Home Wi-Fi security is usually one decision: the password. The other settings — the ones routers hide two menus deep — matter just as much. Here is the short list of what to change, and why each one earns its place.

WPA3, or at least WPA2 with a long key

# on the router, under wireless security:
# mode: WPA3-SAE (or WPA2/WPA3 transition if older devices need it)
# passphrase: 16+ random characters, not a word

WPA2 is not broken in the way headlines suggest, but WPA3 kills the offline password guessing that WPA2 handshakes allow. If a device forces WPA2, give it its own SSID on WPA2 rather than downgrading the whole network.

Guest network, always on

IoT devices are the weak link in most homes: a smart plug that phones home should not sit on the same network as your laptop. A guest SSID with client isolation gives visitors (and your toaster) internet without a path to your machines.

# enable: guest network, client isolation, no admin access from guest

The boring settings that matter

Turn off WPS (it is a PIN brute-force shortcut). Update the router firmware — the web UI on old firmware is a bigger risk than the Wi-Fi itself. And check whether the admin panel is reachable from the LAN: it should not be, or only from one wired port.

What Wi-Fi encryption does not do

WPA2/3 encrypts the air between you and the router. Past the router, your traffic is plaintext to your ISP unless you use HTTPS — and your DNS is still visible (see the DNS post). Wi-Fi security is the first hop, not the whole journey.

Home networks get broken through the ignored settings far more often than through the password. Ten minutes in the router admin repays itself.