How to secure your home network in 2026

Most home networks are still running on default credentials, firmware from three years ago, and a Wi-Fi password someone typed once and never changed. I see this constantly, in Singapore and everywhere else I’ve looked. It doesn’t take a nation-state actor to get in. Botnets like Mirai and VPNFilter spread for years by scanning for exactly this kind of router, testing default logins, and recruiting the box into a swarm used for DDoS attacks or credential stuffing. Your router is probably not a high-value target on its own, but it’s a low-effort one, and low-effort targets get hit first.

This guide is for anyone with admin access to their router who wants a network that isn’t trivially exploitable, whether that’s a single apartment, a house with a dozen smart plugs and cameras, or a home office you don’t want showing up in a client’s security questionnaire as the weak link. You don’t need networking certifications for any of this. You need about an hour, your router’s admin password, and a willingness to actually read the settings page.

By the end you’ll have updated firmware, unique credentials everywhere, WPA3 encryption, your IoT devices isolated from your laptop and phone, and DNS-level filtering running in the background. None of it is exotic, but it closes the gaps that actually get exploited.

what you need

a router bought since roughly 2020, or one that supports third-party firmware like OpenWrt, so it can do WPA3. if yours predates that and the vendor has stopped shipping updates, budget $90 to $160 for a replacement. I run an ASUS RT-AX86U at home and a GL.iNet travel router when I’m testing configs on the road
admin login for your router (not your ISP account portal — a separate login on most ISP-supplied gateways, including Singtel’s and StarHub’s default units)
45 to 90 minutes uninterrupted, ideally not while someone else is on a video call
a password manager. I use Bitwarden, the free tier covers everything in this guide
a free NextDNS account for DNS-level filtering, or a Raspberry Pi if you’d rather self-host Pi-hole
optional: a router or switch with VLAN support if you want to properly isolate IoT devices rather than rely on a basic guest network toggle
a second device (phone on cellular data) on hand in case you lock yourself out mid-setup

step by step

1. inventory every device on your network

Before changing anything, know what’s connected. Log into your router’s admin panel and find “connected devices” or “client list.” For a more complete picture, run a network scan from a laptop on the same Wi-Fi.

nmap -sn 192.168.1.0/24

Swap the subnet for whatever your router uses (check the admin panel’s LAN settings if you’re not sure).

expected output: a list of IP addresses, MAC addresses, and where available, hostnames. Count how many you don’t recognize. In most homes it’s more than expected: old phones, a smart TV nobody uses, a neighbor’s device never kicked off the guest network.

if it breaks: no nmap installed? On Windows or macOS run arp -a for a lighter version of the same list, or install the free Fing app, which scans for you with friendlier device names.

2. update firmware on the router and every connected device

Check the firmware version in your router’s admin panel against the latest listed on the vendor’s support page, then apply the update and reboot. Do the same for anything else with its own firmware: smart cameras, mesh nodes, NAS devices.

This matters more than most steps on this list. Consumer routers show up repeatedly in CISA’s Known Exploited Vulnerabilities catalog, which tracks flaws attackers are actively exploiting, not just theoretical bugs. Old firmware is the single most common reason a home router gets compromised.

expected output: the admin panel shows a firmware date within the last few months, matching what the vendor currently publishes.

if it breaks: if your router hasn’t gotten an update in over a year and the vendor’s support page shows no recent activity for your model, it’s end of life — replace it. No configuration fixes a router the manufacturer has stopped patching.

3. kill default credentials and remote admin access

Change the router’s admin username (if the interface allows it) and set a new password, at least 20 characters, generated and stored in your password manager, not something you’ll try to memorize. Then find the “remote management” or “WAN access” toggle and turn it off, so the admin panel can’t be reached from outside your home network.

expected output: logging into the admin panel now requires the new credentials, and remote management shows as disabled.

if it breaks: if you lock yourself out, most routers have a physical reset button (hold 10 to 15 seconds) that restores factory defaults. Write down your ISP connection details (PPPoE credentials if applicable) beforehand, so a factory reset doesn’t also cost you your internet connection.

4. switch Wi-Fi encryption to WPA3

In the wireless security settings, select WPA3-Personal, or WPA2/WPA3-Personal transitional mode for older devices that don’t support WPA3 outright. Set a new passphrase of at least 16 characters, avoiding dictionary words. The Wi-Fi Alliance’s security page covers what WPA3 actually changes over WPA2 — mainly a stronger handshake that resists offline password-guessing attacks.

expected output: all devices need to reconnect with the new passphrase. On a phone, checking the Wi-Fi connection details should show WPA3 (or WPA2/WPA3 in transitional mode).

if it breaks: an older device, say a printer or a 2017 smart plug, refuses to connect on WPA3-only mode. Use transitional mode, or if the router supports it, put that device on a separate legacy-only SSID and keep it off your main network.

5. put IoT and guest devices on a separate network

Enable your router’s guest network feature, or if you’re running something like a UniFi Dream Machine or OpenWrt, set up a proper VLAN. Move everything except your laptop and phone onto it: smart plugs, cameras, TVs, kids’ tablets, voice assistants. The goal: a compromised smart bulb can’t see or reach your NAS or work laptop.

expected output: devices on the guest/IoT network can reach the internet but can’t ping or browse to devices on your main network.

if it breaks: some smart home hubs (Google Home, Amazon Alexa) need to be on the same subnet as your phone during setup to discover the device. Temporarily connect it to your main network, finish pairing, then move it to the isolated network afterward.

6. turn off UPnP, WPS, and unused remote services

In the router’s advanced or WAN settings, disable UPnP (Universal Plug and Play), which lets any device open router ports without asking you. Disable WPS pairing. Turn off any cloud-relay, Telnet, or FTP admin features you’re not actively using.

expected output: UPnP and WPS show as disabled. Test any apps that relied on automatic port forwarding, a game console or security camera app, to confirm they still work or now need manual configuration.

if it breaks: a game console or older smart TV app stops connecting because it relied on UPnP to open its own ports. Forward only the specific port it needs manually, instead of leaving UPnP open to every device on the network.

7. add DNS-level filtering

Sign up for a free NextDNS account (up to 300,000 queries a month on the free tier) or set up Pi-hole on a Raspberry Pi, then point your router’s DNS settings to it instead of your ISP’s default resolver.

nslookup google.com

expected output: nslookup should show the response coming from your NextDNS or Pi-hole resolver’s IP rather than your ISP’s. Your NextDNS dashboard should start logging queries within a few minutes.

if it breaks: some IoT devices hardcode a public DNS server (commonly 8.8.8.8) and ignore what your router hands out via DHCP. You can block outbound port 53 to everything except your chosen resolver at the router’s firewall level, but accept that a few cheap devices will always try to route around this.

8. set unique passwords everywhere and enable 2FA

Use your password manager to generate a unique password for the router admin panel, your NAS, any camera app, printer web interface, and every cloud account tied to a device, Ring, Nest, TP-Link Kasa, whatever you’re running. Turn on two-factor authentication anywhere it’s offered. NIST’s digital identity guidelines, SP 800-63B, have pushed the industry away from complexity rules and periodic rotation toward length as the main defense: a long unique password beats “P@ssw0rd1!” changed monthly.

expected output: your password vault has one entry per device or account, no duplicates.

if it breaks: some cheap IoT devices flat out don’t let you change the default password. That’s a signal: either replace the device or make sure it’s permanently isolated on the guest network from step 5 and never given access to anything sensitive.

common pitfalls

reusing the ISP portal password as the router admin password. These are usually two separate logins on ISP-supplied gateways — fixing one and assuming you’ve fixed both leaves the admin panel wide open.
leaving the default SSID broadcasting the router brand and model. That’s a shortcut for anyone nearby to look up known vulnerabilities for that exact hardware. Rename it to something generic.
treating this as a one-time project. New devices join the network, firmware drifts out of date again, and nobody revisits the client list. The FTC’s guide to securing your home Wi-Fi makes a decent quarterly checklist to re-run.
buying “smart” everything and never auditing what’s connected. Six months in, most people can’t name half the devices on their own network.
assuming the ISP’s all-in-one gateway is a real firewall. Many of these boxes have their own cloud-based remote access baked in by the manufacturer, separate from anything you configured — one more reason to disable remote management explicitly rather than trust the defaults.

scaling this

Everything above is a one-time setup for a single home, checked quarterly. What changes as the number of devices or properties grows:

around 10 devices (a normal household): the steps above are enough. Do the device inventory and firmware check once a quarter and you’re in good shape.

around 100 devices (a real smart home, or you’ve become the unofficial IT support for extended family): manually tracking a client list stops working. This is where a proper controller earns its cost, something like a UniFi setup that logs every client and lets you push firmware updates centrally, plus a shared password manager vault (Bitwarden’s organization tier) instead of everyone keeping their own.

around 1,000 devices (managing network security across a portfolio of rental properties, or a small business with distributed home-office staff): individual router admin panels don’t scale. You need centralized management, DNS filtering deployed at the account level rather than per-router (NextDNS’s paid tiers support this), and a documented patch cadence with alerting instead of manual firmware checks. If you’re also juggling separate browser profiles or accounts across properties for privacy reasons, I’ve covered isolation tooling for that at antidetectreview.org/blog/.

where to go next

Once the network itself is locked down, the next weak points are usually the accounts and browsers running on top of it. I’d go to how to lock down your Google account next, since it’s the account most people have tied to the most other services. After that, how to check if your accounts were in a breach is worth running even if your network is clean, credentials leak from services you don’t control. And if you’re curious how much of your browsing is trackable even on a secured network, how to browse without being fingerprinted covers what a locked-down router doesn’t. More guides like these are on the blog.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-07-21.