The Complete Home Network Security Checklist

This page contains affiliate links. If you make a purchase through one, we may earn a commission at no extra cost to you.

Most “complete security” guides overwhelm you with two dozen steps you’ll never actually take. This is the shorter version: the handful of things that cover the overwhelming majority of real-world risk, in the order they actually matter — and none of it requires a security background to set up.

0. Lock Down the Router Itself, First

Everything else on this list assumes the network it runs on is reasonably sound. It’s worth five minutes to confirm that before anything else:

• Change the router’s admin password from the factory default. Log in at the router’s local IP (usually 192.168.1.1 or 192.168.0.1, printed on the device itself), find the admin/login settings, and set a unique password — factory defaults are published online per model and are the first thing scanning tools check for.
• Change the wifi network password too, separate from the admin password, if it’s still the sticker default — especially on an older router where that sticker has been visible to every houseguest and delivery person for years.
• Disable WPS (Wi-Fi Protected Setup) in the router’s wireless settings. It’s a convenience feature for pairing devices with a PIN, and that PIN is brute-forceable in hours on older implementations.
• Turn off remote administration if it’s enabled — this is the setting that lets the router’s admin panel be reached from outside your home network, and most people who have it on never intentionally turned it on.
• Check for a firmware update in the router’s settings menu. Router firmware patches real vulnerabilities the same way phone and computer updates do, and it’s the update category people forget exists.
• Set up a guest network for visitors and smart-home devices, so a compromised smart plug or a friend’s infected laptop isn’t sitting on the same network segment as your work computer and NAS.
• Turn off UPnP if you don’t specifically need it. Universal Plug and Play lets devices and apps open ports on your router automatically, without asking — convenient for some game consoles and smart devices, but it also means any compromised device on your network can silently open a hole to the outside.

None of this requires technical knowledge beyond typing an IP address into a browser and clicking through a settings menu. Most routers group these settings under “Wireless,” “Administration,” or “Advanced” tabs — the exact labels vary by manufacturer, but the settings themselves exist on nearly every consumer router made in the last decade.

1. Encrypt Your Traffic on Any Network You Don’t Fully Trust

Public wifi, hotel networks, even your own ISP — all of these can see more of your traffic than most people assume. A VPN like Surfshark closes that gap: 4,500+ servers across 100+ countries, unlimited simultaneous devices (no per-device tax as your household grows), at a genuinely low entry price for what it covers. See our public wifi safety guide and VPN vs. firewall breakdown for the details.

2. Stop Reusing Passwords

The single biggest real-world cause of account compromise isn’t some sophisticated attack — it’s one breached site handing over a password you used somewhere else too. A password manager like RoboForm fixes this permanently, with a Premium tier for individuals and a Family plan covering multiple people at a modest step up. More in our guide to choosing a password manager.

3. Keep Real-Time Antivirus Running, and Back Up in a Way Ransomware Can’t Also Destroy

Real-time antivirus is what actually catches most malware and ransomware before it runs — it’s the primary defense, not an afterthought. Versioned, disconnected backups through something like AOMEI Backupper are the safety net for the cases antivirus misses — the free tier covers basic scheduling, and the paid Professional tier (available as an annual subscription or a one-time lifetime license) adds full disk imaging and version history. Full explanation in antivirus first, backups as the safety net.

4. Know What to Do When Something Goes Wrong Anyway

Even a good setup gets breached sometimes — not because you did something wrong, but because a company holding your data did. Our data breach checklist covers exactly what to do in what order.

That’s the whole list. Five things, done consistently, instead of twenty things done never. Combined, the VPN and password manager alone cost less than most people spend on a single streaming subscription, for the two protections that cover the most common real-world risks.

One point worth stressing: order matters less than consistency. A partial setup you actually maintain — a password manager you use every time, a VPN you remember to turn on — beats a “complete” setup abandoned after the first inconvenient prompt.

If You Suspect You’re Already Compromised, Start Here Instead

If you’re reading this because something already feels wrong — unfamiliar login alerts, a device acting strange, a password that mysteriously stopped working — treat it as a live incident rather than working through the checklist in order. The sequence that actually contains the damage:

1. Change your email password first, from a device you trust. Email is the recovery method for almost every other account, so a compromised inbox is the highest-priority fix — everything else can wait a few minutes for this one.
2. Check your email’s forwarding and filter rules. A common, quiet attacker move is adding a silent forwarding rule that copies your incoming mail to an external address — easy to miss because it doesn’t change anything visible in your inbox.
3. Check your router’s connected-devices list (in the same admin panel from step 0) for anything you don’t recognize, and change the wifi password if you see one.
4. Run a full antivirus scan on any device you use for email, banking, or work — not a quick scan, the full one, even though it takes longer.
5. Change passwords on financial and email accounts next, using unique passwords stored in a password manager rather than variations of what you were using before — reusing a slightly modified version of a compromised password defeats the point.
6. Turn on two-factor authentication on email, banking, and any account that offers it, if it isn’t on already — this alone stops most account-takeover attempts even if a password leaks again later.

Once those six steps are done, come back and work through the full checklist below — the incident response above buys you time and containment, but the ongoing habits are what keep it from happening again.

Why This Order Specifically, Not Just This List

The router settings come first because they’re the foundation everything else sits on — a compromised router can intercept or redirect traffic regardless of how good your other habits are. Encryption comes next because it protects against the most common everyday exposure — unencrypted traffic on networks you don’t control. Password hygiene comes after that because it addresses the single biggest source of actual account compromise: one breached site handing over a password reused elsewhere. Antivirus and backups come next because together they’re the only defense against a category of threat — ransomware, hardware failure — that the first three steps don’t touch at all. The breach response plan comes last because it’s reactive — it only matters once something’s already gone wrong, which is exactly why it’s easy to skip and exactly why it’s worth having ready before you need it.

A Realistic Rollout Over Two Weekends

Trying to do all five steps in one sitting is exactly the kind of overwhelm that causes people to do none of them. A more realistic path: weekend one, log into the router and work through the settings in step 0, then install and configure the VPN and password manager, including actually going through your most-used accounts and updating the worst reused passwords — not all of them, just the handful that matter most (email, banking, and anything tied to payment methods). Weekend two, confirm antivirus is actually running and up to date, set up automated backups and do one test restore, then bookmark a breach-checklist reference for later. This spreads real effort across two sessions instead of one overwhelming afternoon, which is the actual reason most security-checklist articles never get acted on.

What This Checklist Deliberately Doesn’t Cover

Dedicated firewall appliances and full network segmentation are real security measures that matter more for specific situations — a small business handling customer payment data, a household with a complex smart-home setup, or anyone with a specific reason to expect targeted attention. For a typical household, the items here address the overwhelming majority of what actually goes wrong, and adding more tools beyond this baseline has diminishing returns unless a specific risk in your situation calls for it.

Frequently Asked Questions