How to Secure WiFi: Guide to Protecting Your Wireless Network

Step 1. Change the Default Router Login

Connect to the router via an Ethernet connection. Do not use a WiFi connection to get to the administrative access. Usually, the Admin interface for a router is at http://192.168.0.1 or http://192.168.1.1.

Once in, log in with the default admin username and password. Even though you want to change it, you still have to get in the first time.

Depending on your router, the steps to change the administrative username and password will be different. For Arris, this is listed under Login settings:

Change both the username and the password. Use a long, random password and store it somewhere safe — not on a sticky note on your desk.

Step 2. Change and Hide your SSID

The SSID is the identity for your secure WiFi network. It’s the name people use to find it and connect to the network, and how to set it apart. Leaving it as “Netgear001” or “Linksys123” makes you a target — it tells potential attackers what hardware you use.

Some routers even let you specify multiple networks (more on that in a moment). Check your manual, but the typical steps are:

Log into your router (you did set up a new username and password from Step 1, right?). Select your WiFi network and change the SSID, and turn off “Broadcast Network Name.”

Save those settings. The WiFi network will still work, it just won’t tell everyone about it. While you’re at it, make sure that the Pre-Shared Key is something unique.

💡Expert Tip Use memorable phrases rather than simple words or numbers.

Now we’re hidden. This won’t stop a determined attacker using tools like NetSpot — but it adds a layer of obscurity.

Step 3. Use Strong Wi-Fi Encryption

Most modern routers automatically enable Wi-Fi encryption by default. But — are you sure your router’s encryption is enabled and properly configured? Don’t assume it is — you should always verify your router’s security settings.

Choose WPA3-Personal if available, or WPA2-AES as the fallback. Avoid WEP, WPA, and WPA2-TKIP — they are outdated and vulnerable.

How to check your encryption: Use NetSpot’s Inspector Mode to view the security settings of nearby networks, including your own.

The steps for configuring your WiFi network encryption differ slightly between router models, but generally, follow these instructions:

Log into your router and set Security Mode or Encryption Level to WPA3-Personal. If WPA3 is not supported by your router, use WPA2-PSK (AES) instead.

💡Expert Tip: Regularly update your router’s firmware to ensure support for the latest security protocols like WPA3.

Step 8. Turn On Your Router’s Firewall

A firewall functions as a defensive mechanism that regulates network traffic coming into and going out of a system based on established security rules.

• Rule 1: Reject all inbound connections that were not explicitly requested (Any: DENY).
• Rule 2: Permit inbound connections solely when they are responses to outgoing requests initiated by devices within the network (stateful firewall).
• Rule 3: Enable “Ping Blocking” to prevent your router from responding to external ping requests (ICMP Echo requests). Hackers often ping networks to identify active systems. By blocking ping responses, you make your network less visible.

Another setting is to block “fragmented packets.” A packet is a bit of network, containing a header saying where the packet is going and what information it carries. It’s like a letter that computers send each other on the network. The envelope shows where the letter came from and where it’s going to, and inside the letter is the actual information.

But sometimes a hacker will send a fragmented packet. This is a packet that is formed badly on purpose to confuse the router or computers into accepting bad information that they usually would deny. It can trick the computer into granting access because the computer will do it’s best to guess what the fragmented traffic is trying to get to. By denying these, it prevents those issues in the first place:

💡Expert Tip: Regularly review firewall logs to rapidly identify and address possible security risks by monitoring suspicious behavior.

Step 9. Limit Your WiFi Range

When it comes to wireless networks, most users want to achieve the widest signal coverage possible. In some cases, that’s really the correct approach, but not always. Because that’s the easiest way to prevent hackers and curious strangers from trying to obtain access to it.

More advanced routers let you limit your network range by changing transmission power in settings, but you can also influence it by changing the placement of your router. We recommend you use NetSpot’s Survey mode to create a visual map of your WiFi coverage.

The map will make it easy to see exactly how far your signal can reach and where it is the strongest.

Step 10. Physically Secure Your Router

Physical security is often overlooked, but that doesn’t make it any less important. Unless your router is located someplace where strangers can’t easily go and protected by a strong admin password, an opportunistic attacker could replace it with their own router, connect their laptop to it and change its settings, or even infect it with malware.