Lesson 3 of 720 minutesHands-on

Make your Wi-Fi hard to crack

Your Wi-Fi signal goes through walls, into the street and into your neighbours’ homes. What stops anyone in range from joining is the security mode your router uses and the password behind it. In this lesson you’ll check both, turn off the shortcut that undoes them, and set up a separate guest network for visitors and gadgets.

In this lesson

  • Choose the strongest Wi-Fi security mode your devices support
  • Set a passphrase that holds up, and turn off WPS
  • Create a guest network and keep it separate from your own devices

You’ll need: your router’s admin page, your device list from Lesson 1, and ten minutes when nobody in the house needs the internet (changing the Wi-Fi password disconnects everyone).

Security modes, from best to never

Mode in your routerUse it?
WPA3 (sometimes “WPA3-Personal” or “WPA3-SAE”)Yes, if every device in your home supports it. It’s the current standard and resists password guessing much better.
WPA2/WPA3 mixed (“transition mode”)A good choice when some older devices only understand WPA2.
WPA2-AES (or “WPA2-PSK [AES]”)Still sound, as long as the password is strong.
WPA, WEP, or anything mentioning TKIPNever. These are outdated and can be broken.

With WPA2, the password matters a great deal. Someone in range can capture the brief exchange that happens when a device joins your network, take it away, and try password guesses against it on their own computer, as fast as their hardware allows. A short or common password falls quickly. A long passphrase doesn’t.

Try it yourself · part 1

Check the mode and set a passphrase

  1. In the admin page, open Wireless, Wi-Fi or WLAN settings. If your router has separate settings for 2.4 GHz and 5 GHz, check both.
  2. Look at the security mode. Choose WPA3 if all your devices support it, or WPA2/WPA3 mixed if you’re not sure. Never leave it on WPA, WEP or TKIP.
  3. Make a new passphrase: open Password Tools, go to the Passphrase tab, choose 5 words and click Generate. Five random words are strong, and much easier to type on a TV remote than a jumble of symbols.
  4. Save the passphrase in your password manager, then set it on the router and save. Every device will disconnect; reconnect the ones from your main network list first.

Turn off WPS

WPS (Wi-Fi Protected Setup) is the push-button or PIN shortcut for joining a network without typing the password. The PIN version has a design flaw, published in 2011, that lets an attacker in range guess the PIN in hours and recover your Wi-Fi password, however strong it is. You lose nothing important by turning it off: it only saves typing the password once per device.

Try it yourself · part 2

Switch off WPS

  1. Find WPS in the wireless settings (sometimes under Advanced).
  2. Turn it off. Some routers have separate switches for the button and the PIN; turn off every one you can find.
  3. Save, then look again after the router restarts to make sure it stayed off.
Two settings that sound useful but aren’t: hiding your network name doesn’t stop anyone who wants to find it, and makes your devices call out the hidden name wherever they go. And filtering by MAC address is easy to get around, because addresses can be copied, and modern phones change theirs anyway. The security mode and the passphrase are what protect you.

A separate network for guests and gadgets

Most routers can run a guest network: a second Wi-Fi name with its own password, kept apart from your main devices. Visitors get the internet without being able to see your computers, printer or shared files. It’s also the right home for the smart plugs, cameras and speakers you labelled guest network in Lesson 1, because a gadget that gets taken over there can’t reach the rest of your home.

Try it yourself · part 3

Set up the guest network

  1. Find Guest network or Guest Wi-Fi in the admin page and switch it on. Some mesh systems have it in their phone app.
  2. Give it a different name from your main network, the same security mode, and its own passphrase.
  3. Look for an option like Allow guests to see each other and access my local network, Access intranet or Network isolation. Set it so guests can’t reach your local network. This is the setting that makes it a real guest network.
  4. Move one device from your guest network list to it as a test, for example a smart plug, and check it still works in its app. Lesson 6 moves the rest.

If your router has no guest network at all, that’s a good reason to consider a newer one when you next replace it.

Key takeaways

  • Use WPA3, or WPA2/WPA3 mixed if older devices need it. Never WPA, WEP or TKIP.
  • With WPA2, the password can be guessed offline, so make it a long passphrase.
  • WPS’s PIN can reveal your password whatever its strength. Turn it off.
  • A guest network with isolation on keeps visitors and gadgets away from your own devices.
  • Hiding the network name and MAC filtering don’t add real security.

Check yourself

Three questions. Pick one answer each and you’ll see why.

1. Some of your older devices won’t connect when you choose WPA3. What’s the best option?

2. Why turn off WPS when your Wi-Fi password is already strong?

3. What makes a guest network actually protect your other devices?

Next: what your network looks like from the internet, and the doors you can close.

This lesson is part of the free course Secure Your Home Network, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.

Scroll to Top