Router Security Checklist 2026: 12 Settings Worth Checking on Your Home Network
Router Security Checklist 2026: 12 Settings Worth Checking on Your Home Network
Most home routers ship with security features already available but switched off, or set to defaults that prioritise easy setup over protection. The result is that a lot of home networks are less secure than the hardware sitting on the shelf is actually capable of — not because the router is bad, but because nobody's been through its settings since the day it was plugged in. This checklist runs through the router settings actually worth checking, roughly in order of how much they matter, whether you're setting up a brand-new router or auditing one you've had for years.
Do This First: Change the Default Admin Login
If you only do one thing on this list, do this one. Default admin usernames and passwords for common router models are widely published online, and a router still using factory credentials is one of the most common and easiest ways home networks get compromised — it requires no technical skill to exploit, just a lookup. This is separate from your Wi-Fi password: it's the login for the router's own admin/settings page, usually reached by typing the router's IP address into a browser. Change it to something unique, and note it down somewhere other than a sticky note on the router itself.
Enable WPA3 (or WPA2 as a Fallback)
WPA3 is the current Wi-Fi security standard and meaningfully stronger than its predecessor, WPA2, particularly against offline password-guessing attacks. Most routers sold in the last few years support it, though some need it turned on manually rather than shipping with it enabled by default. If your router or any of your devices are old enough to not support WPA3, WPA2 is an acceptable fallback — but avoid the older WEP standard entirely if you encounter it on genuinely old equipment, since WEP is trivially breakable and offers close to no real protection today.
Update the Firmware — and Check Again Periodically
Router firmware updates patch known security vulnerabilities, but unlike a phone or laptop, a router rarely nags you to install them. Check for a firmware update when you first set up a router, and then periodically afterwards — every few months is a reasonable habit — or enable automatic updates if your router supports them. A router running years-old firmware may have long-published vulnerabilities that a simple update would have closed.
Set Up a Separate Guest Network
Nearly every modern router supports a guest Wi-Fi network that's isolated from your main network. Use it for actual visitors, and consider using it (or a second dedicated network, if your router supports more than one SSID) for smart home and IoT devices too — security cameras, smart plugs, smart speakers and similar gadgets are common weak points, and network isolation means a compromised device can't reach your main computers or any shared files and drives. See KitUP's smart home basics guide for how this fits into a wider new-home network setup.
Disable WPS
WPS (Wi-Fi Protected Setup) is the feature that lets you connect a device by pressing a button or entering a short PIN instead of the full Wi-Fi password, and it's a known weak point: the PIN-based version in particular has documented brute-force vulnerabilities that can be exploited in hours rather than requiring genuine effort. Unless you specifically rely on WPS for a device that has no other easy way to connect, turning it off closes a vulnerability for very little day-to-day inconvenience.
Turn Off Remote Management (Unless You Actually Use It)
Remote management lets you access your router's admin settings from outside your home network — useful for specific troubleshooting scenarios, but a feature most households never use and one that widens your router's exposure to the internet for no real benefit if it's switched on by default. Check whether it's enabled, and switch it off unless you have a specific, ongoing reason to keep it on.
Reconsider UPnP
UPnP (Universal Plug and Play) lets devices and applications automatically open ports on your router without you approving each one — convenient for certain games, apps and smart home devices, but it also means any compromised device on your network could open a port to the wider internet on its own. If you don't have a specific application that depends on it, disabling UPnP is a reasonable default; if you do rely on it for something specific, that's a fair trade-off to make knowingly rather than by not knowing the setting existed.
Check That the Firewall Is Actually On
Most modern routers include a basic firewall (often called SPI — stateful packet inspection) enabled by default, but it's worth confirming rather than assuming, particularly on an older router or one that's been reset or reconfigured at some point. This is a baseline layer that controls what traffic is allowed in and out of your network, separate from anything a VPN might add on top.
Use a Strong, Unique Wi-Fi Password
Separate from the admin login, your actual Wi-Fi network password should be long and not reused from another account — length matters more than complexity for resisting brute-force attempts, so a longer passphrase is generally a better choice than a shorter password stuffed with symbols.
Consider Renaming Your Network (Without Advertising It)
Renaming your Wi-Fi network away from a manufacturer's default SSID has a small but real benefit: default SSIDs sometimes reveal the router make and model, which can point an attacker toward known vulnerabilities for that specific hardware. Avoid using your name, address or other identifying information in the new name, since that information is broadcast to anyone nearby.
Review Which Devices Are Actually Connected
Most router admin pages show a list of currently and recently connected devices. Periodically checking this list — every few months is plenty — helps you spot a device you don't recognise, or notice that an old device you thought was disconnected is still on the network. It's a low-effort habit that catches problems the other settings on this list don't directly address.
Consider Encrypted or Filtered DNS
Some routers and standalone devices support DNS-level filtering or encrypted DNS (DNS-over-HTTPS or DNS-over-TLS), which can reduce tracking exposure and block some malicious domains network-wide, for every device without needing anything installed on each one. This is a genuinely useful addition, though it's a layer on top of the fundamentals above rather than a substitute for them — see KitUP's VPN and privacy basics guide for how this fits alongside a VPN if privacy from your internet provider is a separate goal.
Putting It in Order
If you're short on time, the first four items — default admin password, WPA3, firmware update, and a guest network — cover the large majority of practical risk reduction for the least effort. The rest are worth working through when you have half an hour free, roughly in the order listed above, and none of them require replacing your existing router — they're settings changes, not a hardware upgrade, unless your current router genuinely doesn't support WPA3 or a guest network at all.
Frequently Asked Questions
What's the single most important router security setting to change? Changing the default admin username and password, if you haven't already. Default credentials for common router models are widely published, making this one of the easiest and most common ways home networks are compromised — and it takes only a couple of minutes to fix.
Is WPA3 worth switching to if my router already uses WPA2? Yes, if your router and devices support it. WPA3 offers meaningfully stronger protection than WPA2, particularly against offline password-guessing attacks. Check your router's Wi-Fi security settings — some routers support WPA3 but don't enable it by default.
Do I need to replace my router to get these security features? Usually not. Most of this checklist covers settings already present on routers from the last several years — they just need to be found and switched on or off. The main exception is if your router genuinely doesn't support WPA3 or a guest network at all, in which case a newer router would be a worthwhile upgrade.
Should I disable UPnP? For most households, yes, unless a specific application or game you use depends on it. UPnP lets devices open ports on your router automatically, which is convenient but also expands what a compromised device on your network could do without your knowledge.
How often should I check my router's security settings? A full run-through of a checklist like this is worth doing once when you set up a new router, and then a lighter check — firmware updates and the list of connected devices — every few months afterwards.
Final Thoughts
None of these settings require new hardware, and most take a few minutes each — the barrier is usually just not knowing they exist or where to find them in your router's admin interface. Start with the default password, WPA3 and a firmware update, then work through the rest of this list at your own pace. If your current router simply lacks support for WPA3, guest networks or a usable admin interface, that's the point where upgrading the router itself becomes the more efficient fix.
Browse KitUP's range of routers, mesh Wi-Fi systems and networking accessories to find hardware that supports the security features this checklist relies on.