Free resource · print or save

Home network security checklist

Work through it once from top to bottom, then come back every few months. Every item is a plain action with the free way to do it, so none of it needs enterprise gear.

Print or save as PDF

0 of 13 done · ticks stay in this browser

Know what is on your network

Open the router's connected-devices (DHCP client) list and account for every entry. Free way: match each MAC's first three bytes against a vendor OUI lookup, or run nmap -sn 192.168.1.0/24 to list live hosts.

Investigate anything you can't identify before moving on.

Change the router's default password

Replace the admin password with something long and unique. Default admin credentials are the most exploited weakness in home networks, so do this before anything else.

Rename the default SSID if it gives away the router model.

Turn on WPA3, or at least WPA2

Set Wi-Fi encryption to WPA3, or WPA2/WPA3 transitional if some devices are older. Never run an open network or TKIP.

Use a passphrase of at least 12 characters that you don't reuse anywhere else.

Put IoT devices on a guest network

Move smart plugs, cameras and TVs onto a guest SSID with client isolation on, so a compromised device can't reach your laptop or NAS. Prosumer gear can split this into a proper VLAN instead.

Turn off WPS and check UPnP

Disable WPS. Its PIN pairing has a known brute-force weakness.

Turn off UPnP unless you rely on it, and forward ports manually instead.

Find your exposed ports and risky services

Check hosts for open Telnet (23), RDP (3389) or unauthenticated web panels, then ask whether each open port needs to be reachable at all. Free way: nmap -sV 192.168.1.50 lists open ports and service versions on a host.

Keep firmware updated

Patch the router first, then APs, NAS boxes and IoT hubs. Turn on automatic updates where you trust the vendor.

Retire any device that no longer gets security patches.

Watch for devices you don't recognize

Set up new-device alerts so a new connection gets flagged without you checking by hand.

Want the security reminders by email?

The occasional network-security tip and DeviceShelf release news. Confirmed opt-in, one-click unsubscribe, and no open or click tracking.

Steps 1 and 6, done for you

DeviceShelf finds every device on your LAN, works out what each one is, and turns open ports and risky services into a prioritized security report. It runs locally, without an account. It won't fix anything for you, but it tells you where you stand.

Try free for 7 days

Free to use and share. The full write-up behind each step is in how to secure your home network.