Start with what is on your network
You cannot protect what you do not know about. Before changing any settings, list the devices that connect: computers, phones, printers, cameras, smart speakers, televisions and anything else with a network connection. Most routers show a list of connected devices in their administration page. Anything you do not recognize deserves a closer look. In a small office, keep this list written down and update it when equipment is added or removed.
This inventory also shows how the pieces fit together. If you are unsure what the router, switch and access point each do, our overview of how network infrastructure fits together explains the roles.
Secure the router first
The router is the front door to your network, so it is the first place to look.
- Change the administrator password. Many routers ship with a default login that is widely known or printed on a label. Replace it with a long, unique one and store it in a password manager.
- Turn off remote administration unless you truly need it. Managing the router from the internet makes it a more visible target.
- Update the firmware. Router makers release updates to fix security flaws. Check for updates now and then, and turn on automatic updates if the router offers them. If the router is old enough that it no longer receives updates, plan to replace it, since known flaws will stay open.
- Disable features you do not use. Options such as remote file sharing, universal plug-and-play or WPS push-button setup are sometimes convenient but widen the number of ways in. Turn off what you do not need, and consult the router’s documentation if you are unsure what a setting does.
- Change the default network name if it reveals the router model. This is a minor point, but it avoids telling outsiders what equipment you use.
Use modern wireless encryption
Wireless encryption scrambles traffic between your devices and the router so that nearby people cannot easily read it. Choose the newest standard your devices support, which is currently WPA3, or WPA2 with a strong passphrase if WPA3 is not available. Avoid open networks and the old WEP and original WPA options, which are considered weak.
The Wi-Fi password should be long and not a dictionary word with a number tacked on. A passphrase of several unrelated words is easy to type and hard to guess. Change it if you have given it to someone who no longer needs access. Details such as Wi-Fi channels affect speed and interference rather than security, so they matter less here.
Separate what does not need to talk to each other
Segmentation means dividing a network into parts so that a problem in one part does not automatically reach the others. In a home or small office, this can be quite simple:
- A guest network for visitors, which keeps their phones and laptops away from your computers and shared drives.
- A separate network for smart devices. Cameras, televisions and appliances often receive fewer updates than computers. Placing them on their own network limits what an attacker can reach if one is compromised.
- A separate area for business systems if you work from home or run a small office, so that payment systems, file servers or work laptops are not on the same network as family devices or customer Wi-Fi.
Many consumer routers offer a guest network feature. More advanced separation, such as virtual networks, usually requires equipment that supports it, and it is worth getting help if you are not comfortable configuring it. Give each segment its own password, and where possible block the guest network from seeing other devices.
Control traffic with a firewall
Most routers include a basic firewall that blocks unsolicited incoming connections by default. Check that it is turned on and leave it that way. In larger setups, firewall rules define what traffic is allowed between segments and to the internet, and a good starting point is to allow only what is needed and block the rest. Avoid forwarding ports from the internet to internal devices unless you understand the risk, because each forwarded port is an opening that needs to be kept updated and protected.
Protect the devices on the network
A secure network helps, but each device still needs its own protection. Keep operating systems and apps current, and make sure patch management is routine rather than occasional. Use screen locks, turn on disk encryption where available, and require a second sign-in step on important accounts. A well-configured network does not make an infected or outdated laptop safe.
When working away from home, treat public wireless networks as untrusted. Virtual private networks can encrypt traffic between your device and the provider’s server, which helps on shared networks, but they do not protect against phishing or malware, and they shift trust to the VPN provider.
Apply least privilege to people and devices
Give people access only to what they need. In a small office, that might mean limiting who can change the router settings, use shared drives or install software. Using the principle of least privilege, everyday accounts should not have administrator rights, and administrators should use a separate account for administrative tasks. If an everyday account is compromised, the damage is smaller.
Keep an eye on the network
Security is not finished once the settings are chosen. Basic monitoring can be modest:
- Review the list of connected devices occasionally and investigate unfamiliar ones.
- Check whether your router keeps a log of events, and look at it after anything odd happens. Learning to read system logs is a useful skill because logs often show what happened and when.
- Pay attention to signs such as unusually slow connections, unexpected prompts or devices that restart on their own. These do not always mean an attack, but they are reasons to look closer.
Larger offices may use system monitoring tools that alert someone when something unusual occurs. Even then, regular vulnerability scanning of devices facing the internet can find weaknesses before others do, but it should be done only on equipment you own or are authorized to test.
A short routine to keep it secure
- Change default passwords and update router firmware.
- Use WPA3 or WPA2 with a long passphrase, and disable features you do not need.
- Set up a guest network and, if possible, a separate one for smart devices.
- Keep the firewall on and avoid unnecessary port forwarding.
- Review connected devices and update everything every few months.
- Keep backups of important files separate from the network, so a compromise does not take both.
No setup removes all risk, and home and small-office equipment varies widely, so check your own router’s documentation for how each setting is named. The aim is to make the common attacks harder and to notice problems sooner.