Lock down the home router
Admin passwords, WPA3, guest Wi-Fi, and a yearly pass so cameras are not on the same LAN as your files.
The home router is the building’s front door. Phones, laptops, TVs, and cameras all leave through it. If the door still has a factory password, the rest of your cyber security is decoration. Hardening a household network is a short project with a long payoff.
Start with the admin account
Find the router’s address — often on a sticker, or the gateway in your computer’s network details. Log in. If the password is admin, password, or printed for the whole apartment building, change it to a long unique string stored in your password manager.
Turn off remote administration from the internet unless you have a specific need. Most homes never need the router’s settings reachable from a café.
Update firmware. Vendors ship fixes for bugs that let strangers run code on the box. If the model is out of support, plan a replacement. Age is a security setting.
Wi-Fi that is boring and strong
Use WPA3 if every device can handle it. Otherwise WPA2-AES. Avoid WEP and WPA with TKIP. Turn WPS off. The PIN and push-button features are convenience with a history of abuse.
Rename the network if the default broadcasts the router brand and model. You do not need a joke SSID that advertises your name either.
Give guests a guest network. Friends do not need to see printers and NAS boxes. Put cheap cameras and bulbs on that guest or IoT segment if the router allows VLANs or a second SSID. A lightbulb with a default cloud password should not sit next to a laptop full of tax PDFs.
Services to shut off
UPnP can punch holes for games and also for malware. If you do not need it, disable it. Port forwarding should be a list you remember, not a surprise.
WPS, Telnet, and old remote-management tools belong off. IPv6 is fine if you understand it; if a VPN leak test still shows your ISP on IPv6, fix that in the VPN app rather than pretending IPv6 is not there.
Change DNS only if you know why. A random “fast DNS” app is a new middleman.
A yearly pass
- Revisit who has the Wi-Fi password. Rotate it if it has been on a fridge photo.
- Drop devices you do not recognize from the client list.
- Confirm the admin password is still yours.
- Check that the firmware is current or that a new router is on the list.
A hardened router will not stop phishing. It will stop the lazy scan of a default password and it will contain a cheap camera that should never have been on the same LAN as your files. That is enough reason to spend the hour.