Secure a smart home from the router outward: change the router's default login, use WPA3 Personal or WPA2 AES, keep firmware updated and turn off remote management, WPS and (after setup) UPnP, as CISA advises. Then change every device's default password, turn on two-step verification and automatic updates, put internet-only devices on the guest network, check the manufacturer still supports each device, and factory reset anything before you sell it, as the UK NCSC advises. Each step has a trade-off, covered below.

The short version

  1. Change the router's login. CISA says to change the default router username and password. Trade-off: if you forget the new one, you may have to factory reset the router and set it up again, so store it in a password manager.
  2. Check the Wi-Fi encryption. CISA says to confirm the router uses WPA3 Personal or WPA2 AES. If it is open, or uses WEP, WPA or WPA2 TKIP, ask your internet provider for an upgrade or buy a new router. Trade-off: older devices may not support the newest mode, so test before you switch everything.
  3. Use a long Wi-Fi passphrase. CISA suggests 5 to 7 unrelated words totalling at least 16 characters, not reused elsewhere, and a network name with no personal details.
  4. Update the router. CISA says routine updates protect against known vulnerabilities; turn on automatic updates if the router offers them. Trade-off: an update can briefly drop your connection, and CISA's guidance does not say how to time it, so pick a quiet hour if the settings allow.
  5. Turn off the risky extras. CISA says to disable remote management, WPS, and UPnP (after any device that needs it during setup has been added). Trade-off: WPS and UPnP are conveniences that make some devices easier to connect, so you may need to enter a Wi-Fi password by hand.

Go deeper

Originally published on PlayCISO. Drafted with AI assistance.