9 NSA Tips for Securing Your Home Network

Your home router is a computer. It has a processor, memory, an operating system and a permanent connection to the internet. It is also, in most houses, the one computer nobody has updated since the day the technician plugged it in.

That's why the US National Security Agency bothered to publish Best Practices for Securing Your Home Network, aimed at people who work from home. And in April 2026 the advice stopped being theoretical. The FBI announced it had disrupted a network of home and small-office routers compromised by a unit of Russian military intelligence. The attackers had exploited known flaws in routers, including popular TP-Link models, and changed their DNS settings so traffic quietly went via servers that harvested passwords and login tokens. Microsoft counted more than 18,000 compromised routers in over 120 countries at the campaign's peak. The NSA followed up by urging people to reboot their routers and tighten their settings.

Nobody in that story was a spy. They just had old routers with default settings. Here are the nine practices that matter most, explained.

1. Replace a router that's past its support date

Start here, because everything else depends on it. If the manufacturer has stopped releasing firmware updates, every new vulnerability found in that model stays open forever. The NSA's guidance is blunt: replace end-of-life equipment.

Check the model number on the sticker underneath and search the manufacturer's site for its support status. If your router is the one your ISP gave you in 2018, the answer is probably not good. A decent replacement costs a couple of hundred dollars, which is less than an hour of incident response.

2. Keep the firmware updated, automatically

Firmware is the router's operating system. Most modern routers can update themselves; the setting is usually in the admin page or the manufacturer's app. Turn it on. If yours can't auto-update, put a reminder in your calendar to check monthly. The routers in the 2026 campaign were compromised through flaws that already had fixes.

3. Change the admin password

There are two passwords on a router: the Wi-Fi password and the admin password that controls the router's settings. The admin one often ships as something like "admin" or a short code printed on the label, and default credentials for common models are easy to find online. Change it to a long, unique password and store it in your password manager.

4. Use WPA3, or WPA2 at least, with a long passphrase

Wi-Fi encryption scrambles traffic between your devices and the router so neighbours can't read it. WPA3 is the current standard; use it if all your devices support it, or the mixed WPA2/WPA3 mode if some older gadgets complain. Avoid anything labelled WEP or WPA without a number. They're broken.

The NSA suggests a Wi-Fi passphrase of at least 20 characters. That sounds excessive until you do the maths. An eight-character password using lowercase letters has about 200 billion combinations, which offline cracking hardware can chew through quickly. Four random words strung together (say "copper kettle rainy bicycle") has 26 characters, is easier to type on a smart TV, and pushes the number of combinations into territory no attacker will bother with.

5. Turn off WPS

Wi-Fi Protected Setup lets you connect a device by pushing a button or entering an eight-digit PIN. The PIN version has a well-known design flaw: the router checks the PIN in two halves, so instead of tens of millions of possibilities an attacker only has to try about 11,000. That can be done in hours. The convenience isn't worth it. Switch WPS off in the router settings.

6. Disable remote administration and UPnP

Remote administration lets someone change your router's settings from the internet. Unless you have a specific reason, there's no need for that, and it's exactly the door attackers knock on. Limit administration to devices inside your home.

Universal Plug and Play (UPnP) lets devices on your network open ports through the router's firewall automatically. It's handy for games consoles. It's also handy for malware on a compromised device that wants to open a door to the outside world. The NSA recommends turning it off; if something breaks, open that one port manually.

7. Separate your devices onto different networks

A smart TV, a cheap security camera and a work laptop shouldn't share a network. The cheap gadgets rarely get security updates, and if one is compromised it can probe everything else on the same network.

Most routers offer a guest network. Put the smart home gear and visitors' phones on it, and keep the work laptop and personal computers on the main network. It's the home version of what businesses call network segmentation, and it's one of the easiest wins on this list.

8. Reboot regularly

This is the one that made headlines. The NSA recommends rebooting your router, and your phones and computers, at least once a week. Some malware lives only in a device's memory rather than being written to storage, so a restart wipes it out. The attacker then has to compromise the device all over again, and if you've patched in the meantime, they can't.

A reboot won't fix a router whose settings have been changed, as in the 2026 DNS hijacking campaign. That's why it's number eight on the list, not number one. But it costs nothing. Many routers let you schedule it for 3am on a Sunday, so you never think about it again.

9. Protect the devices, not just the network

A well-configured router is one layer. The devices behind it need their own protection: automatic operating system updates, current antivirus or endpoint protection, a screen lock, and MFA on important accounts. Work laptops in particular should be secure no matter which network they're on, which is the thinking behind our laptop security checklist for working from home.

What this means for a business with remote staff

You can't configure every employee's home router, and you shouldn't try. Instead:

• Give staff a one-page version of this list and offer help if they get stuck.
• Design for the home network being untrusted. With cloud apps, phishing-resistant MFA and conditional access that only accepts managed, compliant devices, a compromised router can redirect traffic but can't easily turn it into a working login.
• Manage work laptops centrally so encryption, patching and endpoint protection are enforced, not hoped for.
• Apply the same rules at the office. Small-office routers were hit in exactly the same campaign. Our business internet service includes managed, supported network equipment.

Not sure how exposed your own network is? Our article on whether your network is locked down covers the business side, and a cyber security assessment will test it properly.

Frequently asked questions

How often should I reboot my router?

The NSA recommends at least once a week. Rebooting clears malware that lives only in memory. Many routers let you schedule an automatic reboot overnight so you don't have to remember.

How do I know if my router is still supported?

Find the model number on the label, then check the manufacturer's website for its support or end-of-life status and the date of the latest firmware release. If there hasn't been an update in a couple of years, plan to replace it.

Should I turn off WPS on my router?

Yes. The PIN method of Wi-Fi Protected Setup can be brute-forced in hours because of a design flaw. Turn WPS off and connect devices with your Wi-Fi password instead.

Is WPA3 worth using at home?

Yes, if your devices support it. WPA3 resists password-guessing attacks better than WPA2. If some older devices won't connect, use the router's mixed WPA2/WPA3 mode with a long passphrase.

Local IT and cyber security support across NSW

Chewing IT runs managed IT and cyber security for small and mid-sized businesses from our Wyong and Hornsby offices, covering the Central Coast, Newcastle, Lake Macquarie and Hornsby.

Got staff working from home on networks nobody has checked? Talk to us about securing remote work — managed laptops, MFA and a home network checklist your team can follow.