How to secure your home Wi-Fi router in nine steps

Your home router connects every laptop, phone, TV and smart speaker in the house to the internet, and for many people it is also the office network. If someone gets into it, they can use your connection, see traffic and reach the devices behind it. This guide walks through the settings that matter, in order, for a typical home or home-office router. Plan on 30 to 45 minutes.

The Government of Canada's Get Cyber Safe campaign notes that if someone uses an unsecured Wi-Fi network for illegal activity, the account holder could be held accountable. A few changes make that far less likely.

Before you start

• Find the router's brand and model on the label underneath. If your internet provider supplied it, the provider's support site will have instructions for that model.
• Use a computer connected by cable if possible, so you are not cut off when you change Wi-Fi settings.
• Every router is different. Get Cyber Safe suggests checking the manufacturer's website if a menu name below does not match yours.

Step 1: Sign in to the router

1. Open a browser and type the router's address into the address bar. It is often printed on the label, or in the manufacturer's app. Many providers and makers now use a phone app instead of a web page.
2. Sign in with the admin user name and password. If you have never changed them, they are often printed on the router.

Step 2: Change the admin password

The admin password controls the router's settings and is separate from the Wi-Fi password. Default admin credentials are widely known. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends changing both the default user name (if your router allows it) and password.

1. Look for a section named Administration, System or Management.
2. Set a long, unique password and store it in a password manager.

Step 3: Update the firmware and turn on automatic updates

1. Find Firmware Update, Router Update or similar, often under Administration or System.
2. Install any available update, and turn on automatic updates if the router offers them. CISA recommends running the latest firmware from the manufacturer.
3. Check whether your model still gets updates. The Canadian Centre for Cyber Security advises replacing equipment that no longer receives security updates from its maker. If your router is past its end of support, ask your provider for a newer unit or buy one.

Step 4: Rename the network and set a strong Wi-Fi passphrase

1. Open the Wireless or Wi-Fi settings, sometimes called Wireless Security.
2. Change the network name (SSID). Get Cyber Safe and CISA both advise leaving out personal information such as your name, address or unit number.
3. Set a new Wi-Fi password. Get Cyber Safe recommends a passphrase of at least four random words and 15 characters, such as four unrelated words strung together, avoiding song lyrics and common expressions.

Step 5: Use the strongest encryption your devices support

1. Find the setting called Security mode, Authentication or Network Authentication.
2. Choose WPA3-Personal if every device in the house supports it. CISA recommends WPA3 Personal.
3. If older devices cannot connect, choose WPA2/WPA3 mixed (sometimes called transition mode), or WPA2-Personal (AES). Get Cyber Safe says that if you do not see at least a WPA2-Personal option, it may be time to upgrade the router.
4. Never use WEP or an open network.

Step 6: Turn off features you do not need

CISA recommends switching off these features unless you have a specific need:

• WPS (Wi-Fi Protected Setup). The push-button or PIN shortcut for joining devices has a known PIN design flaw on many routers.
• Remote management (also called remote access or web access from WAN). This lets someone change router settings from the internet. If your provider manages the router for you, ask before changing it.
• UPnP (Universal Plug and Play). It lets devices open holes in your firewall automatically. Some game consoles and video apps use it; turn it off and see whether anything breaks.

While you are in the settings, confirm the router's built-in firewall is on.

Step 7: Create a guest network for visitors and smart devices

1. Look for Guest Network and turn it on.
2. Give it its own name and passphrase.
3. Connect visitors, smart TVs, speakers, cameras and other connected gadgets to the guest network, and keep your computers and phones on the main one. Get Cyber Safe recommends this so smart devices and guests cannot reach your personal information.
4. If you work from home, keep your work laptop on the main network, not shared with smart devices.

Step 8: Save, reconnect and check who is connected

1. Select Save or Apply. The router may restart.
2. Reconnect each device with the new name and passphrase.
3. Open the list of connected devices, often under Attached Devices, Clients or Device List. CISA advises watching for unknown devices. Remove or block anything you cannot identify, then change the Wi-Fi passphrase.

Step 9: Small extras that help

• Placement. Get Cyber Safe suggests placing the router near the middle of your home, away from windows, so the signal reaches less of the street. CISA also suggests reducing transmit power if your router allows it.
• Update everything on the network. Computers, phones and smart devices need updates too.
• Schedule a check. Look at the router every few months for updates and unknown devices.

If you think someone has broken in

Signs include unknown devices on the list, settings you did not change, or your browser being redirected to odd sites. Unplug the router from the internet, perform a factory reset (usually a recessed button held for 10 seconds or more), then repeat the steps above starting with a new admin password and firmware update. Change passwords for important accounts from a device you trust. If you lost money or data, report it to your local police and to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca.

Sources

• Get Cyber Safe (Government of Canada): Private networks
• Get Cyber Safe (Government of Canada): Is your network holiday-ready?
• CISA: Home Network Security
• Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations