Secure a wireless network by changing the router's default admin password, using WPA3 or WPA2 with a long passphrase, installing firmware updates, putting visitors on a guest network and keeping HTTPS on for everything you browse. Updates matter most, because flaws in Wi-Fi itself are fixed only by patching.
What does official guidance recommend?
CISA's advice on securing wireless networks is short and practical. It says to replace the factory administrator password on the router or access point, since default passwords are widely published. It says to encrypt wireless traffic and states that WPA3 is currently the strongest encryption, so use WPA3 capable equipment where possible and avoid relying on older protocols. It recommends the guest feature for visitors, regular checks for firmware updates, a router firewall alongside host firewalls on each device, and changing the default network name so it does not reveal the router's make or model.
CISA also lists filtering devices by MAC address. Treat that as a minor extra: addresses can be copied, so it is not a substitute for strong encryption and a good passphrase.
Why do updates matter so much?
Because some weaknesses are in the protocol. In 2017 researcher Mathy Vanhoef disclosed KRACK, short for key reinstallation attacks, against the WPA2 handshake. An attacker within range tricks a device into reinstalling a key already in use, which resets counters and lets the same encryption keystream be reused. The researchers state that the weaknesses are in the standard itself, so correct implementations are likely affected.
The consequences depended on configuration. An attacker could decrypt some traffic, and with certain ciphers could forge packets, though could not learn the Wi-Fi password. The fix is to patch both clients and access points, since patching one side leaves the other exposed. The patches are backward compatible, so patched and unpatched devices still talk to each other. The researchers' advice was to keep using WPA2 rather than switching to the broken older WEP, and to keep HTTPS on, noting it still adds protection even though it has been bypassed in some situations.
Constructed example: the small office
A ten person office uses one consumer router bought four years ago. Its admin page still uses the label on the underside as a password. The router has not been updated since installation, and the guest laptop of every client and delivery driver joins the same network as the accounting computer.
Four changes fix most of it in an afternoon: set a unique admin password, install the latest firmware, create a guest network for visitors, and replace the shared passphrase with a new, long one that is stored in a password manager. If the router is too old to receive updates, replace it.
What else should you consider?
Remote administration. Turn off access to the router's admin page from the internet unless you truly need it.
Wi-Fi Protected Setup. Disable convenience features you do not use, since each adds attack surface.
Segmentation. Put smart devices, cameras and printers on a separate network from laptops that handle company data. They are updated less often and cannot be trusted as much.
Public networks. On an open hotspot, assume others can observe unencrypted traffic. Prefer a mobile connection for sensitive work, and keep HTTPS and a device firewall on.
Rogue access points. In an office, walk the space or check the controller occasionally for unknown access points.
How to check or apply this
- Log in to the router and set a unique administrator password.
- Choose WPA3, or WPA2 with a passphrase of at least 15 characters if WPA3 is not available.
- Update router and access point firmware, and set a monthly reminder.
- Enable the guest network and move visitors and smart devices to it.
- Disable remote administration and unused features.
- Change the network name so it does not reveal the router model.
- Replace hardware that no longer gets updates.
Quick check
Does changing the Wi-Fi password stop KRACK?
No. The researchers say changing the password does not prevent the attack. Patching the client and the access point does.
Is hiding the network name a security control?
Not a strong one. Changing the default name to avoid revealing the router model is reasonable, but encryption and a long passphrase do the real work.
Sources
Last reviewed: 18 October 2026.
