Home routers and mesh Wi-Fi: security features to compare

Do I need a new router? Often not: the router already in the house can be secured with a few settings, and the ACSC’s guidance points to replacement in a few situations, such as a router that no longer gets security updates. Choosing a new router or mesh Wi-Fi system is mostly a conversation about speed and coverage, but the security features matter just as much over the years the device stays plugged in. This guide starts with securing the router you already have, then explains the mesh Wi-Fi and router security features worth comparing: WPA3 encryption, automatic firmware updates, published support periods, guest networks and app-based management. It compares what four makers publish about their current systems sold in Australia.

Do you need a new one?

A home router connects every phone, laptop, TV and smart device in the house to the internet, and decides who can join the network. It’s a small computer that is always on. The ACSC explains that an insecure router can let attackers reach other devices on the network, and links compromised routers to outdated firmware and a “set and forget” habit.

Often, the router already in the house can be secured with settings changes. The guide to securing home Wi-Fi and router settings walks through each of the ACSC’s steps, and the home Wi-Fi security checklist helps work through them.

The ACSC’s guidance points to a few situations where replacement comes up:

• End of life. The ACSC says manufacturers typically provide security updates for “a limited time (usually 3 to 5 years)”, depending on brand and model. It says that if no firmware update or security patch has come out in more than 12 months, the router is likely end-of-life, and that end-of-life routers should be replaced “as a priority”.
• No WPA2. The ACSC’s guidance describes considering replacing a router that doesn’t support at least WPA2.
• Choosing a replacement. The ACSC describes choosing a model that supports automatic updates, and asking the internet service provider (ISP) for advice on compatible replacements.

ISP-supplied routers or buying your own

Many internet plans come with a modem-router. Others let customers bring their own. Neither choice is automatically more or less secure: what matters is whether the device gets security updates, supports current encryption and has its default passwords changed. Some ISP-supplied devices are updated or managed by the provider, so the provider’s own support pages explain how updates work for that equipment.

What a mesh system adds

A mesh Wi-Fi system does the same job as a router using two or more units spread around a home. One unit connects to the internet and the others relay the signal. Google’s store describes it simply: “Mesh Wi-Fi provides more coverage than a traditional router.” That helps with Wi-Fi black spots, but it’s about convenience rather than security: a mesh system is still one network managed as a whole, usually through the maker’s app.

What to compare

WPA3 encryption. WPA3 is the current Wi-Fi security standard. The ACSC’s guidance puts WPA3 first, then WPA3 transition mode (which lets older devices that only support WPA2 still connect), then WPA2. Google’s support page says WPA3 makes a network “highly resistant to security risks like offline dictionary attacks”. Many systems support WPA3 but ship with WPA2 as the default.

Automatic firmware updates. Firmware is the router’s own software. The ACSC says that if a router updates automatically, manual checks can be skipped. Makers word this differently: some state updates are automatic, others describe updating through an app.

A published support period. This is how long the maker promises security updates, and it’s arguably the most useful single number on a spec sheet, because a router that stops getting updates becomes the end-of-life device the ACSC describes replacing. Some makers publish an end date per model; others publish a policy without fixed dates.

Guest network. The ACSC describes using a guest Wi-Fi network, with its own name and password, for visitors and untrusted devices, separating them from the main network.

App-based management and account security. Most mesh systems are set up and managed through a phone app linked to an online account, which means the account controls the network. A strong, unique password and multi-factor authentication on that account, where the maker offers it, matter as much as the router’s admin password. The guide to securing online accounts explains how those protections work.

Content filtering. Some systems include website filtering or blocking, sometimes as part of a paid security subscription that continues after a trial.

Features the ACSC describes turning off. The ACSC’s guidance describes disabling WPS, UPnP and remote management if they aren’t needed. Some makers don’t support WPS at all; others include it as an option.

Australia’s smart device security standard

The Department of Home Affairs says mandatory security standards for smart devices commenced on 4 March 2026. They apply to most smart devices manufactured on and from that date and intended for personal, domestic or household use. Home Affairs lists three requirements: no universal default passwords, a published way to report security issues, and a published support period that says how long the device will get security updates.

Home Affairs’ factsheet gives examples such as smart TVs, smart watches and home assistants. The Home Affairs pages checked for this guide don’t mention routers. The Rules themselves list the products that are excluded (desktop computers and laptops, tablets, smartphones, therapeutic goods, road vehicles and road vehicle components) and don’t name routers either way. This guide doesn’t say whether a particular router is covered; Home Affairs is the contact for questions about scope.

How the products compare

Based on makers’ published specifications, checked October 2026. “Not stated” means the pages checked didn’t say, not that the feature is missing. Products are listed alphabetically, not ranked. Prices aren’t shown; the maker’s site has current details.

The product summaries below set out what each maker states, and where details weren’t found.

How to set up a new router or mesh system securely

Every maker’s setup is different, and most now run through an app. Based on the ACSC’s router guidance (checked October 2026), the security settings it describes for any router are:

1. Change the default admin username and password, if the system uses one. The ACSC warns defaults “may be published online for anyone to see”. For app-managed systems, secure the account linked to the app.
2. Check that firmware updates are automatic, or install the latest update.
3. Set Wi-Fi encryption to WPA3, or WPA3 transition mode if some devices can’t connect, or WPA2 if WPA3 isn’t available.
4. Give the network a name that doesn’t include personal information, and a long, unique Wi-Fi password.
5. Turn on the guest network for visitors and untrusted devices.
6. Turn off features that aren’t needed, such as WPS, UPnP and remote management.

The ACSC also describes a router health check every six months. The home Wi-Fi security guide covers each setting in more detail, and the maker’s own help pages have the exact steps for each model.

Things to watch for

• Defaults aren’t always the most secure setting. Several makers ship with WPA2 as the default and WPA3 as an option.
• Subscriptions. Some security and filtering features come as a trial, then need a paid plan. Basic security updates may not depend on the subscription; eero, for example, states eero Plus isn’t required to keep receiving security updates.
• Support dates are counted differently. One maker counts from the date of purchase, another from the date the product was first sold, another from when manufacturing stops. The maker’s own wording is what counts.
• Smart home devices on the network. The guide to smart speakers, cameras and doorbells covers the devices that connect to a router.
• Working from home. A home router also carries work traffic for many people. Working from home security explains what official guidance says about that.

Common questions

Do I need a new router?

Often not: the router already in the house can be secured with settings changes. The ACSC points to replacement in a few situations. It says a router with no firmware update or security patch in more than 12 months is likely end-of-life, and that end-of-life routers should be replaced as a priority. It also describes considering replacement if a router doesn’t support at least WPA2. See Do you need a new one?

Is mesh Wi-Fi more secure than a single router?

Not by itself: mesh is about coverage. A mesh system uses two or more units spread around a home, and Google’s store says it provides more coverage than a traditional router. Security depends on the same things as any router: WPA3 or WPA2 encryption, automatic firmware updates, the published support period, a guest network, and how the app account that controls the network is protected. See what a mesh system adds.

How long do routers get security updates?

The ACSC says manufacturers typically provide security updates for a limited time, usually 3 to 5 years, depending on brand and model. Makers count this differently: eero lists an end date for each model, Google counts from when a product was first sold, and NETGEAR’s policy relates to when a product stops being manufactured. The maker’s own wording is what counts. See the comparison table.

Should I use my ISP’s router or buy my own?

That depends on the plan, the connection type and the provider’s terms, and neither choice is automatically more or less secure. What matters is whether the device gets security updates, supports current encryption and has its default passwords changed. Some ISP-supplied devices are updated by the provider, and the ACSC describes asking the ISP about compatible replacements. See ISP-supplied routers or buying your own.

Does my router support WPA3?

The router’s specifications or Wi-Fi settings list its encryption options, usually under the security or encryption setting. Many current models support WPA3 but ship with WPA2 as the default. The ACSC’s order is WPA3, then WPA3 transition mode, which lets older WPA2-only devices still connect, then WPA2. The home Wi-Fi security guide has the steps.

Is a router covered by Australia’s smart device security standard?

This guide doesn’t say whether a particular router is covered. Home Affairs says mandatory standards for smart devices commenced on 4 March 2026 and apply to most smart devices made from that date for household use. The Home Affairs pages checked don’t mention routers, and the Rules’ list of excluded products doesn’t name them either way. Home Affairs is the contact for questions about scope. See the standard.

Where to get official help

The ACSC’s guide to securing a Wi-Fi router is the Australian Government’s reference for router settings. Home Affairs explains the security standards for smart devices. For using Wi-Fi away from home, see public Wi-Fi and travel security.