Router and Wi-Fi Security Checklist for a Small Office
Practice4 minInnovialabs editorial team
In short
Change the router admin password, update firmware, use WPA3 or WPA2-AES, turn off WPS, UPnP and remote admin, put guests on a separate network and regularly review the list of connected devices.
The short answer
The router is the front door of the office network. Most problems with it come not from sophisticated attacks but from factory settings: a default password, old firmware and "convenience" features left on. Basic protection fits into about ten items and takes roughly an hour.
The checklist
| Item | What to do |
|---|---|
| Admin password | Change to a long unique one, store it in a password manager |
| Firmware | Update and enable auto-update if available |
| Wi-Fi encryption | WPA3 or WPA2-AES, no WEP or TKIP |
| WPS | Turn off |
| UPnP | Turn off unless you have a specific need |
| Remote admin | Disable access to the admin panel from the internet |
| Guest network | Separate SSID isolated from the work network |
| Connected devices | Review the list and remove unknown ones |
Admin password and panel access
The Wi-Fi password and the router's admin panel password are different things. The second one often stays at the factory default, which is frequently printed on a sticker or easy to find online by model.
- Set a long unique password and, if possible, change the default
adminusername. - Block admin access from the guest Wi-Fi and, if the router allows it, permit management only from specific devices or over a cable.
- Use HTTPS for the admin panel if it is supported.
Firmware
Vendors fix vulnerabilities through updates. If a router has not received firmware for a long time, that is a signal to replace it.
- Check the version in the panel and on the vendor's website.
- Turn on automatic updates if available.
- Consumer models that are out of support do not belong in an office.
WPA2 or WPA3
- WPA3-Personal — the current standard, better protection against password guessing.
- WPA2-Personal with AES — acceptable if some devices do not support WPA3.
- WPA2/WPA3 transition mode — a compromise for a mixed device fleet.
- WEP, WPA and TKIP — obsolete, switch them off.
Make the Wi-Fi password long: a phrase of several words is stronger than a short string of symbols. Change it when an employee who knew it leaves.
If the office has more than a few people, consider WPA2/WPA3-Enterprise with individual accounts: when someone leaves, you disable one login instead of changing a shared password.
WPS, UPnP and remote admin
- WPS lets devices join with a button or PIN. The PIN mode has a history of brute-force weaknesses. Turn WPS off completely.
- UPnP lets devices inside the network open ports to the outside on their own. Handy for game consoles, risky in an office: an infected device can expose itself. Turn it off and forward ports manually only when truly needed.
- Remote management (WAN access) exposes the router's panel to the internet. If you need remote access to the network, use a VPN rather than an open panel.
Network segmentation
Split the network into at least two parts:
- work — staff computers, NAS, printers;
- guest — visitors and personal phones, with no access to work devices.
Where possible, also move CCTV cameras and other "smart" devices into a separate network or VLAN.
Checking connected devices
The router panel has a client list (DHCP clients or "connected devices"). Review it once a month:
- rename known devices so new ones stand out;
- block an unknown device and change the Wi-Fi password;
- reserve IP addresses for important devices — it makes troubleshooting easier.
Common mistakes
- Changing only the Wi-Fi password and forgetting the admin password.
- Leaving WPS on because "nobody uses it".
- Putting guests on the same network as the NAS with documents.
- Opening the router's admin port to the internet for remote setup.
- Never checking whether updates are still released for the model.