Nobody is targeting your home network personally. What is happening is automated scanning — programs looking for known weaknesses across every address on the internet, continuously.
That is good news, because defending against automated scanning is straightforward. A handful of settings decides whether it finds anything.
Start with the email account
Not the network. The email account.
Your main email address is the key to everything else you own. Banking, shopping, social accounts, your phone account, your energy supplier — every one of them will send a password reset to that address.
Somebody with access to your email has access to your entire online life, and no amount of network security protects against that.
So: a long unique password used nowhere else, and multi-factor authentication switched on. If you do only one thing from this article, do that. See passwords, passkeys and MFA.
The router
Change the administrative password
Two different passwords exist on a router: the wi-fi passphrase, which most people change, and the administrative password for the settings, which most people do not.
Many routers ship with a default administrative password printed on the device or standard across the model. Anything on your network — including a visitor's phone or a compromised smart device — can reach that settings page.
Apply updates
Router firmware receives security updates and most routers do not apply them automatically. Enable automatic updates if the option exists; otherwise check occasionally.
A router more than five or six years old may no longer receive updates at all, which is a reason to replace it regardless of whether it still works.
Turn off remote management
The ability to reach your router's settings from the internet. Almost nobody needs it, and routers with it enabled are found by scanning.
Turn off WPS
The button that connects devices without a password. It has a known weakness and is rarely needed.
Use WPA3 or WPA2 with a good passphrase
Not WEP, which is broken, and not an open network. A long passphrase rather than a complicated short one.
Everything on this list defends against automation rather than against a person. That is what makes it achievable — automated scanning only finds what is easy.
Separate the smart devices
Smart plugs, cameras, doorbells, televisions, speakers, thermostats. Many receive updates rarely and some never, and their security varies from good to essentially absent.
The practical mitigation is to put them on your guest network. Most routers have one and it is normally isolated from the main network, so a compromised device cannot reach your computers or your files.
It costs nothing and takes half an hour of reconnecting devices. It is the most useful home network change after the router password.
The same principle applies in businesses, at larger scale — see VLANs explained.
Keep everything updated
Enable automatic updates on: computers, phones and tablets, browsers, and smart devices where the option exists.
This is the single most effective ongoing security measure available to a household, and it requires no expertise — only that you allow the restarts rather than postponing them for four months.
Retire devices that no longer receive updates. A phone or tablet past its support window accumulates known, unpatched weaknesses.
Cameras and doorbells
Worth specific care because they see inside your house.
Change the default password. Enable multi-factor authentication on the account. Never expose the camera to the internet directly by forwarding a port — use the manufacturer's app instead, imperfect as that may be.
And consider where they point. A doorbell camera covering the pavement, or an indoor camera visible in the background of your video calls, both raise questions worth thinking about in advance.
The realistic threats
What actually happens to households, in order of likelihood:
Reused passwords. A service you used in 2018 is breached, the password appears in a list, and it is tried against your email and your bank automatically. A password manager solves this completely.
Convincing messages. A text about a delivery, an email about a bank account. The defence is a habit rather than a setting: never act on a link in an unexpected message — go to the site yourself.
Unpatched devices. Handled by automatic updates.
Somebody in the house installing something. Separate accounts on shared computers limits the damage.
Notably absent from that list: sophisticated network attacks. Those are not what happens to households.
A half-hour that covers most of it
- Multi-factor authentication on your main email account.
- Change the router administrative password.
- Enable automatic updates everywhere.
- Move smart devices to the guest network.
- Install a password manager and start with your most important accounts.
Our support team helps households across Suffolk and Norfolk get this in order without jargon. Get in touch.
