Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can substantially harden a home network with the router and devices you already own. The free approach is layered: secure the router, use current Wi-Fi encryption, reduce unnecessary exposure, separate visitors, then secure every connected device and account. It is a baseline, not a promise that a compromise is impossible.
Work through the steps in order. Buy hardware only if your current router still cannot provide WPA2 Personal or WPA3 Personal after you check for firmware updates and the model’s support information.
What “layered security” means for a home network
A router setting cannot compensate for an unpatched camera, a reused account password, or an old device that no longer receives security updates. Each layer reduces a different type of exposure:
| Layer | Free action | What it addresses |
|---|---|---|
| Router administration | Replace default administrator credentials and keep firmware current. | Unauthorized changes to the router itself. |
| Wireless access | Use WPA3 Personal or WPA2 Personal with a unique Wi-Fi password. | People nearby attempting to join or intercept the wireless network. |
| Network exposure | Enable the firewall; disable remote management, WPS, and UPnP when unnecessary. | Features that can expose the router or open paths you do not need. |
| Segmentation | Put visitors and less-trusted equipment on a guest network. | Sharing your primary credentials and allowing every device onto the main network. |
| Device security | Change device defaults, update firmware and apps, enable multifactor authentication, and remove unsupported equipment. | Weak endpoints that can undermine otherwise sound router settings. |
| Account and endpoint security | Use unique long passwords, available multifactor authentication, current operating systems, browsers, apps, and security software. | Compromise through an account or computer rather than through Wi-Fi. |
The Federal Trade Commission’s guidance describes WPA3 as “the newer — and best — encryption available,” while noting that WPA2 also scrambles your information. Read the full FTC guidance on securing a home Wi-Fi network for model-specific context.
#1 Best Overall
Before changing anything: make a safe inventory
Write down the router’s exact model, the internet provider (if it supplied the equipment), and the devices that need to stay connected. Include phones, computers, televisions, streaming boxes, printers, game consoles, cameras, smart speakers, thermostats, plugs, and appliances.
- Find the manufacturer or ISP support page for the router model. The labels and menu names differ by model.
- Identify which device is used to administer the router. If you change the Wi-Fi password, that device may need to reconnect.
- For important smart devices, locate the companion app and its account-recovery method before making network changes.
- Do not begin by factory-resetting the router. A reset can erase ISP connection settings and any configuration you need to restore service.
Keep the old Wi-Fi password available until you have confirmed that essential devices can join with the new one. Do not place a name, street address, or router brand in either a password or a network name.
Step 1: open the official router interface and replace defaults
Use the router manufacturer’s instructions or your ISP’s instructions for the exact model. The administration page may be a local web address or a mobile app; there is no universal path that is safe to guess.
Recommended Free Tools
- Connect to the home network using a trusted computer or phone.
- Open the official management interface and sign in with the current administrator credentials.
- Change the administrator username and password if the model permits changing both. At minimum, replace the default administrator password with a unique, long password.
- Set a separate, unique Wi-Fi password. The administrator password controls router settings; the Wi-Fi password controls network access. They serve different purposes and should not be the same.
- Save the changes, reconnect the management device if necessary, and sign out of the administrator session.
Store the new credentials in a password manager or another protected record. Never send them in a group chat or leave them on a label visible to visitors.
Step 2: choose the strongest available wireless encryption
Open the wireless or Wi-Fi security settings and select the newest personal-security option the router supports.
Rank #2
| Option | Use it when | Action |
|---|---|---|
| WPA3 Personal | The router and the household’s clients support it. | Choose it as the preferred option named in current FTC guidance. |
| WPA2 Personal | WPA3 is unavailable or a necessary device cannot use it. | Use it as the practical supported alternative; keep firmware and clients updated. |
| WPA or WEP only | The router exposes no WPA2 or WPA3 option. | Check for a firmware update, then recheck. If the current router still cannot offer WPA2 or WPA3, consider replacing it. |
Do not select an option merely because it is first in the menu. Confirm that it says “Personal” (sometimes shown as WPA3-Personal or WPA2-Personal), not an obsolete WPA or WEP mode. A mixed WPA2/WPA3 mode can help older clients on some models, but follow the model’s documentation because compatibility behavior differs.
After saving, reconnect a phone and a computer, then test the devices that matter most. If one older device cannot connect, check whether its operating system or firmware has an update before weakening the network for it. If no update exists, place that device on a guest network when practical or retire it rather than reverting the entire router to obsolete encryption.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Step 3: install router firmware updates
Firmware fixes defects in the router’s operating software and can also add or restore security options. In the router interface, look for entries such as Administration, System, Maintenance, or Firmware update. Use only the manufacturer’s support page or the ISP’s documented update process.
- Record the exact model and hardware revision shown on the router or in its interface.
- Check the support page for the newest firmware and its installation instructions.
- Back up settings if the interface offers a backup function, then apply the update exactly as directed.
- Wait for the router to restart; do not unplug it during the update.
- Sign in again and verify that the firewall, Wi-Fi encryption, administrator credentials, and guest network still have the intended values.
ISP-provided equipment may update automatically or may require the ISP to perform the update. Ask the ISP which process applies to your model. Support status is model-specific and can change, so check periodically rather than assuming that an update option means the router is still supported.
Step 4: reduce unnecessary exposure
Keep the built-in firewall enabled
Find the firewall or security section and turn on the router’s built-in firewall. If the ISP supplies a gateway and a separate personal router, ask the ISP which device is performing routing before changing advanced firewall modes; changing modes without understanding the arrangement can interrupt service.
Turn off remote administration when you do not need it
Remote management allows administration from outside the home. Disable it unless you have a specific, understood reason to use it. If you must keep it, restrict it according to the model’s documentation and protect the administrator account with a unique password.
Disable WPS when it is not required
Wi-Fi Protected Setup can make joining easier, but it is not necessary for most households. Turn it off if your devices can join normally without it. If a device depends on WPS, update that device and consult the router instructions before disabling the feature.
Disable UPnP when no application needs it
Universal Plug and Play can let applications request automatic port changes. If no household application requires it, turn it off. If you rely on a game, media server, camera, or other service that needs UPnP, first check that service’s documentation and understand what stops working when UPnP is disabled.
Save each change separately when the interface requires it, then log out of the administrator session. Convenience features are not automatically dangerous, but leaving unused ones enabled creates exposure you do not need.
Step 5: create a guest network
If the router offers a guest network, enable it with a password different from the primary Wi-Fi password. Give visitors that password instead of sharing the credentials for the main network. A guest network can also be useful for equipment you do not fully trust or that does not need to reach computers and storage on the primary network.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #4
- Open the Wi-Fi or guest-network section.
- Give the guest network a neutral name that does not reveal your address or household details.
- Set WPA3 Personal when the guest feature supports it; otherwise use WPA2 Personal.
- Set a unique guest password and enable the option that prevents guests from accessing the local network if the router provides one.
- Connect a test phone, then confirm that normal internet access works and that the model’s documented guest restrictions behave as expected.
Guest isolation is implementation-specific. Some routers block access to primary devices; others provide fewer controls. Read the exact model documentation and do not promise perfect separation simply because the network is labeled “guest.”
Step 6: audit every connected device
Open the router’s connected-device, wireless-client, or DHCP-client list. Match each entry to something in your inventory. An unfamiliar name may be a television, printer, phone, or accessory with a generic hostname, so identify it before blocking it.
| Check | What to do | If the check fails |
|---|---|---|
| Default login | Replace the factory username or password in the device’s app or web interface. | Do not leave the device reachable with publicly documented defaults. |
| Multifactor authentication | Turn on two-factor or other multifactor authentication for the device account when offered. | Use a unique long password and protect the account’s recovery method. |
| Firmware and app updates | Install updates from the device maker and keep its companion app current. | Check whether the model is still supported. |
| Remote features | Disable remote access, cloud control, or other features you do not use. | Follow the device documentation before turning off a feature that is required. |
| Support status | Confirm that the device still receives security updates. | Disconnect it from the network when it is no longer supported or needed. |
Repeat the review after adding a device, changing the router, or noticing an entry you cannot identify. The FTC’s guidance on securing internet-connected devices at home covers the same device-level controls.
Step 7: secure computers, phones, browsers, and accounts
The network is only one layer. Install current operating-system updates on computers and phones, update browsers and apps, and keep reputable security software current where it is available. Remove software you no longer use, especially software that exposes a remote-control service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For important online accounts, use a different long password for each account and turn on multifactor authentication whenever the service offers it. Protect the email account used for password recovery first; losing it can allow an attacker to reset other accounts. A current router cannot protect an account whose password is reused or whose recovery channel is unsecured. CISA’s Five Steps to Protecting Your Digital Home also emphasizes keeping devices and accounts protected as part of a broader home-security routine.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A maintenance routine that keeps the layers intact
- After a router or device update: verify that encryption, firewall, administrator credentials, and guest-network settings remain enabled.
- When someone moves out or no longer needs access: change the Wi-Fi and guest passwords if those credentials were shared.
- When buying or receiving equipment: change defaults before connecting it permanently, enable available multifactor authentication, and check its support status.
- When a device is retired: disconnect it from Wi-Fi and remove its account access. If it stored sensitive information, follow its documented erase or reset procedure before disposal.
- When an unknown client appears: identify it from the router list and household inventory, then change Wi-Fi credentials and review device accounts if you cannot explain it.
Keep a short record of the router model, the date you last checked firmware, and which devices belong on the network. Do not record passwords in that same plain-text list.
Troubleshooting common setup problems
A device will not join after changing encryption
Confirm that the selected mode is WPA3 Personal or WPA2 Personal and that the device’s operating system and firmware are current. Re-enter the new Wi-Fi password, forget the old network profile, and reconnect. If the device still supports only obsolete encryption, isolate it on a guest network if the router permits, replace the device, or use a different supported device; do not downgrade the entire network without understanding the security cost.
The router has no WPA2 or WPA3 setting
Check the exact hardware revision and install any available firmware update. Ask the ISP whether it manages updates for supplied equipment. If current software still offers only WPA or WEP, the router does not meet the encryption baseline in the FTC guidance; consider a WPA2- or WPA3-capable replacement.
A guest device can reach a primary device
Guest-network behavior differs by router. Recheck the guest settings for an option such as local-network access or client isolation, then consult the model documentation. Until you understand the boundary, do not treat the guest network as perfect isolation; keep sensitive services off it and avoid sharing primary credentials.
An application stops working after disabling UPnP or WPS
Identify which feature the application actually requires. Check the application and router documentation for a safer manual configuration or an alternative connection method. Re-enable only the feature you need, keep the router firmware current, and disable it again if you stop using that application.
You cannot identify a device in the client list
Compare its MAC address or hostname with the device information shown in each phone, computer, television, printer, and smart-device app. Temporarily disconnect known devices one at a time and refresh the list. If the entry remains unexplained, change the Wi-Fi password, reconnect only recognized equipment, and review every device account.
When replacing the router is justified
A purchase is the exception, not the first step. Consider replacing the router when all of these are true:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- You checked the exact model and hardware revision.
- You installed the latest available firmware or confirmed with the ISP that updates are managed automatically.
- The router still cannot offer WPA2 Personal or WPA3 Personal.
- It lacks controls your household genuinely needs, such as a firewall, guest network, or a way to change administrator credentials.
- The manufacturer or ISP no longer provides security support.
Choose a replacement whose documentation explicitly states WPA2 Personal or WPA3 Personal support, ongoing firmware updates, administrator-credential changes, a firewall, and a guest network if you need one. Verify those capabilities for the exact model and regional edition; do not assume that a product family has identical features across versions.
Quick Recap
Final verification checklist
- Administrator credentials are no longer the defaults and differ from the Wi-Fi password.
- The primary network uses WPA3 Personal, or WPA2 Personal where WPA3 is unavailable.
- The router firmware is current, or the ISP has confirmed how it is updated.
- The router firewall is enabled.
- Remote management, WPS, and UPnP are disabled unless a documented household need remains.
- A guest network uses its own password, with the model’s available isolation controls enabled.
- Every connected device is identified, has changed defaults, receives updates, and has multifactor authentication enabled where offered.
- Unsupported or unused devices are disconnected.
- Computers, phones, browsers, apps, and security software are current.
- Important accounts use unique long passwords and available multifactor authentication.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
