When the internet slows down and the router flickers strangely, it often leaves network owners perplexed. However, the problem is often not caused by a provider's equipment failure, but rather by simple traffic theft by neighbors or random passersby. In densely populated urban areas, the range of a hotspot often extends beyond the apartment, making your network visible to dozens of surrounding devices.
The consequences of unauthorized access can be far more serious than simply slowing down page loading speeds. An attacker with access to your local network could theoretically intercept transmitted data, attack connected devices, or use your IP address to commit illegal activities online. That's why protecting your home WiFi should be a top priority, immediately after installing your router.
Modern routers offer a wide range of security features, but many users limit themselves to setting a simple password, often leaving the factory security settings unchanged. This isn't enough to guarantee security. In this article, we'll explore a comprehensive approach to securing your wireless network, from basic encryption settings to advanced device filtering methods.
Basic protection: password change and encryption
The first and most obvious step is to set a strong wireless network access key. Factory passwords, often printed on a sticker on the bottom of the device, are publicly available. Hackers and other advanced users have databases of standard combinations for various router models. Change password a unique combination is the foundation of security.
The password must be complex, containing at least 12 characters, including uppercase and lowercase letters, numbers, and special characters. However, password complexity alone means nothing without the correct encryption protocol. In the wireless settings (Wireless Settings) it is necessary to select the most modern safety standard.
The protocols are currently valid WPA2-PSK (AES) and newer WPA3Outdated standards WEP And WPA (TKIP) hacked in minutes using automated scripts. If your router supports WPA3, be sure to activate it. Otherwise, choose WPA2-PSK with encryption algorithm AES.
⚠️ Warning: Do not use mixed encryption mode WPA/WPA2, unless there is a pressing need to support very old devices. The presence of a vulnerable protocol WPA in the mixture puts the entire network at risk, allowing it to be attacked through the least protected element.
After changing the settings, all your devices will require reconnection with the new password. This is normal, confirming that the old access keys are no longer valid. Changing your password regularly, at least every six months, is also a good digital hygiene practice.
Setting up a network name (SSID) and hiding broadcasts
Network name or SSID (Service Set Identifier) is what you see in the list of available connections on your smartphone. By default, routers are often named after the manufacturer and model, for example, TP-Link_5G_2A3BThis name immediately tells a potential hacker what kind of device they're dealing with and hints at any vulnerabilities its firmware might contain.
It's recommended to change the network name to something neutral that doesn't contain personal information (last name, apartment number) or hardware model information. Further protection lies in the ability to hide the network from the public list. Hide SSID (or Enable Hidden Wireless) stops broadcasting the network name.
When this feature is enabled, your network disappears from the shared list on your neighbors' phones. To connect to it, you'll have to manually enter the network name and password on each new device. This creates a "protection" effect against random passersby, although to an experienced technician, the hidden network is just as visible, just without the name.
How effective is SSID hiding?
Hiding the network name isn't a cryptographic security method. Traffic is still transmitted over the air, and specialized scanners can easily detect the presence of a hidden access point through its service packets. However, it effectively protects against "lazy" neighbors simply looking for a way to connect without a password.
It's worth noting that on some mobile devices (especially the latest versions of iOS and Android), connecting to hidden networks may be delayed or require additional confirmation, as the device constantly polls the airwaves for a familiar name.
MAC address filtering: whitelist
Every network device has a unique physical address known as MAC addressThis is an identifier hardcoded into a network card or WiFi module. Routers allow you to create access control lists based on these addresses. You can configure the router to allow only specific devices onto the network.
This function is usually located in the section Wireless MAC FilteringYou will need to find out the MAC addresses of all your gadgets (phones, laptops, TVs) and add them to the "White List" (Allow List). After activating the "Allow" mode (Allow the stations specified by any enabled entries to access), all other devices, even knowing the password, will not be able to connect.
- 📱 Find the MAC address in your phone's WiFi settings (often hidden in "Details" or "Status").
- 💻 On a Windows computer, the address can be found using the command
ipconfig /allin the line "Physical address". - 🖥️ Enter the address into the router interface by clicking the "Add New" or "Add" button.
- ✅ Activate the filtering rule and select the "Allow" mode.
The main drawback of this method is the labor-intensive nature of its maintenance. Every time you have guests or buy a new gadget, you'll have to manually enter its address into the router settings. However, for a home network with a constant set of devices, this provides a very high level of control.
☑️ Setting up MAC filtering
Disabling WPS and remote control
Technology WPS (Wi-Fi Protected Setup) was created to simplify connecting devices by pressing a button or entering a PIN. Unfortunately, the implementation of this feature in most routers contains critical vulnerabilities. The WPS PIN consists of only 8 digits, and brute-forcing it takes anywhere from several hours to a couple of days.
The first thing you need to do to improve security is to find the item in the settings WPS or QSS and transfer it to a state Disable (Disabled). Even if you don't use the connect button, the feature may remain active in the background, creating a "backdoor" into your network.
The second important aspect is remote control (Remote Management). This feature allows you to administer your router from the internet, not just your home network. If you don't need to access your router settings while at work or on vacation, you should definitely disable this feature. It opens a port for external connections, which expands your attack surface.
⚠️ Note: Interfaces and menu item names may vary depending on the firmware version and router manufacturer (Keenetic, TP-Link, Asus, MikroTik). If you cannot find the described functions, please refer to the official documentation for your specific model.
Also check which port the router's web interface is running on. The standard port 80 or 8080 It is better to replace it with a non-standard one (for example, 8085) to make life difficult for automated scanners, although within a local network this provides only minimal security gains.
Comparison of WiFi security methods
To better understand the methods described, it's worth comparing their effectiveness and impact on usability. Not all methods are equally useful in all situations, and sometimes it's necessary to find a balance between safety and convenience.
| Method of protection | Level of protection | Impact on convenience | Recommendation |
|---|---|---|---|
| Complex WPA2/WPA3 password | High | Low (enter once) | A must for everyone |
| Hiding the SSID | Average | Average (manual name entry) | Recommended |
| MAC address filtering | High | High (difficult to add guests) | For advanced users |
| Disabling WPS | Critical | Low (button does not work) | Necessarily |
As the table shows, a combination of several methods yields the best results. For example, using a complex password with WPS disabled closes 95% of attack vectors. MAC address filtering adds another layer of protection, making network penetration extremely difficult even with a known password.
Don't rely on just one method. A comprehensive approach, known in information security as Defense in Depth (layered defense) assumes that when one barrier is compromised (for example, a password leak), other defense mechanisms come into play.
Control and monitoring of connected devices
Even after configuring all security settings, it's important to periodically check the network status. Modern routers allow you to see a list of all active clients in real time. This section is usually called Client List, Wireless Status or DHCP Server List.
Get into the habit of looking at this list once a month. You should know each device by name: your phone, laptop, smart speaker, TV. If you see an unfamiliar name (for example, Unknown-Device or a device with a MAC address from another manufacturer), this is a cause for concern.
If you detect an intruder, don't panic. Most routers allow you to instantly block the device directly from the client list (button Block or Deny). After being blocked, it is recommended to immediately change your WiFi network password, as the old one may have been compromised.
Some advanced firmware (for example, OpenWrt or proprietary OS from Keenetic And MikroTik) allow you to set up notifications. The router will automatically send you an email or instant message if a new device connects to the network. This allows you to respond to intrusions immediately.
Updating the router firmware
Rounding out the list of security measures is regular router firmware updates. Manufacturers constantly release patches to address discovered vulnerabilities in security protocols. Outdated firmware is an open door for hackers to exploit known security holes.
The update process is usually simple: you need to go to the section System Tools -> Firmware UpgradeMany modern models can check for updates automatically. If your model is several years old and the manufacturer has stopped releasing updates, it's time to consider buying new hardware.
Using an outdated router without security updates is like storing money in a safe with the door open. Even the most complex passwords won't save you if the device itself has a software bug that allows you to bypass authentication.
What to do if there is no update?
If the manufacturer officially announces end-of-life support, the router becomes potentially vulnerable. In this case, it's best to use it only in access point mode behind a newer primary router or replace it with a modern model.
Remember that security is a process, not a one-time action. Regularly checking your settings and updating your passwords and software will ensure your home internet remains stable and fast, free of unwanted access.
Can my neighbor see what websites I visit if he connects to my WiFi?
If a neighbor simply connects to your network, they technically become part of the local network. However, thanks to traffic encryption (HTTPS, which almost all modern websites use), they won't be able to see page content, passwords, or correspondence. They'll only be able to see the domain names of the resources you're visiting (for example, that you're visiting youtube.com), but not specific videos or pages. However, if your network doesn't have encryption (WPA2/WPA3), intercepting your traffic becomes trivial.
Does the number of connected devices affect internet speed?
Yes, directly. The WiFi channel is shared among all active users. If someone is downloading large files or watching 4K video, the available bandwidth for other devices is reduced. Furthermore, the router must switch between devices, which creates latency. Limiting the number of devices using a MAC filter helps maintain speed for your devices.
Is it safe to use a Guest Network?
Using a guest network is an excellent security practice. A guest network isolates guest devices from your main local network. Even if a guest's phone is infected with a virus, it won't be able to attack your computer or NAS storage because they are on different virtual subnets. This is also a benefit for guests—they won't have access to your personal files.
Will changing the password change the smart home settings?
Yes, all smart home devices (lamps, outlets, cameras) connected via WiFi will lose connection to the router after changing the password or network name (SSID). You will need to reconfigure each device by connecting to it through the manufacturer's app and entering the new network information. This may take time if you have many devices.