Wi-Fi and Home Network Security | Free Cybersecurity Course: Protect Your Data, Devices and Business

What you'll learn

What's on a typical home network and why the router is its front door.
A 10-step router hardening checklist you can finish in under an hour.
Which Wi-Fi security setting to choose (WPA3, WPA2, or never WEP) and why.
How to isolate smart devices and visitors on a separate network.
How to use public Wi-Fi safely while traveling or working from a coffee shop.

📥 Practice this lesson

Open your router's settings next to the "Home network" section of the checklist and tick each item as you fix it.

cybersecurity-checklist.xlsx · Personal Checklist sheet

Your home router connects every device you own to the internet, and for many people it hasn't been touched since the installer left. Securing it means four things: change the default admin password, keep the firmware updated, use modern Wi-Fi encryption with a strong passphrase, and put smart gadgets and guests on their own network. This lesson walks through each step, explains the reasons behind them, and finishes with the rules for using public Wi-Fi without exposing your accounts.

1router guards every phone, laptop, camera and smart speaker in the house

10settings to check, most of them in the router app or admin page

< 1 hourto complete the full hardening checklist in this lesson

Map your network
Lock down the router
Choose the right encryption
Separate smart devices
Stay safe on public Wi-Fi

What's on your home network

A home network usually has a modem (connects to your internet provider), a router (directs traffic between your devices and the internet, and usually includes a basic firewall), and a Wi-Fi access point, which is often built into the router or spread across several "mesh" units. Many internet providers hand you a single box that does all three.

Then come the devices, and there are more of them than most people think. Take a fictional family in San Diego who counted theirs for the first time:

Phones, laptops, tablets (33%) 9Hold email, banking and work data. These stay on the main network.
Smart home devices (52%) 14Cameras, smart plugs, thermostat, doorbell, speakers, robot vacuum.
TVs and game consoles (15%) 4Rarely updated by hand, often connected for years.

More than half the devices were smart gadgets that rarely receive updates. That's exactly why they belong on a separate network.

Every device is a possible way in. A forgotten camera with a default password can be enlisted into a botnet; a laptop with old software can be infected and then reach everything else on the same network. The router is where you control all of it.

The 10-step router hardening checklist

Log into your router through its app or by typing its address in a browser (often printed on a label on the device). Then work through this list:

Before you change settings

Write down (or screenshot) the current Wi-Fi name and password, and know how to factory-reset the router in case you lock yourself out. If your internet provider manages the router, some settings may be in their app instead. Changing the Wi-Fi password disconnects every device, so plan 15 minutes to reconnect them.

1. Your router offers WEP, WPA2-Personal, WPA2/WPA3 mixed and WPA3-Personal. All your devices are less than four years old. Which should you choose?

WEP, because every device supports it
WPA3-Personal
WPA2-Personal, because it's the most common

WPA3 is the current standard and is more resistant to offline password guessing. Use mixed mode only if an older device can't connect. WEP has been broken for many years.

Wi-Fi encryption standards compared

The Wi-Fi security setting decides how traffic between your devices and the router is protected, and how hard it is for someone nearby to guess your Wi-Fi password.

WEPFrom the late 1990s

Security: ●●●●
Status: Broken; can be cracked quickly.
Use it?: Never. Replace any device that only supports WEP.

Avoid

WPA (original)A stopgap fix for WEP

Security: ●●●●
Status: Outdated and weak.
Use it?: No.

Avoid

WPA2Common for many years

Security: ●●●●
Status: Acceptable with a long, random passphrase.
Use it?: If WPA3 isn't available, or in mixed mode.

Acceptable

WPA3Current standard

Security: ●●●●
Status: Stronger protection against password guessing.
Use it?: Yes, whenever all devices support it.

Recommended

Even with WPA3, the passphrase still matters. A five-word random passphrase gives about 64.6 bits of entropy (5 × 12.92, using the 7,776-word diceware list from lesson 4): long enough to resist guessing and still easy to type on a smart TV remote.

Give smart devices their own network

Smart devices are convenient, but many get few updates, use weak default settings and stay connected for years. The safest approach is segmentation: put them on a separate network so that, if one is compromised, it can't reach your laptop or your files.

Network	What goes on it	Why
Main network	Phones, laptops, tablets, the family computer	Your most sensitive data, kept away from weaker devices
IoT network (or guest network if you only have one extra)	Cameras, plugs, speakers, thermostat, TVs, consoles	Limits what a compromised gadget can reach
Guest network	Visitors' devices	Friends' phones may be infected without anyone knowing

For the San Diego family, that meant 18 of their 27 devices (two-thirds) moved to the separate network. A few gadgets, like some casting features, may need the main network to work; decide case by case and favor security for cameras and anything with a microphone.

When you buy smart devices, look for these signs of a responsible maker: automatic security updates, a stated support period, the ability to change the default password, and MFA on the companion app's account. And change any default passwords the day you plug the device in.

2. Why put a smart doorbell camera on a separate IoT network instead of the main network?

It makes the camera's video quality better
Separate networks don't need passwords
If the camera is compromised, it can't easily reach your laptops and their data

Segmentation limits "lateral movement": an attacker who takes over a weak device stays stuck on the network with other low-value devices.

Public Wi-Fi: rules for the road

Coffee shops, hotels and airports offer convenient Wi-Fi, but you don't control who else is on it or who set it up. Criminals can create an "evil twin" hotspot with the same name as the real one, and on networks with no password your traffic to non-encrypted sites can be read by others nearby. Most websites and apps now use HTTPS, which encrypts traffic between you and the site, so the risk is lower than it once was, but these habits are still worth keeping:

Best optionUse your phone's hotspotYour cellular connection is generally safer than an unknown shared network.
Before connectingConfirm the exact network nameAsk staff. Be suspicious of duplicates like "Airport_Free_WiFi" and "Airport Free WiFi."
While connectedStick to HTTPS and official appsNever click through a certificate warning; close the page instead. For work, use the VPN your employer provides.
SettingsTurn off auto-join and file sharingStop your device from silently reconnecting to networks with familiar names.
AfterForget the networkRemove it from your saved networks when you leave.

3. You're at a hotel in Chicago and see two networks: "Lakeview-Guest" (password from the front desk) and "Lakeview Guest FREE" (no password). What should you do?

Confirm the official network with the front desk, or use your phone's hotspot
Connect to the free one, since both are from the hotel
Connect to both to get faster speeds

A look-alike open network is a classic evil-twin setup. Confirm the official name and password with staff, or avoid the question entirely by using your hotspot.

Common mistakes

Keeping the admin password printed on the router label.

Change it on day one and store it in your password manager.

"Hiding" the network name and calling it secure.

Hidden SSIDs are still easy to detect. Real protection comes from WPA3 and a strong passphrase.

Giving the main Wi-Fi password to every visitor and contractor.

Share the guest network instead, and change its password from time to time.

Running the same router for a decade.

Check whether the maker still releases updates. If not, replace it.

4. Which router feature should usually be turned off because it can let devices open ports in your firewall automatically?

Automatic firmware updates
UPnP (Universal Plug and Play)
The guest network

UPnP lets devices on your network open incoming connections without your approval. Turn it off unless a specific device truly needs it; keep automatic updates and the guest network on.

Practice exercise

Priya in Raleigh logs into her router and finds: admin user "admin" with password "admin"; firmware from 2022 with an update available; Wi-Fi security "WPA2-Personal"; Wi-Fi password "Priya1985"; WPS on; remote management on; UPnP on; no guest network; network name "Priya-Patel-Apt4B"; 6 smart plugs and 2 cameras on the main network. List the fixes in order of priority and explain the top three.

See solution

Change the admin password to a long unique one. With "admin/admin," anyone who reaches the admin page controls the network.
Turn off remote management. Combined with a default password, it exposes the router to the whole internet.
Update the firmware and enable automatic updates. Four years of missing fixes likely includes security patches.
Switch to WPA3 (or mixed mode) and replace "Priya1985" with a five-word random passphrase.
Turn off WPS and UPnP.
Create a guest/IoT network and move the 6 plugs and 2 cameras there; change the cameras' default passwords.
Rename the network to something that doesn't reveal her name or apartment.

The top three come first because they let an attacker take control of the router itself, which would undo every other setting.

Summary

The router is the front door of your home network: change its default password and keep its firmware updated.
Use WPA3-Personal (or WPA2/WPA3 mixed) with a long random passphrase; never WEP or an open network.
Turn off WPS, remote management and UPnP unless you have a specific need.
Put smart devices and visitors on separate networks so a weak gadget can't reach your computers.
On public Wi-Fi, prefer your phone's hotspot, confirm network names and stick to HTTPS.

Next lesson: Networking Fundamentals: IP, Ports, DNS and Firewalls. You'll learn how data moves across networks, what ports and DNS are, and how firewall rules protect a small office.