters.
- Turn off WPS: a design flaw published in 2011 lets an attacker in range find the 8-digit PIN in at most 11,000 guesses. Share access with a QR code or Wi-Fi Easy Connect instead.
- Hiding the SSID and MAC address filtering add no real security: the name is easy to find, addresses are easy to copy, and phones now use a private address for each network.
- Give visitors and smart devices their own networks, check the list of connected devices now and then, and let the router install firmware updates automatically.

To set up a secure home Wi-Fi network, open your router's settings and choose WPA3-Personal, or WPA2/WPA3 transition mode if older devices still need to connect. Then set a passphrase of at least 16 characters, turn off WPS, put visitors and smart devices on their own networks and switch on automatic firmware updates. Hiding the network name adds no security.

Each setting answers a specific attack, and knowing which one makes the trade-offs easier when an old printer or smart plug refuses to connect. This guide covers the wireless security settings one at a time, with a checklist at the end. The rest of [router setup](https://computese.com/how-to-set-up-secure-home-network/) (the admin password, remote management, UPnP) and [Wi-Fi coverage](https://computese.com/how-to-improve-wi-fi-signal-strength/) are separate jobs. For how attackers intercept Wi-Fi traffic in the first place, see our explainer on [eavesdropping attacks](https://computese.com/understanding-eavesdropping-attacks-how-they-work/).

## A short history of Wi-Fi security protocols

Your router's security menu is a record of the last three decades. Each protocol replaced one that had been broken, and many routers still offer the old ones for compatibility.

| Protocol                       | Introduced                                 | How it protects the connection                                                     | Use it today?                                        |
| ------------------------------ | ------------------------------------------ | ---------------------------------------------------------------------------------- | ---------------------------------------------------- |
| WEP (Wired Equivalent Privacy) | 1997, in the first IEEE 802.11 standard    | RC4 cipher with a 40-bit key in the standard; vendors added 104-bit keys           | No: the key can be computed from captured traffic    |
| WPA (Wi-Fi Protected Access)   | 2003, as a stopgap from the Wi-Fi Alliance | TKIP: WEP's RC4-based mechanism with a longer key and a new key for every packet   | No                                                   |
| WPA2                           | 2004, the certification of IEEE 802.11i    | CCMP, based on AES                                                                 | Only WPA2-Personal (AES), for devices that lack WPA3 |
| WPA3                           | 2018                                       | The SAE handshake for Personal networks, with Protected Management Frames required | Yes: WPA3-Personal                                   |

The dates come from the [Wi-Fi Alliance's summary of legacy protocols](https://www.wi-fi.org/faq/what-are-legacy-protocols) and NIST's archived [guide to securing legacy 802.11 networks](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-48r1.pdf), which records that the IEEE approved the first 802.11 standard, with WEP, in 1997. WPA was an interim fix that ran on WEP-era hardware; the IEEE finished the real replacement, 802.11i, in June 2004, and WPA2 is the Wi-Fi Alliance's interoperability certification for it. The Wi-Fi Alliance [introduced WPA3 on June 25, 2018](https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-wi-fi-certified-wpa3-security), and [WPA3 support has been required](https://www.wi-fi.org/system/files/WPA3_Deployment_Options_Highlights_202602.pdf) in every new Wi-Fi CERTIFIED device since 2020. Its use is mandatory on the 6 GHz band, so a device that cannot do WPA3 cannot use a router's 6 GHz band at all.

## WPA3 vs WPA2: what WPA3-Personal fixes

Both WPA2 and WPA3 encrypt your traffic well once a device is connected. The difference is in how a device proves it knows the password, and in what an attacker can do with a recording of that moment.

With **WPA2-Personal** (also labelled WPA2-PSK, for pre-shared key), a device and the router run a short handshake based on the shared password, and anyone within radio range can record it. That recording is enough to test password guesses offline: the attacker tries candidates on their own hardware, as fast as it runs, and the router never sees a single attempt. The researchers behind the Dragonblood study of WPA3 state it directly: [a captured WPA2 handshake can be used to recover the network's password](https://wpa3.mathyvanhoef.com/) by brute force or with a dictionary. A short or common password falls quickly; a long random one does not.

![A laptop copies the messages a phone and a router exchange as the phone joins the network, then, away from the router, tries a long row of keys until an orange one fits.](https://computese.com/images/blog/how-to-set-up-secure-home-wi-fi-network/handshake.c6daf1cf20-1536.webp)

*With WPA2-Personal, one recorded join is enough: the guessing happens later, on the attacker's own hardware, where your router can neither slow it down nor notice it.*

**WPA3-Personal** replaces that exchange with the Dragonfly handshake, which the Wi-Fi standard calls Simultaneous Authentication of Equals (SAE). The Wi-Fi Alliance puts the result plainly: with WPA3, [an offline dictionary attack is not possible](https://www.wi-fi.org/beacon/the-beacon/whats-new-in-wi-fi-security). An attacker has to guess against your router in real time, one exchange per guess. The Alliance says this protects even passwords weaker than usual advice recommends, which is no reason to choose one. SAE comes with three further protections:

- **Forward secrecy.** Even if someone later learns the password, they cannot decrypt traffic they recorded earlier, or other users' traffic on the network.
- **Protected Management Frames (PMF).** Every WPA3 network must use PMF, which [protects management frames from forging](https://www.wi-fi.org/security): the control messages that devices and access points exchange.
- **No legacy fallbacks.** WPA3 networks [disallow outdated legacy protocols](https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-wi-fi-certified-wpa3-security) by design.

Most devices bought in recent years support it: Apple notes that [WPA3 Personal works with every device that supports Wi-Fi 6](https://support.apple.com/en-us/102766) (802.11ax) and with some older ones. The router needs support too (see the note on firmware at the end). WPA3-Enterprise is the business variant, with an optional 192-bit security mode for sensitive networks; at home, WPA3-Personal is the one you want.

## Use transition mode while older devices need WPA2

If your router offers WPA3-Personal but a printer, games console or smart plug only speaks WPA2, you have three options:

1. **WPA2/WPA3 transition mode** (Apple's name is "WPA2/WPA3 Transitional"; router menus vary). WPA3 devices connect with WPA3 and older ones with WPA2, on the same network name and password. Apple recommends it for compatibility with older devices.
2. **Two networks:** one WPA3-only network for phones and laptops, and one WPA2 network for the devices that need it, each with its own password. The Wi-Fi Alliance [suggests this](https://www.wi-fi.org/system/files/WPA3_Deployment_Options_Highlights_202602.pdf) because some older or uncertified devices have trouble connecting to a transition-mode network, and it combines well with the smart-device network described below.
3. **WPA3-Personal compatibility mode**, a newer option that hides WPA3 from older devices so they see a plain WPA2 network, while updated devices still connect with WPA3. It needs a firmware update on the router, and the Wi-Fi Alliance asks vendors to label it "WPA3-Personal compatibility" in their settings.

Transition mode has a known cost. Because the WPA2 side uses the same password, an attacker nearby can set up a fake WPA2-only copy of your network, force a WPA3-capable device onto it and record a WPA2 handshake to guess against offline. That is the [Dragonblood downgrade attack](https://wpa3.mathyvanhoef.com/) disclosed in April 2019, and it is why the passphrase still matters on a transition network. A fake access point is the same trick behind [evil twin attacks](https://computese.com/understanding-eavesdropping-attacks-how-they-work/) on public Wi-Fi. Once every device on the network supports WPA3, switch to WPA3-Personal only.

One mixed setting to avoid is **WPA/WPA2 mixed mode**. Apple lists it, with WPA Personal, WEP and anything with TKIP in the name, among the [weak security settings to avoid](https://support.apple.com/en-us/102766). After you change the security mode, some devices need to forget the network and join it again to pick up the new settings.

## Why WEP and WPA-TKIP have to go

If your router's menu offers WEP, WPA or anything with TKIP in the name, none of them belongs on a network you care about.

- **WEP is broken by design.** NIST's guide explains that an attacker who captures enough traffic can compute a WEP key, and that [longer keys do not help](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-48r1.pdf) because the flaw lies in how WEP uses its initialization vector and the RC4 cipher.
- **WPA with TKIP was a stopgap.** The Wi-Fi Alliance describes TKIP as an older technology [with some vulnerability to cryptographic attacks](https://www.wi-fi.org/faq/what-are-legacy-protocols), and says only WPA3 devices should be bought and used.
- **Operating systems are closing the door.** Since Windows 10 version 1903, Windows [shows a warning when joining a WEP or TKIP network](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features), and Microsoft says a future release will refuse the connection. Apple devices show a security warning for the same settings.

If the router offers nothing better than WEP, WPA or WPA2 with TKIP, CISA's advice is to [ask the internet provider that supplied it for an upgrade, or buy a new router](https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5). A router that old is also likely past the end of its firmware updates (see the last section). If you are choosing a replacement, [Wi-Fi 7 explained](https://computese.com/wi-fi-7-standard-set-to-achieve-certification-in-early-2024-bringing-advanced-connectivity/) covers what the newest generation needs to pay off.

> [!WARNING]
> Never switch security off, not even for a few minutes or only on the guest network. Apple's guidance is blunt: an open network lets anyone in range join, use your connection, reach shared devices and monitor the websites you visit.

## Choose a long passphrase

WPA3 protects a weak password better than WPA2 did, but the password still carries weight: transition mode, a separate WPA2 network for old devices and a WPA2 guest network all keep a WPA2 handshake on the air. CISA suggests a memorable passphrase of [5 to 7 unrelated words, at least 16 characters in total](https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5), used for nothing else.

- **Pick the words at random**, with dice or a password manager's generator, not a line from a song. A shape like `lantern orbit maple cobalt ferry` (do not use this one) is long and still easy to read out.
- **Keep personal details out:** no address, surname, pet's name or phone number.
- **Change it when someone who had it should no longer have access**, such as a former housemate, or when you find a device you cannot account for. Every device then needs the new one, which is the price of a shared password and the reason visitors belong on the guest network.

This is the Wi-Fi password. The router's admin password is a different secret, and it needs changing from the default as part of router setup.

## Name the network, and do not bother hiding it

The network name (the SSID, or service set identifier) is broadcast to everyone in range, so treat it as public.

- **Change the default name.** CISA notes that a default SSID can [point an attacker to known vulnerabilities](https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5) in the router you use. Apple adds a reliability reason: devices that know a common default name such as linksys or netgear are more likely to [find other networks with the same name and try to join them](https://support.apple.com/en-us/102766).
- **Keep personal details out of it.** CISA's rule is no sensitive or identifying personal information in the name: no surname, unit number or street address.

**Hiding the SSID does not add security.** A hidden network still transmits; the router only [leaves its name out of its beacon frames](https://learn.microsoft.com/en-us/previous-versions/windows/hardware/wireless/scanning-for-non-broadcast-ssids), and a device that wants to join has to send probe requests that contain the name. Microsoft advises against hiding networks, because there are [minimal security benefits and clients may have issues connecting and roaming](https://learn.microsoft.com/en-us/windows/win32/nativewifi/non-broadcast-profile-sample); finding the name is trivial. Apple goes further: because of how devices search for networks, using a hidden network can expose information that identifies you and the hidden networks you use, such as your home network.

![A laptop on a café table sends out signals that each carry a small house symbol, the name of its hidden home network. A second laptop nearby catches one of them, drawn in orange.](https://computese.com/images/blog/how-to-set-up-secure-home-wi-fi-network/probe.f3bb0bc954-1536.webp)

*A hidden network's name does not disappear: your devices ask for it by name, which can point back to your home network.*

You will still find checklists that recommend hiding the name, including the Canadian Centre for Cyber Security's (CCCS) [router best practices](https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019). The companies that write the Wi-Fi software on phones and laptops, Apple and Microsoft, both advise against it, and their reasoning holds: the encryption mode and passphrase protect the network, and the name only identifies it.

## Give guests and smart devices their own networks

A guest network is a second Wi-Fi network from the same router, with its own name and password, that reaches the internet but not the devices on your main network. Use it for two groups:

- **Visitors.** CISA's rule of thumb is that the guest network is for [anyone who does not routinely connect](https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5) to your home Wi-Fi, with its own long, random password. Visitors never learn the main password, so you never have to change it after they leave.
- **Smart devices.** Cameras, plugs, speakers and TVs that only need the internet do not belong beside your laptop. On a guest network they cannot discover your other devices, reach the router's settings or bring their own vulnerabilities onto your main network, CISA notes. The CCCS recommends a guest network [for your guests and for your IoT devices](https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019) for the same reason.

If the router can run more than one extra network, give smart devices one and visitors another, so a guest's infected phone and your doorbell camera cannot reach each other either. The smart-device network is also the natural home for anything stuck on WPA2, which lets the main network run WPA3 only. If the router offers a single guest network, put both groups on it, as CISA and the CCCS suggest: it still keeps them away from your computers and phones. Our guide to [smart home devices](https://computese.com/how-ai-driven-smart-home-devices/) covers choosing and securing the devices themselves; [auditing and segmenting an existing network](https://computese.com/how-to-secure-your-home-network/) in depth is a separate job from setting up its Wi-Fi.

Settings worth checking on any guest network:

1. **Security on.** Use [WPA2 or WPA3 with its own password](https://www.cyber.gc.ca/en/guidance/guest-wi-fi-itsap80023), different from every other network and account.
2. **No access to the local network.** Whatever your router calls the option, guests should reach the internet and nothing else.
3. **Time limits** if the router offers them. The CCCS suggests limiting how long a guest password stays valid, so only current guests can connect.
4. **Wi-Fi Enhanced Open**, if offered, encrypts an open network's traffic [without a password](https://www.wi-fi.org/security). Anyone in range can still join, so it suits a café better than a home.

## Turn off WPS

Wi-Fi Protected Setup (WPS) was meant to make joining easier: press a button on the router, or type the 8-digit PIN printed on its label. In December 2011, [CERT/CC vulnerability note VU#723755](https://kb.cert.org/vuls/id/723755) documented a design flaw in the PIN method:

- the router's replies to a wrong PIN reveal whether the first half was right, so each half can be guessed on its own;
- the last digit is a checksum, so it never needs guessing;
- together, that cuts the search from 100 million attempts to at most 11,000 (10,000 for the first half, 1,000 for the second);
- many routers did not lock out repeated attempts.

An attacker within range who finds the PIN can recover the Wi-Fi password, change the router's configuration or knock it offline. CERT/CC's workaround was to disable WPS, and the CCCS and CISA still say to turn it off. Look for the setting under the names CERT/CC lists, such as "WiFi Protected Setup", "router PIN" or "external registrar", and turn off the PIN method along with the rest. If a router gives you no way to turn it off, that is one more reason to replace it. Android itself [deprecated WPS in Android 9](https://source.android.com/docs/core/connect/wifi-easy-connect).

## Share Wi-Fi safely: QR codes and Wi-Fi Easy Connect

Reading a long passphrase aloud is the main reason people choose short ones. Share it without typing instead:

- **Android:** open Settings, then Network & internet, Internet, your network and Share. The phone shows a [QR code another device can scan to join](https://support.google.com/android/answer/9075847).
- **iPhone:** in the Passwords app, open Wi-Fi, choose the network and [tap Show Network QR Code](https://support.apple.com/guide/iphone/find-and-share-your-wi-fi-password-iph96e6aa9bb/ios). Between Apple devices that are in each other's contacts and within range, the iPhone also offers to share the password when the other device tries to join.
- **A printed card:** print the guest network's QR code for visitors, never the main one. Anyone who photographs it can join, so treat it like the password itself.

**Wi-Fi Easy Connect**, which the Wi-Fi Alliance introduced [alongside WPA3 in 2018](https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-wi-fi-certified-wpa3-security), goes one step further for devices without a screen. You scan the QR code on the new device, such as a smart plug or a camera, with your phone, and the phone hands it the network credentials. Android has supported it [since Android 10](https://source.android.com/docs/core/connect/wifi-easy-connect) under its technical name, the Device Provisioning Protocol (DPP), for both WPA2 and WPA3 networks, and describes it as an alternative to WPS. The new device has to support it too; where it does, it is the cleanest way to add a device without a PIN or a typed password.

## Skip MAC address filtering

MAC address filtering lets only devices on an allow list join. It sounds strict and protects little. Apple's router guidance says to [leave it disabled](https://support.apple.com/en-us/102766) and not rely on it, for three reasons: it does nothing against someone monitoring traffic on the network; MAC addresses can easily be copied, spoofed or changed; and devices now use a different address for each network. The CCCS checklist still lists it as an optional extra; it cannot keep out anyone who can copy an address.

![A router checks the orange tag on each device's messages against an allow list. A laptop copies the tag a phone uses, puts the same tag on its own messages and is let through too.](https://computese.com/images/blog/how-to-set-up-secure-home-wi-fi-network/macclone.d1671295d6-1536.webp)

*A MAC allow list checks a label every device announces in the open; copying the label is all it takes to pass.*

The last point turns MAC filtering from weak into a nuisance. iPhones and iPads since iOS 14 [use a private Wi-Fi address for each network](https://support.apple.com/en-us/102509), and since iOS 18 that address rotates every two weeks by default on networks with weak or no security. Android has [used a randomized MAC address by default since Android 10](https://source.android.com/docs/core/connect/wifi-mac-randomization-behavior). A phone that resets its network settings joins with a new address and is locked out of your own allow list. Encryption and a strong passphrase decide who joins; the address list does not.

## Check who is connected

The router's app or admin page lists the connected devices, usually with a name, an IP address and a MAC address. Look at it every few months, and after any change to the network:

1. **Match each entry to a device you own**, and rename entries in the router if it allows, so the list stays readable.
2. **Expect unfamiliar MAC addresses.** With private addresses, the address a phone uses on your network is not its hardware address; compare with the Wi-Fi address shown in the device's own network details.
3. **Change the passphrase if something cannot be accounted for**, then rejoin your own devices. Anything that does not come back was not yours.
4. **Turn on new-device alerts** if the router or its app offers them, and keep watching the guest network too: the CCCS guest Wi-Fi guidance says to [monitor what is connected](https://www.cyber.gc.ca/en/guidance/guest-wi-fi-itsap80023) there as well.

## Keep the router's firmware updated

Wi-Fi security keeps changing after you buy the router. The fixes for Dragonblood shipped as vendor updates, WPA3-Personal compatibility mode requires one, and Apple notes that updates can change the security settings a router offers. Set the router to [install firmware updates automatically](https://support.apple.com/en-us/102766) if it can; if it cannot, check for updates in its app or admin page every few months.

A router that no longer receives updates is a standing risk. In May 2025 the FBI warned that criminals were [compromising end-of-life routers](https://www.ic3.gov/PSA/2025/PSA250507) with variants of TheMoon malware and using them to run criminal proxy services, noting that routers dated 2010 or earlier are likely no longer updated and that some compromised routers had remote administration turned on. The FBI's advice is to replace an end-of-life router, apply every available update and turn off remote management. Signs that a router itself is compromised include overheating, connection problems and settings changes you do not recognize. If your internet provider supplied the router, ask them whether it still receives updates.

> [!IMPORTANT]
> Firmware updates are also how new security modes arrive. If your router shows no WPA3 option, or no way to turn off WPS, update it and look again before deciding it needs replacing.

## Home Wi-Fi security checklist

| Setting               | Set it to                                                     | Why                                                    |
| --------------------- | ------------------------------------------------------------- | ------------------------------------------------------ |
| Security mode         | WPA3-Personal; WPA2/WPA3 transition while old devices need it | SAE stops offline password guessing                    |
| Never use             | WEP, WPA, TKIP, WPA/WPA2 mixed, open                          | Broken, obsolete or unencrypted                        |
| Wi-Fi passphrase      | 5 to 7 random words, 16 characters or more                    | It still guards every WPA2 connection                  |
| Network name          | Changed from the default, nothing personal                    | Default names reveal the router model                  |
| Hidden network        | Off                                                           | No security benefit; devices announce the name         |
| Guest network         | On, own password, no local network access                     | Visitors never get the main password                   |
| Smart devices         | Their own network                                             | A compromised camera cannot reach your laptop          |
| WPS                   | Off, including the PIN                                        | The PIN falls in at most 11,000 guesses                |
| MAC address filtering | Off                                                           | Addresses are easy to copy and now private per network |
| Firmware updates      | Automatic                                                     | Security fixes and new modes arrive this way           |

The same settings apply to a small office, with more at stake: staff, visitor and device networks to keep apart, and more people who know the password. Our [IT support](https://computese.com/services/it-support/) team takes on projects such as a new office, and [security scanning](https://computese.com/services/security-testing/) checks what your public IP addresses expose to the internet, such as open ports and services.

## Key terms
- **WPA3-Personal**: The home version of Wi-Fi Protected Access 3, introduced in 2018. Everyone shares one password, but the SAE handshake stops offline guessing and adds forward secrecy.
- **SAE (Simultaneous Authentication of Equals)**: The password-based handshake in WPA3-Personal, also known as the Dragonfly handshake. Each password guess needs a live exchange with the network.
- **Offline dictionary attack**: Guessing a network password from a recording, trying candidates on the attacker's own hardware without further contact with the network. WPA2-Personal allows it; WPA3-Personal does not.
- **Transition mode**: A WPA3 setting, often labelled WPA2/WPA3, where WPA3 devices connect with WPA3 and older devices with WPA2, using the same network name and password.
- **TKIP**: Temporal Key Integrity Protocol, the encryption of the original WPA from 2003. It reused WEP's RC4-based mechanism and is deprecated; WPA2 replaced it with AES-based CCMP.
- **Protected Management Frames (PMF)**: Protection for the management messages that Wi-Fi devices and access points exchange, so they cannot be forged. Required on every WPA3 network.
- **SSID**: Service set identifier: the network name your router advertises and devices list when you look for Wi-Fi. It identifies the network; it does not protect it.
- **WPS (Wi-Fi Protected Setup)**: A shortcut for joining a network with a button or an 8-digit PIN. The PIN method has a design flaw (CERT/CC VU#723755) and should be turned off.
- **Private Wi-Fi address**: A randomized MAC address a phone or laptop uses instead of its hardware address, different for each network. Apple and Android devices use one by default.
- **Wi-Fi Easy Connect**: A Wi-Fi Alliance method, also called the Device Provisioning Protocol (DPP), that adds a device to a network by scanning its QR code with a phone instead of typing a password.

## Common questions

### Is WPA3 better than WPA2?

Yes. WPA3-Personal uses the SAE handshake, which makes offline password guessing impossible and adds forward secrecy, so traffic recorded earlier stays private even if the password leaks later. WPA2-Personal with AES is still acceptable for devices that cannot use WPA3: give them transition mode or a separate network.

### Should I hide my Wi-Fi network name (SSID)?

No. Microsoft and Apple both advise against it: the name is easy to find, devices may connect and roam less reliably, and devices that use a hidden network ask for it by name, which can identify your home network. Protect the network with WPA3 and a strong passphrase instead.

### Is WPS a security risk?

The PIN method is. A design flaw published in December 2011 (CERT/CC VU#723755) lets an attacker in range find the 8-digit PIN in at most 11,000 attempts and then recover the Wi-Fi password. Turn WPS off entirely, including the router PIN, and share access with a QR code instead.

### Does MAC address filtering make Wi-Fi more secure?

Not in any way that matters. MAC addresses can be copied or spoofed easily, filtering does nothing against someone monitoring traffic, and iPhones and Android phones now use a private address for each network, so an allow list mostly locks out your own devices.

### Why does my phone or laptop say my Wi-Fi has weak security?

The router is using an old mode such as WEP, WPA, TKIP or WPA/WPA2 mixed mode. Apple devices warn about these settings, and Windows has warned about WEP and TKIP networks since Windows 10 version 1903. Switch the router to WPA3-Personal or WPA2/WPA3 transition, then rejoin your devices.

### How long should my Wi-Fi password be?

At least 16 characters. CISA suggests a passphrase of 5 to 7 unrelated words, which resists guessing and is still easy to type or read out. Use a different one for the guest network, and never reuse it for another account.

## Sources
1. [What are legacy protocols?](https://www.wi-fi.org/faq/what-are-legacy-protocols), Wi-Fi Alliance
2. [SP 800-48 Rev. 1: Guide to Securing Legacy IEEE 802.11 Wireless Networks (archived)](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-48r1.pdf), NIST
3. [Wi-Fi Alliance introduces Wi-Fi CERTIFIED WPA3 security](https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-wi-fi-certified-wpa3-security), Wi-Fi Alliance
4. [WPA3 deployment options: driving widespread adoption of WPA3](https://www.wi-fi.org/system/files/WPA3_Deployment_Options_Highlights_202602.pdf), Wi-Fi Alliance
5. [Dragonblood: Analysing WPA3's Dragonfly Handshake](https://wpa3.mathyvanhoef.com/), Mathy Vanhoef and Eyal Ronen (IEEE S&P 2020)
6. [What's new in Wi-Fi security?](https://www.wi-fi.org/beacon/the-beacon/whats-new-in-wi-fi-security), Wi-Fi Alliance
7. [Security](https://www.wi-fi.org/security), Wi-Fi Alliance
8. [Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766), Apple Support
9. [Deprecated features for Windows client](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features), Microsoft Learn
10. [Project Upskill Module 5: Securing Your Home Wi-Fi](https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5), CISA
11. [Scanning for Non-Broadcast SSIDs](https://learn.microsoft.com/en-us/previous-versions/windows/hardware/wireless/scanning-for-non-broadcast-ssids), Microsoft Learn
12. [Non-Broadcast profile sample](https://learn.microsoft.com/en-us/windows/win32/nativewifi/non-broadcast-profile-sample), Microsoft Learn
13. [Routers cyber security best practices (ITSAP.80.019)](https://www.cyber.gc.ca/en/guidance/routers-cyber-security-best-practices-itsap80019), Canadian Centre for Cyber Security
14. [Guest Wi-Fi (ITSAP.80.023)](https://www.cyber.gc.ca/en/guidance/guest-wi-fi-itsap80023), Canadian Centre for Cyber Security
15. [VU#723755: WiFi Protected Setup (WPS) PIN brute force vulnerability](https://kb.cert.org/vuls/id/723755), CERT/CC, Carnegie Mellon University
16. [Wi-Fi Easy Connect](https://source.android.com/docs/core/connect/wifi-easy-connect), Android Open Source Project
17. [Connect to Wi-Fi networks on your Android device](https://support.google.com/android/answer/9075847), Android Help (Google)
18. [Find and share your Wi-Fi password on iPhone](https://support.apple.com/guide/iphone/find-and-share-your-wi-fi-password-iph96e6aa9bb/ios), Apple Support
19. [Use private Wi-Fi addresses on Apple devices](https://support.apple.com/en-us/102509), Apple Support
20. [MAC randomization behavior](https://source.android.com/docs/core/connect/wifi-mac-randomization-behavior), Android Open Source Project
21. [Cyber Criminal Proxy Services Exploiting End of Life Routers (I-050725-PSA)](https://www.ic3.gov/PSA/2025/PSA250507), FBI Internet Crime Complaint Center