In short and in plain language
A router is the small box for your internet. All devices in your home go online through it. If it is poorly protected, strangers have an easier time.
The article shows how to protect your router better. Change the password it came with. Use long passwords of your own.
Turn on automatic updates. An update is a small fix for the device. Also switch to the newer type of encryption.
A separate guest network helps for cameras and smart plugs. This keeps them apart from your phone and computer.
Turn off what you do not need. This often includes access from outside. We come to your home and set this up with you.
For most people the Wi-Fi router sits inconspicuously in the hallway or the living room, blinking away, untouched for years - yet it is the heart of your digital home. Every device that goes online runs through it: laptop and phone, the smart TV, the video doorbell, the smart plug and the heating control. That is exactly what makes it a rewarding target. If the router is poorly secured, attackers do not just have one door open but the whole home network. And the number of connected devices is growing fast: already 43 percent (Bitkom) of households in Germany use smart-home applications, and worldwide around 18.8 billion (IoT Analytics) devices were connected by the end of 2024. At the same time it shows how little many people care about the basic settings: 86 percent (Broadband Genie) of users have never changed the default admin password of their router. This guide explains in calm steps how to secure your router and all connected devices against outside access - from WPA3 encryption through a separate guest network for smart-home devices to automatic updates. And if you would rather not tackle it alone, we set up your home network securely at your place.
Key takeaways
- The router is the heart of the home network and can be attacked around the clock - yet 86 percent (Broadband Genie) never change the preset admin password.
- The three most effective steps are your own long admin password, encryption set to WPA3 and automatic firmware updates switched on (BSI).
- The Wi-Fi password and the admin password are two different things: both should be long, unique and separate from each other, and the network name should not reveal the router model.
- A guest network separates cameras, plugs and other smart-home devices from the main network, where only trusted devices such as laptop, phone and tablet remain (BSI).
- Convenience features cost security: WPS and UPnP should stay switched off unless they are explicitly needed, and so should remote access from the internet.
Why an Unsecured Router Becomes a Gateway
A router is a small computer that is connected around the clock - and therefore vulnerable around the clock. Automated programs constantly scan the internet for devices with known gaps or factory-set default passwords. If an open spot is found, access is done in seconds, without any human deliberately targeting you. How large the attack surface is becomes clear from the damage figures: by one estimate, cybercrime causes the German economy around 267 billion euros (Bitkom) in damage each year, and 52 percent (Bitkom) of internet users have already been affected themselves by data theft, fraud or malware. Since around 95 percent (Federal Statistical Office) of households in Germany have an internet connection and security researchers register over 450,000 (AV-TEST) new malware samples every day, the home router is long past being a niche topic - it is part of your own security, like a door lock. The federal government therefore recommends a fixed set of basic settings for private households, which we go through in plain terms in this guide.
Look first, then act
The Most Common Weak Points in the Home Network
The good news first: almost all gateways can be closed with a few steps, and most of them cost no money, only a few minutes in the router settings. The weak points have stayed the same for years. At the very top is the factory default password that many people never replace. Behind it come outdated encryption, open convenience features like WPS and UPnP, remote access reachable from the internet and firmware that has seen no update for years. This is exactly where attacks strike - because 89 percent (Broadband Genie) of those surveyed have never updated the firmware of their router, even though it is precisely that which closes security gaps. How real the danger is was shown by the Mirai botnet: in 2016 it hijacked around 600,000 (heise online) poorly secured internet devices and thereby brought down large parts of well-known online services. The overview below sorts the typical weak points and shows where an intervention helps most.
Factory default password
Preset passwords like admin are openly listed in manuals and online lists - they should be the first thing you replace.
Outdated encryption
A Wi-Fi without WPA3 or even with the old WEP can be eavesdropped on far more easily with freely available tools.
WPS and UPnP left on
Convenience features for quick connecting also open well-known attack paths and should stay switched off.
Remote access from the net
If the router interface is reachable from the internet, automated attacks try to log in around the clock.
Outdated firmware
Without updates, known gaps stay open - automatic firmware updates close them without you having to think about it.
Unprotected IoT devices
Cheap cameras, plugs and sensors are often weakly secured and become a quiet gateway into the home network.
WPA3 Instead of WPA2: the Right Encryption
The Wi-Fi encryption decides how hard it is to eavesdrop on the wireless traffic between your devices and the router. The current standard is called WPA3 and is the recommendation of the Federal Office for Information Security for new setups. WPA3 makes guessing passwords noticeably harder and also protects better when a password is not particularly long. Its predecessor WPA2 is still considered usable but has known weaknesses; the older WPA and the long-outdated WEP should no longer be used at all. Many routers offer a mixed mode that allows WPA3 and WPA2 at the same time - that makes sense as long as older devices in the household do not yet support WPA3. What matters is that the encryption is on the newest level your device supports. The overview below shows the differences at a glance.
| Feature | Outdated (WEP/WPA) | Current (WPA3) |
|---|---|---|
| Protection from eavesdropping | weak, crackable with tools | far more robust against listening in |
| Short passwords | easily attacked | better secured than with WPA2 |
| Federal recommendation | no longer use | recommended standard per BSI |
| Device compatibility | old, but everywhere | modern devices, mixed mode possible |
| Fit for everyday use | not included | yes, without a noticeable downside |
Keep network name and password apart
Securing the Router: Step by Step
It sounds like a lot, but it is done in a short half hour. The following order is based on the recommendations of the Federal Office for Information Security and takes you from the most important to the finer step. Work through the list calmly in order and note the new passwords in a safe place - for example in a password manager that takes over the remembering for you. If you are unsure which setting sits where in your router, the manufacturer's manual helps, and it can usually be found online too.
- Change the admin password for the router interface from the factory value to a long, personal password.
- Set the Wi-Fi encryption to WPA3, and choose the WPA3/WPA2 mixed mode for older devices.
- Assign a long, unique Wi-Fi password and pick a network name without a model hint.
- Switch off WPS and UPnP unless you expressly need these convenience features.
- Deactivate remote access from the internet if you do not use it deliberately and securely.
- Turn on automatic firmware updates so that security gaps are closed without your involvement.
A Separate Guest Network for Smart-Home Devices
One trick from the Federal Office for Information Security is especially effective and yet little known: the guest network. Almost every modern router can open a second, separate Wi-Fi that was originally meant for visitors. This very guest network is ideal for walling off smart-home and IoT devices from the actual home network. The idea behind it: cameras, lights, plugs or robot vacuums are often more weakly secured than your laptop and can be updated less often. If such a device hangs in the same network as your computer and an attacker takes it over, they can go on from there to access your photos, documents and banking. If the device sits in the guest network instead, it is cut off from the rest - a hijacked motion sensor then simply cannot reach your private files. How to build a smart home in a data-minimal and secure way from the start is also shown in our guide on data protection and security in the smart home. The following checklist walks through the setup.
- Set up a guest network in the router with its own name and its own long password.
- Register smart-home devices like cameras, plugs and sensors there instead of in the main network.
- Where possible, enable the option that guest devices may not communicate with each other.
- Reserve the main network alone for trusted devices such as laptop, phone and tablet.
- Regularly review which devices are registered and remove unknown entries.
Keeping Firmware Current and Closing Remote Access
No router is free of vulnerabilities from the start, and that is normal: manufacturers close gaps that become known through firmware updates. If these are not installed, every once-public weakness stays open permanently - a feast for automated attacks. Because hardly anyone searches for updates by hand - according to surveys only around half of respondents (BSI Digitalbarometer) use automatic updates - the simplest and most effective measure is to switch on automatic updating in the router. Then the device loads new firmware on its own, usually at night. Just as important is remote access: many routers can be set so that you reach the interface from on the road via the internet. That is convenient but opens a door at which login attempts knock around the clock. Anyone who does not deliberately and securely need remote access switches it off. Also watch whether your router is still supplied with updates - very old models eventually receive no more security updates and should then be replaced.
Beware of convenience features and remote maintenance
Strong Passwords for Router and Wi-Fi
In the end, the security of your home network stands or falls with the passwords. That 86 percent (Broadband Genie) of users never change the admin password of their router is perhaps the most consequential negligence of all - because whoever knows the factory credentials has a clear run. A good password is long and unique: the longer the better, and it should not be used anywhere else. Whether you remember a long sequence of words or rely on random characters is secondary - what counts is length and uniqueness. Because no one can remember a separate long password for every device and every service, a password manager helps, keeping everything encrypted and generating new passwords on request. That way you combine security and convenience without sticking a note on the router.
The rule of thumb
Bringing Smart-Home Devices Onto the Network Safely
With every new smart device the home network grows - and with it the number of spots where something can go wrong. Forecasts assume around 40 billion (IoT Analytics) connected devices by 2030, and already today many households have on average more than ten connected devices (Deloitte), from the television to the toothbrush. So that this does not become a risk, the same basic rules apply to smart-home devices as to the router: change the preset password, install updates and put the devices in the guest network. When buying, look for manufacturers that promise updates over a longer period, and for a seal like the IT Security Label of the federal office. Many devices also request more data than they need for their function - here a critical look at the app settings pays off. If you are building a smart home from scratch, our overview of the Matter standard 2026 helps in choosing durable, cross-manufacturer technology. On request we take on the secure setup of your smart home including cameras and doorbell at the same time.
Security in the home network is not a one-off project but a handful of good habits. Anyone who changes passwords, allows updates and puts smart devices in the guest network has done the most important part.
Explained Plainly - Also for Seniors
Router settings put many people off - cryptic menus, English terms, the fear of accidentally knocking out the internet. This worry is understandable but unfounded: nothing of what we describe here cannot be undone again, and with a little patience every setting can be found. Especially for older people who have many connected devices in the house but little contact with their technology, a secure home network is particularly important. We take the time to explain each step calmly, instead of just quickly changing something. Anyone who relies on smart helpers at home anyway should secure them cleanly from the start - that applies to the camera as much as to smart lights for nighttime fall prevention or a home emergency call with a subsidy from the care insurance. For all questions around technology in older age we offer the right, patient setting with our tech help for seniors. The following points help relatives at first glance:
- Check together whether the Wi-Fi password and the admin password are still the factory values.
- See whether automatic updates are switched on and activate them if needed.
- List all smart devices and consider which should move to the guest network.
- Note important credentials in a safe place, not as a slip of paper on the router.
- Name one fixed contact the person can turn to when unsure.
How We Secure Your Home Network On Site
You do not have to wrestle with all of this alone. We come to your home, look at your router and the registered devices and set up the security together with you. We change the passwords, set the encryption to WPA3, create a guest network for your smart-home devices, switch on automatic updates and deactivate what you do not need. On request we check at the same time whether your Wi-Fi arrives stably throughout the house, set up an automatic data backup or help with the secure setup of your cameras. Afterwards we explain patiently what you should watch out for in future - also for beginners and seniors. You get one personal contact instead of a hotline. Transparent terms and the home-visit flat rate can be found on the page about our prices.
Check the home network
We look at the router, encryption and all registered devices and show you where action is needed.
Secure and separate
We set strong passwords, enable WPA3 and create a guest network for your smart-home devices.
Switch on updates
We enable automatic firmware updates and close open convenience features like WPS and remote access.
Explain patiently
We show you calmly what each setting means - understandable for beginners and seniors too.
Related Articles
Moving house: internet, router and your home tech
Does the contract move with you, when may you give notice and why the Wi-Fi name should stay: the technical half of a house move, planned step by step.
Power cut at home: what still works and what to prepare
Without power the router, IP phone and doorbell go quiet. What keeps working at home, what fails, and how to prepare emergency calls, light and supplies.
Smart home data: new access rights from September 2026
From 12 September 2026, new connected devices must build in access to your data. Which deadlines apply, what you can ask for and what you cannot.