A practical review for a network you own
For a home or small shared network you are authorised to administer. A workplace, building-managed or provider-managed network may need its responsible team. Good Wi-Fi security reduces risk; it does not prove devices, accounts or internet activity are free of compromise.
Step 1 of 9
In this guide
Identify the network owner and preserve access
Identify the network owner and preserve access
Identify the Wi-Fi network you use, the unit providing it and who manages it. Your internet provider may manage the supplied router; a separate access point or mesh system may have a different owner or app. Do not assume every box is a router or that the NBN connection box contains the Wi-Fi controls.
Use the manufacturer’s or provider’s genuine instructions to reach the correct settings. Do not enter an administrator password into a search advert, unsolicited support page or unfamiliar management app. Do not bypass a browser certificate warning as a generic instruction; confirm the documented local-access method with the legitimate provider if it is unclear.
List devices and essential dependencies before changing anything: phones, printers, smart devices, alarms, payment equipment or work connections. Arrange an appropriate change window and another way to contact support. Preserve authorised access and any supported settings backup privately; configuration exports may contain credentials. If you cannot establish ownership, recovery or the impact on essential equipment, stop and ask the responsible team.
Keep the legitimate management route, owner and recovery plan clear. Do not make a change that could strand essential devices without a supported way back.
Plan and change the Wi-Fi joining password
Plan and change the Wi-Fi joining password
Confirm which setting is the Wi-Fi joining password for the intended main or guest network. It is distinct from the router’s administrator password, provider account and internet-service credentials. Prepare a long, unique, unpredictable passphrase within the equipment’s supported limits. The Australian cyber security handbook recommends at least 15 characters for passwords; check that all required devices accept the chosen passphrase. Do not use a short or reused password for convenience; do not reuse an email or banking password or copy a public example.
Store the new credential in an appropriate private password manager or secure record before applying it. Use the genuine documented wireless settings and change only the intended network in the agreed window. Follow any instructions for linked access points or mesh units; changing one unmanaged unit can leave an inconsistent network.
Expect devices using the old password to need reconnection. Rejoin required devices using their supported method and confirm the correct network name. Use a known existing wired management connection only if authorised and supported; do not move unknown router ports or provider cables. Do not enable an open network to make reconnection easier. If the network name also needs changing, choose one without personal details and plan its reconnection impact separately. A name change alone is not an access control.
Keep the new joining credential private and confirm required devices rejoined. A password change is not evidence that a suspected intrusion has been fully resolved.
Protect router administrator access
Protect router administrator access
Review the legitimate administrator login or management account for the router/mesh system. Replace a shared or factory-default administrator password with a unique one through the supported workflow, where you are authorised. Some equipment has a unique printed credential or provider-controlled account; verify what applies rather than assume every device uses a public default login.
Preserve the supported recovery details privately. Where the genuine cloud management account supports multi-factor authentication, enable it using the account’s documented process and retain recovery access. A secure management account does not remove the need for an appropriate Wi-Fi joining password.
Review whether management from outside the home is actually required. Disable unnecessary remote administration only through documented controls and with the owner’s agreement. Provider maintenance, a managed service and an exposed personal administrator page are different arrangements; do not switch off unknown management settings or open a new management port. If you cannot tell who has access, ask the provider or responsible IT team before changing it.
Keep legitimate recovery and management available only as intended. Do not confuse Wi-Fi membership with permission to administer the router.
More checks6 detailed checks
Review supported Wi-Fi encryption
Review supported Wi-Fi encryption
Check the actual wireless security mode in the genuine management interface. For a personal home network, WPA3-Personal is preferable when the router and required devices support it. A documented WPA2/WPA3 transitional mode can accommodate compatible older devices; WPA2-Personal with AES is an appropriate compatibility option where stronger supported modes cannot be used. Avoid WEP, original WPA, TKIP and open/unsecured modes.
Use the equipment’s current instructions and the needs of the devices that must reconnect. Apple’s router guidance distinguishes current personal-network modes from obsolete mixed settings. A label simply saying “mixed” is not enough to tell which protocols it enables. Do not copy personal-network settings over a workplace’s enterprise authentication.
Plan a supported mode change in the agreed window, then reconnect and test required devices. If an old device only works with obsolete security, seek a supported replacement or properly designed separation rather than weaken the main network. Do not assume a guest network makes obsolete encryption safe. Hiding the network name and MAC address filtering are not substitutes for secure authentication and encryption.
Keep the actual mode and required-device result. A secure Wi-Fi mode protects that wireless link; it does not certify every website, account or device.
Check supported firmware and extra features
Check supported firmware and extra features
Use the genuine manufacturer or provider workflow to check whether this exact model still receives security updates. Some provider-supplied equipment updates automatically; confirm rather than install an image from another model or region. For a manual update, preserve supported settings/recovery and follow the documented steps in a suitable window. Do not interrupt power, unplug cables or press Reset during an update.
Review optional features you do not need, such as WPS simplified joining, remote administration or UPnP automatic port setup. These have different purposes and may affect printers, games or other services. Follow supported guidance and check dependencies before disabling a feature; do not guess at every switch or remove needed provider management. Keep firewall and security protection enabled.
If firmware support has ended, plan compatible replacement with the provider or IT, including phones, internet settings and any other dependencies. Do not leave an unsupported router in service indefinitely because it still connects, or install unofficial firmware as a routine security fix. The Australian cyber security handbook explains why supported device updates matter.
Keep the exact update/support result and any agreed feature change. A successful firmware update is not proof that all unwanted access has been removed.
Review guest and smart-device access
Review guest and smart-device access
If your equipment supports a guest or separate smart-device network, review its intended access and security using the genuine instructions. Give visitors an appropriate guest credential instead of the main network password where suitable. Avoid publicly displayed joining QR codes or passwords; they grant access to whoever can use them.
Check whether the guest network is actually prevented from accessing private devices and administrator controls. The options and defaults vary. A second network name without the required isolation is not proof of separation. Use a harmless test against a resource you own and are authorised to check, or ask IT to validate the design; do not scan neighbours or expose private files to see whether a test passes.
Moving smart devices may affect discovery, casting, phone control or printer access. Agree the needed functions and supported isolation before moving them. Do not simply allow all local-network access to restore one feature. Business devices, work VPNs and managed networks may need a more specific policy than a home guest option.
Keep the intended access and actual test result separate. A guest label or separate password alone does not establish isolation.
Check security warnings and unfamiliar devices
Check security warnings and unfamiliar devices
Record the exact warning from the genuine device or management interface. An outdated encryption warning, a browser’s certificate warning and a suspected account login are different problems. Do not use a frightening web page’s repair number or install its remote-access tool. Check the relevant supported setting or ask the responsible provider.
A connected-device list may use a private/randomised address, generic hostname, old entry or an unfamiliar manufacturer label. Compare your own devices through their supported settings and household inventory before blocking anything. Do not disable private addressing on every device, delete the list or assume slow internet proves someone is stealing Wi-Fi.
If settings change without permission, a management account was accessed, or there are other signs of compromise, preserve the evidence privately and contact the legitimate provider or IT/security contact using a trusted channel. A Wi-Fi password change alone may not address management access or affected devices/accounts. Avoid repeated factory resets or broad deletion that removes useful evidence before an appropriate response is agreed.
Keep the exact evidence and device identification. An explained entry is not a whole-network security clearance; suspected compromise needs a focused response.
Verify security settings and required connections
Verify security settings and required connections
Reopen the genuine settings and confirm the intended network, supported security mode and authorised administrator access remain as planned. Do not share screenshots showing passwords, recovery codes or configuration exports. If you changed a joining credential, test that the required devices can use the new one without publishing it.
Check ordinary internet use and the household or work functions affected by the change, including required printers and guest access. Confirm any intended isolation remains in place. If something fails, record the exact device and stage; do not switch encryption off, share administrator credentials or open the private network to guests as a shortcut.
If normal use and the intended controls are working, keep the private recovery record and stop making changes. Review supported updates periodically and when access needs change. This is a practical check of specific controls, not a penetration test or guarantee the network is free of compromise. Escalate recurring warnings or unapproved changes with the recorded evidence.
When finished, sign out of the management interface and close it on shared devices. Keep the authorised recovery record accessible only to the right people; do not leave an administrator session open for visitors.
Stop once required connections and the intended controls are verified. Keep credentials private and investigate only a remaining or recurring issue.
Back to the symptom checkerWhen should you get home network security help?
When should you get home network security help?
Get help if you cannot identify the legitimate administrator, required devices need obsolete security, provider management is unclear, updates are unsupported or changing access could affect essential equipment. Contact the legitimate provider or responsible IT/security team promptly for suspected unauthorised management or account access.
Provide only a useful private summary: model, supported firmware status, exact warning, intended changes, affected functions and what you already tried. Do not send passwords, recovery codes, complete configuration exports or unrestricted remote-access credentials in response to an unsolicited request.
Our Wi-Fi setup support can help review the network and a suitable supported plan. Agree the impact, recovery route and verification before changes. Do not treat a security review or new router as a promise that no future incident can occur.
Keep essential connectivity, evidence and legitimate recovery intact while a supported security or incident-response plan is agreed.
Book IT support
