How to Secure a Smart Home: The Settings That Matter

Most advice about securing a smart home is a list of thirty things, which is the same as no advice at all. The federal guidance is shorter, and one item on it does more than all the others put together: put the devices on the guest network.

What follows is the short list, why each item is on it, and — at the end — what none of this protects you from, because that gets left out.

1. Put the smart devices on the guest Wi-Fi

This is the one that matters. CISA's own guidance is to "connect any smart home and other IOT devices to your Guest Wi-Fi if internet access is the only thing they require."

The reason is worth understanding rather than just following. A guest network is not merely a second password — on most routers it isolates its clients, so a device on it can reach the internet but cannot see anything else on your home network. It cannot browse your file shares, it cannot reach your laptop, and it cannot open your router's admin page.

That changes what a compromised device can do. A camera or a plug with an unpatched flaw is a nuisance on its own. On a flat network it is a foothold: something that sits inside your house, permanently powered, and can talk to every other machine you own. On an isolated guest network it is a nuisance again.

The catch: "if internet access is the only thing they require" is doing real work in that sentence. Some devices need to see your phone directly on the same network for setup, casting or local control. Chromecast-style casting and some hubs are the usual examples. Those either stay on the main network, or go on the guest network after setup and lose the local feature. Check per device rather than assuming.

If your router offers a client isolation or AP isolation toggle on the guest network, that is the setting doing the work. Some routers have it off by default.

2. Change the router's own login — not the Wi-Fi password

These are two different credentials and people routinely conflate them.

The Wi-Fi password is what joins a device to the network. Most people change it.

The router's admin login is what opens the settings page. Many people never touch it, and CISA is direct about why that matters: change it, because "default router information may be publicly available for anyone to find." It is not a guess — the defaults for consumer routers are published, searchable, and often printed on the label.

Anything already on your network can reach that page. Which is the second reason item 1 comes first.

3. WPA3 Personal, or WPA2 AES. Nothing else

CISA is unusually blunt here: make sure "your router uses WPA3 Personal or WPA2 AES (also referred to as WPA2 Pre-Shared Key [PSK] or WPA2) encryption. These are the only two forms of encryption that are considered safe and secure."

If your router offers WEP, WPA, or a "mixed" mode that includes them, those options exist for compatibility with old hardware, not because they work. A mixed mode drags the whole network down to the weakest option any client asks for.

The practical friction: plenty of smart home devices are old enough that they do not speak WPA3. This is another argument for splitting the network — main network on WPA3, guest network on WPA2 AES for the devices that need it.

4. Turn off UPnP once everything is connected

Universal Plug and Play lets a device on your network ask the router to open a port to the internet on its behalf, without anybody approving it. It exists because it makes setup painless.

CISA's assessment is that "threat actors can use UPnP to spread malware to devices in your network and control them remotely", and the recommendation is to disable it after the initial connection of your smart devices.

That sequencing is the useful part: leave it on while you are setting things up, then turn it off. Most devices only need it during pairing, and the ones that genuinely need a permanent open port will tell you — at which point you open that one port deliberately rather than leaving the door on the latch for everything.

5. Turn off remote management

Remote management exposes the router's admin page to the internet, so you can change settings from outside the house. Almost nobody needs this, and CISA notes that disabling it "can prevent threat actors from making changes to your router without connecting to your network first."

It is frequently on by default, sometimes under a name like "remote access", "cloud management" or "web access from WAN".

6. Firmware, and why automatic is worth having

CISA: "Routine updates will protect you against known vulnerabilities. Some routers even allow you to set up automatic updates." The FTC adds the part people miss — device firmware often has to be fetched from the manufacturer's own website rather than arriving on its own.

The honest version of this advice: manual firmware updating is a task nobody performs on schedule. If your router can update itself, turn that on and stop thinking about it. For the devices themselves, the update situation is a purchase criterion — a manufacturer that has stopped shipping firmware has stopped supporting the device, whatever the box says.

What this does not protect you from

Network hygiene defends against things reaching your devices. It does nothing about the two risks people actually meet:

The manufacturer's cloud. Most smart devices send data to a vendor's servers by design. Isolating the device on a guest network does not change what it sends or who holds it. That is a question about which company you are willing to hand a camera feed to, and it is answered at the shop, not in the router.

Account access. If someone gets into the account the devices are attached to, the network topology is irrelevant — they are using the same app you do. Two-factor authentication on that account is worth more than any router setting on this page, and it is the step most often skipped.

There is also the mundane case that has nothing to do with attackers: someone in the house reaching something they should not. That is access control rather than security, and it is solved device by device — the way a Samsung TV's browser is locked down, for instance, has nothing to do with your Wi-Fi.

The order to do this in

1. Set up the guest network and move the devices that can live there.
2. Change the router admin login.
3. Check encryption: WPA3 Personal, or WPA2 AES.
4. Disable remote management.
5. Disable UPnP, after the devices are paired.
6. Turn on automatic firmware updates if offered.
7. Turn on two-factor authentication on the accounts your devices use.

Steps 1 to 6 happen on the router. If yours cannot do guest isolation or WPA3, our guide to what to look for in a router for a smart home covers what to check before replacing it.

Sources

All quoted recommendations are from CISA's Project Upskill, Module 5: Securing Your Home Wi-Fi. The point about firmware often requiring a visit to the manufacturer's website is from the FTC's Securing Your Internet-Connected Devices at Home. The description of how client isolation works, and the caveat about devices that need local network access, are general network behaviour rather than statements from either agency.

If you'd like to read other articles similar to How to Secure a Smart Home: The Settings That Matter You can visit the category Smart Security.