Securing Your Office Router and Wi-Fi Network
The router is the quiet box that connects every computer, phone and printer in a small office to the internet. Most people set it up once and forget about it. That makes it an easy target. A router left on factory settings can expose the whole network.
The Australian Signals Directorate’s Australian Cyber Security Centre publishes plain advice on securing your Wi-Fi and router. Most of the steps take a few minutes in the router’s settings page. This guide covers what to change and how often to check it.
Why the router deserves attention
Every device on your network passes its traffic through the router. If someone takes control of it, they may be able to see or redirect that traffic. They can also use your connection for their own purposes. For a home office or small studio, the router is often the only thing between your files and the open internet.
Freelancers and small teams feel this most. A home office often relies on a single router and nothing else. If you are building a career as a web designer, client logins and project files will pass through that box every day. It deserves the same care as your laptop.
Change the default logins first
Routers ship with a default admin username and password for the settings page. The ACSC warns that these defaults may be published online for anyone to see. Change both in the router’s admin settings. Then log out and back in to confirm the new details work.
Use a long passphrase and store it in a password manager. The ACSC links to its own guidance on passphrases and password managers from the router page. Do not reuse a password from another account. Write the router model and login location somewhere safe for the next time you need it.
Rename the network and set a strong Wi-Fi password
The network name, also called the SSID, often reveals the router’s make and model by default. The ACSC suggests choosing a new name that contains no personal information. Then change the Wi-Fi password to something long that you do not use anywhere else. You will need to reconnect each device afterwards.
Many routers broadcast on two bands, such as 2.4 GHz and 5 GHz. Apply the same changes to each band you use. The ACSC recommends turning off any network you do not use.
Use the strongest encryption your devices support
Encryption scrambles the traffic between your devices and the router. The ACSC recommends setting the encryption to WPA3 if possible. If some devices cannot connect, use WPA3 transition mode. If that is not available, choose WPA2, which may be listed as WPA2 Personal or WPA2 PSK.
Older settings such as WEP are outdated. The ACSC says that if a router does not support at least WPA2, you should consider replacing it. That is a clear sign the hardware is past its useful life.
Keep the firmware up to date
Firmware is the software that runs the router itself. Manufacturers release updates to fix security flaws. Check for updates in the router settings or on the manufacturer’s website. The ACSC advises downloading firmware only from official sources.
If the router offers automatic updates, switch them on. When you do update by hand, let the process finish. The ACSC warns that cutting the power, unplugging cables or pressing reset during an update can leave the router unusable. Some manufacturers will also alert you when an update is available.
Turn off features you do not need
Routers come with extra features that make life easier but also open doors. Remote management is the big one. The ACSC calls it one of the most common ways that routers are compromised. It advises turning off remote management along with Telnet, SSH and SNMP access from outside the network. Several other features are worth reviewing in the settings page:
- WPS, or Wi-Fi Protected Setup, because its PIN method can be broken by repeated guessing.
- UPnP, which the ACSC describes as a potential security risk, after checking which devices rely on it.
- FTP file sharing, because its transfers are not encrypted.
- Port forwarding rules that are no longer required.
The idea behind all of this is least privilege. Keep only the services each device or person genuinely needs. If a smart device or game stops working after you disable UPnP, set up that device manually instead. Fewer open features means fewer ways in.
Give visitors a guest network
Clients, contractors and family members often ask for the Wi-Fi password. A guest network gives them internet access with its own name and password. The ACSC notes that it keeps untrusted devices separate from your main network. Your work computers and shared drives stay out of reach.
A guest network is also handy for testing. If you design or build websites, you can check pages on a visitor’s phone without adding it to your main network. It is a simple way to keep work and guest traffic apart. Guests who need to use a shared smart TV will have to join the main network instead.
Know when to replace the router
Routers do not get security updates forever. The ACSC says manufacturers usually provide them for three to five years. Once a model reaches end of life, new flaws are no longer fixed. Find the model number on the device or in the manual and check the manufacturer’s site.
The ACSC gives a useful rule of thumb. If no firmware or security patch has been released in more than 12 months, the router is likely at end of life. Replace it promptly with a model that supports automatic updates. Your internet provider can suggest compatible options.
A newer router can also help with speed inside the office. Local Wi-Fi problems sometimes get blamed on a website when the real issue is the connection. If you want to know what actually affects load times, our guide on how to make your website faster covers the site side. Separating the two saves a lot of guesswork.
A six monthly router check
The ACSC recommends a router health check at least every six months. Set a calendar reminder so it does not slip. Confirm the router has not reached end of life and check for firmware updates if they are not automatic. Review the list of connected devices and remove any you do not recognise.
Finish by rebooting the router. Turn it off at the power point, wait a few seconds and turn it back on. The ACSC also suggests switching the router off when you go away on holiday. First think about devices that depend on it, such as security cameras.
Physical security matters too. The ACSC asks whether the router is in a secure place and who can reach it. A router sitting near a front window or a shared hallway is easier to tamper with. Keep it somewhere only you and your team can access.
Who this matters for
These steps suit anyone working from a small office or spare room. That includes people running a side business or a hobby site. Your logins for hosting, email and client systems all pass through your router. Anyone handling client information has even more reason to lock it down.
A secure router is a small job that protects everything built on top of it. Treat it as part of your regular hardware maintenance. The six monthly health check above is an easy way to keep it on track.
Frequently asked questions
Should I use the router supplied by my internet provider?
It can be fine if it still receives updates and supports WPA2 or WPA3. Check its end of life status on the manufacturer’s site. If updates have stopped, ask your provider about a replacement.
Is WPA2 still safe to use?
The ACSC recommends WPA3 where possible, with WPA2 as the fallback when devices cannot connect. The ACSC suggests replacing a router that cannot do at least WPA2. Older options such as WEP are outdated.
How often should I check my router?
The ACSC recommends at least every six months. Check for end of life status and updates, review connected devices and reboot. A calendar reminder makes this easy to keep up.
Do I need to turn off remote management?
The ACSC advises turning it off. It describes remote management as one of the most common ways routers are compromised. Most small offices can manage the router from inside the network instead.
