Securing a home network comes down to a short, repeatable checklist: replace the router's default password, enable WPA3, isolate IoT devices on a guest network, disable WPS, close ports you don't need, patch firmware, and keep an eye on what's actually connected. None of it needs enterprise gear. Here is each step in the order that matters.
Start by knowing what is on your network
You can't secure what you can't see. Open your router's admin page and look at the DHCP client or connected-devices list. It shows IP and MAC addresses, and often hostnames. Cross-check each MAC's first three bytes (the OUI) against a vendor lookup to guess the manufacturer. Anything you can't account for gets investigated.
For a fuller picture, nmap -sn 192.168.1.0/24 sweeps the whole subnet and lists live hosts. A dedicated scanner does the same faster and adds identification. DeviceShelf discovers every device on the LAN, resolves hostnames over DNS, mDNS and NetBIOS, guesses the OS and device type, and runs entirely on your machine with no account. If you already use Fing, the Fing alternative page covers what a local-first tool does differently.
Change the router's default password first
Default admin credentials are the single most exploited weakness in home networks. Log into the router, change the admin password to something long and unique, and while you're there rename the default SSID if it reveals the model. This is the one step that undoes the most common attacks, so do it before anything else.
Turn on WPA3, or at least WPA2
In the wireless settings, set encryption to WPA3 if every device supports it. Mixed networks can use WPA2/WPA3 transitional mode. Avoid WPA/WPA2-TKIP and never run an open network. Pick a Wi-Fi passphrase of at least 12 characters that isn't reused anywhere else.
Put IoT devices on a guest network
Smart plugs, cameras and TVs are the least trustworthy things you own, and many phone home constantly. Move them onto a guest or separate SSID that has client isolation enabled, so a compromised bulb can't reach your laptop or NAS. Most consumer routers support this in a few clicks; prosumer gear lets you split it into a proper VLAN.
Turn off WPS, and check UPnP
WPS (the push-button or PIN pairing shortcut) has a known brute-force weakness. Disable it. UPnP is more nuanced: it lets devices open inbound ports automatically, which is convenient for game consoles but can silently expose services to the internet. If you don't rely on it, turn it off and forward ports manually instead.
Find your exposed ports and risky services
This is where most home users are flying blind. A device with Telnet (port 23), an open RDP (3389), or an unauthenticated web panel is a real problem. Run nmap -sV 192.168.1.50 against a host to list open ports and service versions, then ask whether each one needs to be reachable.
DeviceShelf turns this into a prioritized security report: a risk score per device, flags for exposed services like Telnet and RDP, default-credential checks, and CVE hints tied to the software it finds. It won't fix anything for you, but it tells you where you actually stand. The DeviceShelf comparison page lines up how that reporting differs from other LAN scanners.
Keep firmware updated
Check the router first, since it's the gateway everything passes through, then work down to APs, NAS boxes and IoT hubs. Enable automatic updates where the vendor offers them and you trust the track record. Retire any device that no longer receives security patches.
Watch for devices you don't recognize
Security isn't a one-time scan. New devices appear, guests connect, and something unexpected shows up eventually. Continuous presence monitoring with new-device alerts catches that without you re-checking by hand, and per-device bandwidth helps spot a machine behaving oddly.
If you'd rather see all of this on one screen instead of stitching nmap output together, DeviceShelf offers a free 7-day trial, no account needed. Either way, run the checklist top to bottom once, then revisit it every few months.