Your router is almost certainly the oldest, least-patched and most privileged computer in your house, and it is the one nobody thinks about. We rebuilt a typical family network from scratch and wrote down every decision, including the ones that turned out to be wrong.
The house in question: two adults working from home, two teenagers, and thirty-one connected devices ranging from work laptops to a smart doorbell to a television that phones home more often than the teenagers do. The starting position was the one most homes are in — an ISP-supplied router on default settings, one flat network, one Wi-Fi password shared with every guest since 2019, and no idea what half the devices were doing.
Nothing below requires enterprise equipment or a networking qualification. It requires an afternoon and a willingness to write things down.
Start with a threat model, not a product
“Is my network secure?” has no answer. “Secure against what?” has several. For a normal household, four threats are worth designing against, and they are not the ones films suggest:
| Threat | Likelihood | Impact | Where it is stopped |
|---|---|---|---|
| Automated scanning of exposed services | Constant | High | Router firewall, no port forwarding |
| A compromised IoT device pivoting inward | Moderate | High | Network segmentation |
| Credential theft via phishing | High | Very high | Endpoint + DNS filtering + MFA |
| Ransomware from a download or attachment | Moderate | Catastrophic | Backups, endpoint protection |
| A neighbour cracking your Wi-Fi | Very low | Moderate | WPA3, long passphrase |
| A targeted attack on you personally | Very low | Very high | Outside the scope of home networking |
Notice where the effort should go. The last two rows are what people worry about; the first four are what actually happens. Every layer below is aimed at one of those first four.
Spend fifteen minutes listing what is actually on your network and what you would genuinely mind losing. Almost everyone discovers a device they had forgotten about and a folder with no backup. That list is your threat model, and it is more useful than any product recommendation.
Layer 1 — The router, your most neglected computer
Every packet in your house passes through it. It runs an operating system, it has a web server, and in a great many homes it has not been updated since it was installed. Six things, in order:
1. Change the administrator password, properly
Not the Wi-Fi password — the administrator login. Default credentials for essentially every consumer router are published, indexed and built into automated tooling. Use a long unique passphrase from your password manager.
2. Disable remote administration
Also listed as “WAN management”, “remote GUI” or “cloud access”. If it is on, your router's login page is reachable from the internet, and it will be found within hours. There is no configuration of this feature that is safe enough to justify the convenience.
3. Turn off UPnP
Universal Plug and Play lets any device on your network silently open a hole through your firewall. It exists so that games and consoles do not require manual configuration, and it means a compromised device can expose itself to the internet without telling you. Turn it off, then fix whatever actually breaks — in our rebuild, exactly one console needed a single manual port forward.
4. Update the firmware, then set a reminder
Enable automatic updates if the router supports them. If it does not, put a recurring calendar entry in. Router firmware updates are infrequent and almost always fix something that matters.
5. Check when your model stopped receiving updates
This is the one people skip and it is the most important. Consumer routers typically get three to five years of security updates. After that, published vulnerabilities remain unpatched for ever. In our rebuild the existing router had been end-of-life for two years and had four known unauthenticated vulnerabilities. No configuration fixes that; it was replaced.
6. Disable WPS
The PIN-based version of Wi-Fi Protected Setup has been trivially brute-forceable since 2011. Some routers still ship with it enabled.
Search for your exact model plus “end of life” or “end of support”. If the vendor stopped issuing security updates, every published vulnerability for it is permanently open. This is the single most common serious problem we find in home networks, and no amount of configuration compensates for it.
Layer 2 — Wireless done properly
Wireless security is largely solved, provided you actually use the solution:
- WPA3, or WPA2/WPA3 mixed mode if older devices need it. WPA3 removes the offline dictionary attack that made weak WPA2 passphrases dangerous. Never WEP, never WPA, never an open network.
- A long passphrase, not a complex one. Four or five unrelated words beat eight characters of punctuation, both for strength and for the probability that a guest types it correctly.
- Hide nothing. Hiding the SSID provides no security — the network is trivially discoverable — and it makes client devices broadcast the name constantly while looking for it, which is marginally worse.
- Do not bother with MAC filtering. Addresses are visible in unencrypted management frames and take seconds to clone. It is inconvenience without security.
- Use the guest network for guests. With client isolation enabled, so guest devices cannot see each other or anything else.
One placement note, because it affects security indirectly: a router in a cupboard forces every device to transmit at higher power and produces the dead spots that make people plug in an unmanaged extender, which is then never updated. Central, elevated, out of the cupboard.
Layer 3 — Segmentation and the IoT problem
This is the layer that matters most and the one almost no household has. On a flat network, every device can reach every other device. Your smart doorbell — a small Linux computer built to a price, running firmware from a vendor who may not exist in three years — sits on the same network as the laptop holding your tax records.
The rebuild used four segments:
| Segment | What lives there | Internet | Can reach other segments? |
|---|---|---|---|
| Trusted | Work laptops, phones, NAS | Yes | Yes, initiates to all |
| Family | Personal laptops, tablets, consoles | Yes | NAS only, on specific ports |
| IoT | Cameras, plugs, TV, doorbell, speakers | Yes | No. Nothing. Ever. |
| Guest | Visitors | Yes | No, with client isolation |
The payoff is a containment boundary. If the doorbell is compromised — and cheap cameras are compromised routinely — the attacker gets a doorbell on a network with nothing else on it. Without segmentation they get a foothold with visibility of every file share in the house.
Put every smart device on the guest network with client isolation enabled. It takes ten minutes, needs no new hardware, and removes the most realistic path from a cheap camera to your personal files.
Doing this on ordinary equipment
You do not need managed switches. Three approaches, in ascending order of capability:
- Guest network as IoT network. Most consumer routers have one, and most support client isolation on it. Put every smart device on it. Crude, free, and eighty per cent of the benefit.
- A router with real VLAN support. Increasingly common on prosumer models. Gives you proper per-segment firewall rules.
- A dedicated firewall appliance. More capability than most homes need, and a genuine time commitment to maintain. Only if you enjoy it.
The compromise that bit us: smart-home controllers often need to discover devices via mDNS broadcasts, which do not cross segments. Our first configuration broke the lighting entirely. The fix was an mDNS reflector between two specific segments, allowing discovery traffic and nothing else. Budget an evening for this; it is the step that generates household complaints.
Layer 4 — DNS, the cheapest filter you own
Nearly every attack begins with a name lookup. Phishing links, malware callbacks, tracking beacons — almost all of it resolves a domain first. Filtering at the DNS layer stops a large fraction of it before a connection is ever attempted, and it costs nothing.
- Set a filtering resolver at the router so every device gets it, including the ones with no settings at all.
- Enable encrypted DNS (DoH or DoT) between your router and the resolver, so lookups are not visible on the path.
- Block newly registered domains if your resolver offers it. Phishing infrastructure is overwhelmingly days old.
- Run a local sinkhole if you want per-device visibility. The logs are genuinely educational — our smart television made 4,102 requests to advertising and telemetry domains in a single week while nominally idle.
DNS filtering blocks things, which is useful. What is more useful is that it tells you what your devices are doing when nobody is looking. Almost everyone who turns this on finds at least one device behaving in a way they would not have agreed to.
The device that ignores you
Some devices hard-code their own DNS servers to bypass whatever you configure. The counter is a firewall rule that redirects all outbound DNS traffic on port 53 back to your resolver, and blocks known DoH endpoints for devices that have no business using them. In our rebuild, two devices were doing this: the television and one brand of smart plug.
Layer 5 — The endpoints themselves
Network controls buy you containment. They do not stop a person typing their password into a convincing fake. That happens on the endpoint, and so does the defence:
- Automatic updates on, everywhere. Operating system, browser, and the applications that open files from the internet. The gap between a patch shipping and an exploit appearing is measured in days.
- One anti-malware product. The one built into your operating system is competent. A second real-time scanner adds overhead and conflicts, as we measured in our Windows optimisation piece.
- Full-disk encryption on every laptop. It is the only control that survives the device being stolen.
- A password manager, and multi-factor authentication everywhere it is offered. App-based codes or a hardware key, not SMS — SIM-swap attacks are no longer exotic.
- A non-administrator account for daily use. Unfashionable, still effective, and it turns a silent compromise into a prompt you have to approve.
Text-message codes are far better than no second factor and considerably worse than the alternatives. SIM-swap attacks are routine and well documented. Where an account offers app-based codes or a hardware security key, use those — especially for email, which is the reset path for everything else you own.
Layer 6 — Backups, because prevention fails
Every layer above reduces probability. None of them reduces it to zero. Backups are what convert a catastrophe into an inconvenience, and they are the only control on this page that helps after everything else has failed.
The 3-2-1 rule remains correct: three copies, two different media, one off-site. For a household that usually means the working copy, a local network drive, and an encrypted cloud copy.
The part people get wrong: a continuously-synced folder is not a backup. Ransomware encrypts the working copy and the sync obediently propagates the encryption. What you need is versioning, with enough retention that you can reach back past the point of infection — thirty days minimum — and ideally one copy that the machine being backed up cannot delete.
If your only copy is a synced folder, ransomware will encrypt the working copy and the sync will faithfully replicate the encrypted version everywhere. You need versioning with at least thirty days of retention, and ideally one copy the infected machine has no credentials to modify.
The restore drill
Once a quarter, restore one real file from each backup and open it. This takes five minutes and it is the only way to discover that your backup has been silently failing for three months, which is a thing that happens to almost everyone eventually. An untested backup is a hypothesis.
Remote access without opening the door
The desire to reach your files from outside is reasonable. The usual implementation — forwarding a port to a device inside your network — is how home networks get compromised.
The hierarchy, best first:
- A mesh VPN (WireGuard-based overlay networks). Nothing is exposed to the internet; devices connect outward and find each other. This is what we deployed, and it took twenty minutes.
- A VPN server on the router. One well-audited service exposed instead of several. Requires you to keep it updated.
- A reverse proxy with authentication in front of a specific service. Acceptable when you understand exactly what you are exposing.
- Direct port forwarding. Only ever to something designed to be internet-facing, and never to a management interface, a camera or a NAS admin panel.
Internet-exposed cameras and NAS management panels are catalogued by search engines built for exactly that purpose. If you need remote access to either, put it behind a VPN. There is no version of “but I changed the password” that makes this safe.
The ten-minute monthly routine
Security is maintenance, not a project. This is what we left the household with:
- Check the connected-device list. Anything you cannot name gets investigated. Name every device as you add it — “android-8f2a” tells you nothing in six months.
- Check for router firmware updates and confirm the model is still supported.
- Review DNS block logs for anything unusual. A device suddenly making thousands of blocked requests is a signal.
- Confirm backups ran and, quarterly, restore one file.
- Rotate the guest passphrase after any period with lots of visitors.
- Remove devices you no longer own. Old phones, sold laptops, the tablet that broke.
The households that stay secure are not the ones with the best equipment. They are the ones where somebody looks at the device list once a month. Marco Lindqvist, Security & Networking
What to do when something does get in
Have the sequence written down before you need it, because the moment you need it is the moment you will not think clearly.
- Disconnect, do not power off. Pull the network cable or turn off Wi-Fi on the affected device. Powering down destroys volatile evidence and can trigger ransomware finalisation.
- Change passwords from a different, known-clean device. Email first, because it is the reset path for everything else.
- Check for unauthorised sessions and app passwords on your important accounts. Revoke everything you do not recognise.
- Rebuild rather than clean. Once something has had administrator rights, you cannot prove it is gone. Reinstall from known-good media.
- Restore data, not applications — and restore from a point before the infection.
- Work out how it got in. If you skip this you will do all of the above again in three months.
Six steps on one sheet of paper, taped inside a cupboard door. At three in the morning, with a ransom note on the screen, nobody remembers to disconnect rather than power off. The paper remembers for you.
None of this is exotic, and the whole rebuild took one afternoon plus an evening of fixing the smart lighting. The device list is now accurate, the doorbell cannot see the tax records, and the household knows what to do at three in the morning. That is what “secure” actually looks like in a house.
Questions readers keep asking
Only if it is out of support or lacks the features you need. Check two things: whether the vendor still issues firmware updates for your exact model, and whether it supports WPA3, a guest network with client isolation, and custom DNS. If it fails the first test, replace it. If it passes the first but fails the second, a separate router behind it in bridge mode is a reasonable middle path.
For the threats in this article, no. A commercial VPN moves your traffic from your ISP to the VPN provider; it does nothing about a compromised IoT device, a phishing email or ransomware. It is genuinely useful on untrusted public Wi-Fi and for privacy from your ISP. It is not a security layer for your home network, and it is frequently sold as one.
Usually by its network behaviour rather than anything on the device itself. Watch for sudden traffic to unfamiliar destinations, connections at hours when the device should be idle, a jump in blocked DNS requests, or a device appearing at an address it has never used. This is why per-device DNS logging is worth the setup: it turns an invisible problem into a visible one.
Not inherently, but they are built to a price, they run software that is rarely updated, and the vendor may not exist in five years. Treat them as untrusted computers that happen to be useful: put them on their own segment, block them from reaching anything else, prefer brands with a published update policy, and assume any device with a camera or microphone will eventually have a vulnerability disclosed.
Segmentation, by a clear margin — moving every smart device onto an isolated guest network. It takes ten minutes, costs nothing, and removes the most realistic attack path in a modern home. Second place goes to versioned backups, because they are the only thing that helps once prevention has already failed.
