Router and Wi-Fi Security Checklist
Our Wi-Fi Dead Zones guide is about coverage. This one is about the other half of the router: the settings that decide whether the box guarding your internet connection is guarding anything. Most take two minutes and never need touching again.
A router is a small computer that sits between everything you own and the entire internet, and most of them are set up once, by whoever installed the service, and never looked at again. The good news is that the list of things that matter is short, and none of it requires understanding networking.
The Short Version
Change the admin password, turn on automatic firmware updates, use WPA3 or WPA2 with a long passphrase, put smart devices and visitors on the guest network, and turn off the remote-management features you don't use. If the router is too old to get updates, replace it. That's the list. The rest is detail.
The Checklist
Change the admin password
The router's own login, not the Wi-Fi password. The default is printed on the sticker and in every manual online. Make it long and unique, and save it in a password manager.
Turn on automatic firmware updates
Routers ship with bugs that get fixed for years afterward. A router that never updates is a public computer on your doorstep. If there's no auto-update option, plan to replace it.
Use WPA3, or WPA2 with AES
Never WEP, never plain WPA, never TKIP. Mixed WPA2/WPA3 mode keeps older devices connecting. For the passphrase, use a sentence: fifteen characters or more, easy to say out loud to a guest.
Turn off WPS
The push-button and PIN setup has a known weakness that lets a nearby attacker recover the Wi-Fi password. Nobody needs it. Off.
Turn off remote management
“Remote access,” “Access from WAN,” “Cloud management”: off unless you use it on purpose. UPnP lets devices open ports on their own; turn it off if nothing breaks (game consoles are the usual reason to leave it), and at least look at what it has opened.
Put everything that isn't a computer or phone on the guest network
Smart TVs, cameras, doorbells, thermostats, printers, the pool controller, and every visitor. Turn on client isolation so guests can't see each other. A hacked TV then can't reach your laptop.
Rename the network
The default name reveals the model, which tells an attacker which bugs to try. Pick something plain. Don't hide it: a hidden network makes your phones broadcast its name everywhere they go.
Look at the device list
Once a month, glance at the connected-devices page. Anything you can't name gets removed, and the Wi-Fi passphrase changes.
Set DNS filtering on the router
Point the router's DNS at Quad9 (9.9.9.9) or Cloudflare's malware-blocking resolver (1.1.1.2), and every device in the house stops reaching known-bad sites, with no software installed anywhere. The family version is in our family-safe browsing guide.
Replace it when it's done
No firmware update in two years, or the manufacturer lists it as end-of-life, means it's a liability rather than an appliance. Most consumer routers have a useful life of four to six years.
The ISP Gateway Problem
The combination modem-router from Spectrum, Frontier and the rest is managed by the provider, which is good for firmware and bad for control: remote management is on and often can't be turned off, and the guest network options are thin. The clean fix is to put the gateway in bridge mode and run your own router behind it, which also avoids the double-NAT problems that break game consoles and some cameras. If bridge mode isn't offered, change what you can and lean on the guest network.
Small Office Extras
- A separate network for point-of-sale terminals and card readers, which your card processor's rules already expect.
- A real firewall with intrusion prevention and automatic threat feeds, rather than a consumer router doing double duty.
- No port-forwards to cameras or recorders. Use the vendor's app or a VPN instead; see our camera guide.
- Default passwords changed on printers, cameras, recorders and any network storage.
- Logs kept somewhere, so a question about last month has an answer. The Advanced plan's vulnerability scanning and network insights do this continuously.
Signs Someone Is Already In
DNS settings changed to an address you didn't set. An admin password that no longer works. Port-forwards you didn't create. Devices you can't name. Every browser in the house redirecting to odd sites. Any of those means a factory reset, a firmware update before anything else, and a reconfiguration from scratch using the list above. Our three layers guide covers what to do about the accounts afterward.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Do you know the router's admin password, and is it different from the sticker? | Two minutes |
| Has the firmware updated in the last year? | Check, or replace |
| Are the cameras, TVs and smart plugs on a guest network? | Worth twenty minutes |
| Business: is anything port-forwarded from the internet? | Worth a call |
Want It Checked Properly?
We'll go through the router and everything hanging off it, put the smart devices where they belong, and set up filtering, on-site or over a remote session.
Frequently Asked Questions
Should I hide my network name?
No. It adds nothing against a real attacker, and it makes every phone and laptop you own broadcast the name wherever they go looking for it. A strong passphrase is the protection; the name is just a label.
My older devices won't connect with WPA3. What now?
Use the mixed WPA2/WPA3 mode most routers offer. A device that can only do original WPA or WEP is old enough to retire, or at least to live on the guest network where it can't reach anything that matters.
Is a mesh Wi-Fi system less secure than a single router?
No. The same list applies, and mesh systems managed from a phone app usually update themselves, which is the single most important item on it.
Do I need a VPN on my router?
Usually not. A VPN hides your traffic from your internet provider; it does nothing about a default admin password or an unpatched router. Updates and DNS filtering matter more. A business does want a VPN for staff reaching the office from outside, with MFA on it.
How often should I reboot my router?
Rebooting clears glitches, not security problems. If it needs a reboot every few days to stay usable, that's a sign of failing hardware or overheating, which in Florida is common. Updates are what keep it safe.
More Guides
Why the mesh kit didn't fix it, what's really blocking the signal, and the fix that holds.
DNS filtering, per-device controls, and what each one misses.
PoE vs. Wi-Fi, recorder vs. cloud, and the storage math.
Which cable fixes are cosmetic and which ones are bend radius, EMI or fire-safety issues.
What download, upload, latency, jitter and bufferbloat each actually tell you.
The three layers of cyber threats, and which one is actually your problem.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service