Home Wi-Fi and router security explained

Securing home Wi-Fi mostly comes down to changing the router’s default passwords, turning on WPA3 or WPA2 encryption, keeping its firmware updated and switching off features that aren’t needed, as the ACSC’s router guide describes. A home router connects every phone, laptop, TV and smart device in the house to the internet. It also decides who can join the home network and what can reach it from outside. Many routers are plugged in once and never looked at again, still using the settings they came with. This guide explains how to secure home Wi-Fi: what the main router settings do and how to change them, step by step, based on the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) guide to securing a Wi-Fi router.

Why it matters

A router is a small computer that’s always on and always connected. If someone can get into its settings, they may be able to change where traffic goes, join the network or reach devices on it. The ACSC warns that default admin usernames and passwords “may be published online for anyone to see”. It also says routers need regular firmware updates, “just like your phone and computer,” and that older routers eventually stop getting them.

Routers vary a lot between brands and models, and some are supplied by an internet provider. The steps below describe the common path the ACSC sets out. The router’s manual, or the maker’s support website, has the exact menus for each model. The Home Wi-Fi Security Checklist lists the same steps to tick off.

The two router passwords: admin and Wi-Fi

A router has two separate sets of login details, and it helps to keep them apart:

• The admin login is used to open the router’s settings. It’s usually a username and password, sometimes printed on a sticker on the router.
• The Wi-Fi name and password are what phones and laptops use to join the network. The Wi-Fi name is also called the SSID.

The ACSC describes changing both from their defaults.

How to log in to the router’s settings

Based on the ACSC’s instructions (checked October 2026). The ACSC’s router guide has the latest steps, and the router’s manual has the details for each model.

1. Connect a computer or phone to the router, over Wi-Fi or with a network cable.
2. Find the router’s IP address. The ACSC says it’s usually on the sticker on the router or in the manual, and gives examples such as 192.168.0.1 or 10.0.0.1.
3. Open a web browser and type the IP address into the address bar.
4. Enter the router’s admin username and password when asked, then log in. The ACSC notes these are different from the Wi-Fi name and password.

If the admin details have been forgotten, the ACSC points to the manual for recovery steps. It notes that resetting the router may restore the defaults, which would then need changing again.

How to change the router’s admin password

Based on the ACSC’s instructions (checked October 2026):

1. Log in to the router’s settings, as above.
2. Find the page for the admin login. The ACSC says it’s often labelled “admin settings” or “account management”, but its location varies.
3. Change the username and the password from the defaults. The ACSC describes using a passphrase or a password manager (see how password managers work and what to compare).
4. Save the changes.
5. Log out, then log back in with the new details to check they work.

How to change the Wi-Fi name and password

Based on the ACSC’s instructions (checked October 2026):

1. In the router’s settings, go to the Wi-Fi or wireless settings page.
2. Find the network name. It may be labelled “SSID” or “Wi-Fi name”.
3. Change it to something new. The ACSC notes default names can reveal the router’s make and model, and describes leaving personal information out of the new name.
4. Change the Wi-Fi password to “a long, unique password.”
5. Save the changes, then reconnect each device using the new name and password.

The ACSC’s steps apply to every Wi-Fi network the router broadcasts (for example, separate “2.4 GHz” and “5 GHz” networks), and it describes turning off any that aren’t used.

How to turn on WPA3 or WPA2 encryption

Encryption scrambles the Wi-Fi signal so nearby people can’t read it. Routers usually offer several types, and older ones are weaker. The ACSC’s guidance describes this order of preference:

1. WPA3, if the devices in the house support it.
2. WPA3 transition mode, if some devices can’t connect using WPA3. This lets older devices keep working.
3. WPA2, also called WPA2-Personal or WPA2-PSK, if neither WPA3 option is available.

Based on the ACSC’s instructions (checked October 2026), the setting is usually on the same Wi-Fi settings page:

1. Log in to the router’s settings and open the Wi-Fi settings.
2. Find the security, encryption or authentication setting.
3. Choose WPA3. If some devices then won’t connect, choose WPA3 transition mode, or WPA2 if WPA3 isn’t offered.
4. Save, and reconnect devices if asked.

The ACSC identifies outdated options such as WEP as a risk, and says to consider replacing a router that doesn’t support at least WPA2.

How to update the router’s firmware

Firmware is the router’s built-in software. Based on the ACSC’s instructions (checked October 2026):

1. Check whether the router updates itself. The ACSC suggests searching the model on the maker’s website or checking the manual. If it does, the ACSC describes turning automatic updates on.
2. For a router without automatic updates, log in to its settings and note the current firmware version.
3. Go to the firmware or update page, check for updates, and install any that are available.
4. Leave the router on while it updates. The ACSC says: “Do not disconnect the power, unplug any cables or press the reset button during the update.”
5. Log in again and check the version number has changed.

Some routers need the update file to be downloaded and uploaded by hand. The ACSC describes downloading it only from the maker’s official website, usually under “support” or “downloads”.

How to tell if a router is end of life

According to the ACSC, manufacturers usually provide security updates for “3 to 5 years”, depending on brand and model. It says a router that hasn’t had a firmware update or security patch in more than 12 months is likely to be end of life (EOL). The model number is on the sticker or in the manual, and the maker’s website or support team can confirm an EOL date. The ACSC describes replacing an EOL router as a priority, with one that supports automatic updates, and suggests talking to the internet provider about compatible replacements.

Features the ACSC describes turning off

Routers often come with extra features switched on. The ACSC describes turning these off if they aren’t needed:

• WPS (Wi-Fi Protected Setup). A push-button or PIN way to join the network. The ACSC says its PIN is vulnerable to brute-force attacks.
• Remote management. The ACSC says to consider disabling remote management. It lists protocols such as Telnet, SSH and SNMP to disable if they appear, and describes disabling management from the internet side (often labelled WAN) if the option is available.
• UPnP (Universal Plug and Play). Lets devices open connections through the router automatically. The ACSC notes some smart devices, speakers, cameras and games rely on it, so they may need setting up by hand afterwards.
• FTP and port forwarding. The ACSC says FTP data isn’t encrypted, and port forwarding sends outside traffic to devices inside the network.

How to set up a guest network

A guest network is a second Wi-Fi network with its own name and password, kept apart from the main one. The ACSC describes using the router’s guest Wi-Fi feature for visitors and untrusted devices. It notes that guests who need to use something on the main network, such as a smart TV, would need to join the main network.

The ACSC’s separate smart device guidance says: “Set up an additional Wi-Fi network on your router for IoT devices only”, noting this “may be known on your Wi-Fi router as a ‘guest’ network.” If those devices don’t need to talk to each other, it describes turning on a feature called “client isolation”. Our guide to smart speaker, camera and doorbell security covers those devices in more detail.

Based on the ACSC’s descriptions (checked October 2026), the usual path is:

1. Log in to the router’s settings.
2. Find the guest network or guest Wi-Fi option.
3. Turn it on and give it its own name and password.
4. Save, then connect visitors’ or smart devices to it.

How to do the ACSC’s six-monthly health check

The ACSC recommends a router health check “at least every 6 months”, for example with a recurring calendar reminder. Its checklist is:

1. Confirm the router hasn’t reached end of life.
2. Check for firmware updates, unless automatic updates are on.
3. Review the list of connected devices. If unknown devices appear, the ACSC describes changing the Wi-Fi name and password, which disconnects them.
4. Restart the router by turning it off at the power point, waiting a few seconds and turning it back on.

The ACSC also describes renaming hard-to-recognise devices in the list, such as smart speakers, so they’re easier to spot.

Things to watch for

• Mixing up the two passwords. Changing the Wi-Fi password doesn’t change the admin login, and the reverse.
• Interrupting an update. The ACSC warns against cutting power or pressing reset mid-update.
• Update files from other websites. The ACSC describes downloading firmware only from the maker’s official site.
• Personal details in the network name. The ACSC describes leaving personal information out of the Wi-Fi name, and notes default names can reveal the router’s make and model.
• Devices that stop connecting. After a password or encryption change, each device needs reconnecting. The ACSC notes some devices may not connect using WPA3, which is what transition mode is for.
• Resetting the router. The ACSC notes a reset may bring back the default passwords.

Common questions

How do I secure my home Wi-Fi?

The ACSC’s router guide describes a short list: changing the router’s default admin login and the Wi-Fi name and password, turning on WPA3 or WPA2 encryption, keeping the firmware updated, and turning off features such as WPS and remote management if they aren’t needed. It also describes a guest network for visitors and smart devices, and a health check at least every six months. The steps start at how to log in to the router’s settings.

How do I change my Wi-Fi password?

It’s changed in the router’s settings, which the ACSC says are reached by typing the router’s IP address, usually on its sticker or in the manual, into a web browser. The admin login is separate, and its defaults are usually on the sticker too. On the Wi-Fi or wireless settings page, the ACSC describes changing the password to “a long, unique password”, saving, then reconnecting each device. See how to change the Wi-Fi name and password.

Should I use WPA3 or WPA2 on my router?

The ACSC describes WPA3 first, if the devices in the house support it. If some devices can’t connect using WPA3, its next choice is WPA3 transition mode, which lets older devices keep working, then WPA2 (also called WPA2-Personal or WPA2-PSK). The ACSC identifies outdated options such as WEP as a risk, and says to consider replacing a router that doesn’t support at least WPA2. See how to turn on WPA3 or WPA2 encryption.

How do I know if my router is too old?

The ACSC says a router that hasn’t had a firmware update or security patch in more than 12 months is likely to be end of life. It says manufacturers usually provide security updates for “3 to 5 years”, depending on brand and model. The model number is on the sticker or in the manual, and the maker’s website or support team can confirm an end-of-life date. See how to tell if a router is end of life.

What do I do if I see unknown devices on my Wi-Fi?

The ACSC describes changing the Wi-Fi name and password, which disconnects every device, so each one then reconnects with the new details. Reviewing the connected-devices list is part of the ACSC’s six-monthly router health check, and it also describes renaming hard-to-recognise devices, such as smart speakers, so they’re easier to spot. See the ACSC’s six-monthly health check.

What if my router came from my internet provider?

The ACSC’s guide doesn’t give separate steps for provider-supplied routers. The provider’s help pages or support team can explain what applies to its equipment, and the router’s manual has the menus for each model. For a router that has reached end of life, the ACSC suggests talking to the internet provider about compatible replacements. The general steps start at how to log in to the router’s settings.

Where to get official help

• The ACSC’s router guide is the official version of the steps above.
• The ACSC’s advanced personal security guide also covers disabling remote management and UPnP.
• The router’s manual and maker’s support site describe each model’s menus.
• For smart devices on the network, see smart speakers, cameras and doorbells and smart TV security. The guide to securing your online accounts covers the accounts behind them.
• For Wi-Fi away from home, see public Wi-Fi and travel security. For a home office, see working from home securely.