Secure a home router by changing the default admin login, using the strongest Wi-Fi encryption it offers, keeping firmware current, and switching off features like WPS, UPnP and remote management. These steps come from CISA home network guidance and take about half an hour.
Why the router matters for work
A remote developer's laptop sits behind a consumer router that nobody at the company manages. It sees your traffic, and anything else on the network, from smart TVs to a child's console, shares the same space. You cannot fix all of that, but you can close the common doors.
The checklist
CISA's guidance lists these for wireless and router settings.
- Change the default admin credentials. Default usernames and passwords are often public or printed on the device.
- Use the strongest encryption available. CISA names WPA3 Personal with AES.
- Change the default SSID to a name that does not reveal the manufacturer, your identity or your location.
- Disable WPS. It has a PIN design flaw that makes brute forcing easier.
- Disable UPnP unless you need it. It can let malware bypass the firewall.
- Update router firmware. Check the manufacturer's site and enable automatic updates if offered.
- Disable remote management, so nobody on the internet can change router settings.
- Enable the router's firewall. Confirm it is on, since it may be off by default.
- Review connected devices in the router's list and look for unknown entries.
- Reduce signal reach and turn Wi-Fi off when unused, for example during travel.
The same CISA page also recommends host based firewalls on computers, unique passwords, regular encrypted backups and automatic software updates.
Things the guidance does not cover
CISA's page does not mention guest networks. Many routers offer one, and putting visitors and smart devices on it is a reasonable extra step. It is common practice, not something that page says, so check your router manual for how to set it up.
What to do if the router is old
Look up the model on the manufacturer's site. If it no longer receives firmware updates, replace it. Software fixes cannot reach a device that has no updates coming. Some internet providers supply a router and push updates themselves. In that case, ask them what the update policy is.
Beyond the router
A good router does not replace laptop controls. Keep the host firewall on, disk encryption enabled and updates automatic. The remote work baseline pulls these together.
Quick check
Do I need a VPN at home if the router is locked down?
A VPN is a separate decision about where your traffic exits. A hardened router lowers risk from your local network but does not replace company access controls.
Sources
Last reviewed: 19 October 2026.
