How do you pick a Wi-Fi router for working from home securely?

For working from home, choose a router the maker still updates, with WPA3 or at least WPA2 using AES, a separate guest network and an admin page you can lock down. Support status matters more than speed ratings. Then change the default password and name before anyone connects.

Why does the router matter for work?

Every device in the house, your work laptop included, reaches the internet through that one box. CISA's guidance on home network security says plainly that two common beliefs are wrong: that a home network is too small to be attacked, and that devices are secure enough out of the box. Most attacks are not personal. They scan for weak targets.

What should you look for when buying?

Ongoing updates. Ask how long the maker will ship security fixes for the model, and whether the router can update itself. A router that no longer gets patches is an exposed device. CISA's directive on end-of-support edge devices targets federal networks, yet the point carries over: unsupported devices at the network edge are a known route in.

Modern Wi-Fi security. WPA3 is the current standard. WPA2 with AES is acceptable where devices are older. Avoid open networks and the old WEP and WPA settings.

A guest network. Smart TVs, game consoles and visitors' phones belong on a separate segment, away from the work laptop.

Control over the admin page. You should be able to turn off remote management, change the admin username and password, and see which devices are connected.

Clear documentation. If the maker has no security contact or update notes, that tells you something.

What should you set up first?

Constructed example: Priya works from home for a small accounting firm. She buys a router, plugs it in and leaves the settings alone. The admin password is printed on a sticker, remote management is on, and her family's smart plugs share the network with her work laptop. Fixing that takes twenty minutes: new admin password, remote management off, the plugs moved to a guest network, automatic updates on.

CISA's guidance gives the same shape of advice: update software regularly, remove unnecessary services, change default factory settings, and change default login names and passwords. Its guide on wireless networks adds that an unsecured access point can be used by anyone within range, which may be farther than you expect.

What about mesh systems and ISP boxes?

Mesh kits spread coverage across a home with several units. They follow the same rules: check update support, use WPA3 where devices allow, and keep the admin account locked down. Many mesh systems are managed through a phone app, so the app account needs a strong password and multifactor login, because whoever controls the account controls the network.

If your internet provider supplies the router, you can often still add your own behind it, or ask the provider to put theirs in bridge mode. Whichever you pick, one device should do the routing, and you should know which one it is.

How to check or apply this

1. Look up the model's support page. Find the last firmware release date and any end-of-support note.
2. Log in to the admin page and change the admin password to a long, unique one.
3. Set Wi-Fi to WPA3, or WPA2 with AES, and use a long passphrase.
4. Turn off remote administration and any service you do not use.
5. Create a guest network for visitors and smart devices.
6. Enable automatic firmware updates, or put a monthly reminder in your calendar.
7. Check your employer's remote work policy. Some require a VPN or a managed device on top of this.

Quick check

Sources

• Wi-Fi Alliance, Wi-Fi security
• CISA, Home Network Security
• CISA, Securing Wireless Networks
• CISA BOD 26-02, Mitigating Risk From End-of-Support Edge Devices

Last reviewed: 18 October 2026.