The average Australian household now has 22 internet-connected devices — smartphones, laptops, smart TVs, streaming sticks, smart speakers, security cameras, thermostats, and a growing collection of smart appliances. Each of these devices is a potential entry point for attackers. Most of them ship with default passwords, outdated firmware, and minimal security configurations.
The good news is that securing your home network doesn't require technical expertise. It requires understanding a small number of high-impact actions and actually doing them. This guide covers everything you need to know, in order of importance.
Step 1: Secure Your Router — The Most Important Thing You Can Do
Your router is the gateway between your home network and the internet. If an attacker compromises your router, they can intercept all your network traffic, redirect you to malicious websites, and access every device on your network. Securing it is the single most impactful thing you can do for your home network security.
Change the default admin password. Every router ships with a default admin password — often something like "admin" or "password" — that is publicly documented and trivially guessable. Log into your router's admin interface (usually accessible at 192.168.0.1 or 192.168.1.1 in your browser) and change the admin password to something long and unique. Use a password manager to generate and store it.
Update the firmware. Router manufacturers release firmware updates that fix security vulnerabilities, but most routers don't update automatically. Log into your router's admin interface and check for firmware updates. Enable automatic updates if the option is available. If your router is more than five years old and no longer receiving updates, consider replacing it — an unpatched router is a significant security liability.
Change your Wi-Fi network name (SSID). The default network name often includes the router model, which tells attackers exactly what vulnerabilities to look for. Change it to something that doesn't identify the router model or your address.
Use WPA3 encryption. If your router supports WPA3, enable it. WPA3 is significantly more secure than WPA2, particularly against offline password attacks. If your router only supports WPA2, make sure you're using WPA2-AES (not WPA2-TKIP, which is weaker).
Step 2: Create a Separate Network for IoT Devices
Smart home devices — thermostats, cameras, smart speakers, connected appliances — are notoriously poorly secured. Many run outdated software, have known vulnerabilities, and are difficult or impossible to update. Putting them on the same network as your computers and phones means that a compromised smart TV can potentially access your laptop.
The solution is network segmentation: creating a separate Wi-Fi network for IoT devices that is isolated from your main network. Most modern routers support a "guest network" feature that can be used for this purpose. Put all your smart home devices on the guest network, and keep your computers, phones, and tablets on the main network. Devices on the guest network can access the internet but cannot communicate with devices on the main network.
This single step dramatically limits the damage that a compromised IoT device can do. Even if your smart TV is hacked, the attacker can't use it to access your laptop or intercept your banking traffic.
Step 3: Use Strong, Unique Passwords and a Password Manager
Password reuse is one of the most common causes of account compromise. When a service is breached and passwords are leaked — which happens constantly — attackers use those credentials to try to log into other services. If you use the same password for your email and your bank, a breach at a low-security website can lead to your bank account being compromised.
The solution is to use a unique, randomly generated password for every account. This is only practical with a password manager — a tool that generates, stores, and fills in passwords automatically. Reputable password managers include 1Password, Bitwarden (open source and free), and Dashlane. The small monthly cost of a premium password manager is trivial compared to the cost of a compromised account.
Enable two-factor authentication (2FA) on every account that supports it, particularly email, banking, and social media. Use an authenticator app (Google Authenticator, Authy, or the built-in authenticator in your password manager) rather than SMS-based 2FA where possible — SMS 2FA is vulnerable to SIM-swapping attacks.
Step 4: Keep Everything Updated
The majority of successful cyberattacks exploit known vulnerabilities — security flaws that have already been patched by the software vendor. Keeping your software updated is one of the most effective defences against these attacks.
Enable automatic updates for your operating system, browser, and applications. On Windows, ensure Windows Update is enabled and set to install updates automatically. On macOS, enable automatic updates in System Preferences → Software Update. On iOS and Android, enable automatic app updates in the App Store or Play Store settings.
Pay particular attention to your browser — it's the application most exposed to untrusted content from the internet. Chrome, Firefox, and Safari all support automatic updates; make sure this feature is enabled.
Step 5: Use a VPN on Public Wi-Fi
Public Wi-Fi networks — in cafes, airports, hotels, and libraries — are inherently untrusted. An attacker on the same network can potentially intercept unencrypted traffic, perform man-in-the-middle attacks, and capture credentials. While HTTPS has significantly reduced the risk of traffic interception, public Wi-Fi remains a higher-risk environment than your home network.
A VPN (Virtual Private Network) encrypts all traffic between your device and the VPN server, preventing interception on the local network. Reputable VPN services include Mullvad (privacy-focused, accepts cash payment), ProtonVPN (open source, based in Switzerland), and ExpressVPN. Avoid free VPN services — they typically monetise by logging and selling your traffic data, which defeats the purpose.
Step 6: Be Sceptical of Phishing
Technical security measures are only as effective as the humans using them. Phishing — the use of deceptive emails, messages, or websites to trick users into revealing credentials or installing malware — remains the most common initial attack vector for both consumer and enterprise breaches.
The key habits: be suspicious of any unsolicited communication asking you to click a link or provide credentials, verify the sender's email address carefully (not just the display name), hover over links before clicking to see the actual destination URL, and when in doubt, navigate directly to the website rather than clicking a link in an email.
Modern email clients and browsers include phishing detection, but these tools are not perfect. Human scepticism remains the most reliable defence.
Advanced Steps for the Security-Conscious
If you want to go further, consider: enabling DNS-over-HTTPS in your browser or router to prevent DNS-based surveillance and manipulation; using a hardware security key (YubiKey or similar) for 2FA on your most sensitive accounts; reviewing the permissions granted to apps on your phone and revoking any that seem excessive; and periodically checking Have I Been Pwned (haveibeenpwned.com) to see if your email address has appeared in known data breaches.
Home network security is not a one-time task — it's an ongoing practice. The threat landscape evolves, new vulnerabilities are discovered, and new devices are added to your network. Building the habit of periodic security reviews — updating firmware, reviewing connected devices, checking for breached credentials — is more valuable than any single security measure.