← Back to blog

2026-10-22 · Security Basics

Lock Down Your Office Wi-Fi and Router in 20 Minutes

A 20-minute checklist for a small office with no IT staff: change the router admin password, turn on updates, use WPA3 or WPA2, and keep visitors and smart devices off the work Wi-Fi.

Give visitors their own Wi-Fi name, and move the router off its factory settings. That keeps guests and smart devices off the computers that hold your work.

This list is for an owner at a business of about 5 to 50 people with no IT staff. Plan on one sitting of about 20 minutes. You need the router, a work computer in the office, and the password for the router settings page.

Do the steps from that office computer. The NSA (National Security Agency) says to change router settings from the internal network.

Someone nearby can use a wireless network that was never locked down. CISA (the Cybersecurity and Infrastructure Security Agency), in Securing Wireless Networks, says the risks are the same for a home or a business. On an unsecured network, anyone with a wireless computer in range can use your connection. CISA gives a typical indoor range of 150 to 300 feet. Those users may be able to monitor and capture web traffic, or steal personal files.

How do I lock down office Wi-Fi with no IT staff? From a computer in the office, change the router admin password, install the firmware update and turn on automatic updates if the router offers them, use WPA3 or WPA2, put visitors and smart devices on their own Wi-Fi, turn off remote management and UPnP, rename the default network name, and check who is connected.

Menu names differ by brand. CISA says your internet provider and the router maker may post the steps for your model. Use their page when a label on your screen does not match this list.

The NSA sheet cited below, Best Practices for Securing Your Home Network, is written for a home network, including people who work from home. The router settings are the same ones on a small-office router.

The 20-minute checklist

Sign in to the router from a work computer that is already on the office Wi-Fi. The address is often on a sticker on the router. If the only password you have is the one printed there, that is the default. Change it in step 1.

If you write it down, keep it somewhere locked, not taped to the router.

1. Change the router admin password

This is the password for the settings page. Phones use a different password to join Wi-Fi. You will set that one in step 3.

  • Change the default admin username and password. The FTC says that after you set up a router, change the default username and password. CISA says most network devices, including wireless access points, ship with default administrator passwords to make setup easy. Those passwords "are easily available to obtain online, and so provide only marginal protection."
  • Make it long, and use it for this login only. The FTC says a strong password is at least 12 characters, and that longer is stronger. A passphrase is a series of random words separated by spaces. The FTC also says never to reuse passwords.
  • Plan to change it again later. CISA says: "Use and periodic changing of complex passwords is your first line of defense in protecting your device."
  • Log out of the administrator account when the list is finished. The FTC says to log out after the router is set up.

2. Update the firmware, and turn on automatic updates

Firmware is the router's own software.

  • Install the update the router offers. The NSA says to update routing devices to the latest patches, "preferably through automatic updates." Without that patching, the NSA says the router is more likely to be compromised, and other devices on the network can be compromised with it.
  • Turn automatic updates on if the router has that switch. The NSA prefers automatic updates for routing devices.
  • If there is no automatic switch, pick a monthly check. The FTC says to keep the router's software up to date, to sign up for email alerts if the maker offers them, or to set a schedule to visit the router's website. CISA says to check the manufacturer's website regularly for firmware updates and patches.
  • Stop if the page says this model is no longer supported. The NSA says to replace routing devices when they reach end-of-life, so they can still receive patches. That is a reason to call for help, covered below.

3. Use WPA3, or WPA2 if a work device cannot join WPA3

This setting scrambles what the Wi-Fi carries. The FTC says to make sure the router offers WPA2 or WPA3 and that it is turned on. Encryption protects information sent over the network so outsiders can't read it. On the same page, the FTC says WPA2 and WPA3 are the only encryption standards that will protect information sent over a wireless network.

  • Choose WPA3 when every work device can join it. CISA says WPA3 is currently the strongest encryption. It says WPA and WPA2 are still available, and that it is advisable to use equipment that supports WPA3, "as using the other protocols could leave your network open to exploitation."
  • If an older work device cannot connect, choose WPA2/3. The NSA says that if you have devices that do not support WPA3, you can select WPA2/3. Newer devices then use WPA3. Older devices connect with WPA2. The FTC says to use at least WPA2.
  • Set a Wi-Fi passphrase of at least 20 characters. The NSA says that when you set WPA3 or WPA2/3, use a strong passphrase with a minimum length of twenty characters.
  • Use a different password than the admin password. The FTC says to create a strong password so staff can connect business-owned, operated, or managed devices. It also says never to reuse a password.

If the screen has no WPA2 and no WPA3, stop. The FTC says the router should offer one of those. Use the help section.

4. Separate guest Wi-Fi for visitors and smart devices

Work computers stay on the main Wi-Fi.

  • Turn on a guest network, with its own password. CISA says the guest account gives visitors access on a separate wireless channel with a separate password, while keeping your main password private. The FTC says that if guests, employee personal devices, or the public need Wi-Fi, set up a separate public network in the admin page. Guest and customer Wi-Fi at the office should be separate from the business network, and not connected to it.
  • Put personal phones on the guest network. The FTC says to limit the primary business network to business-owned, operated, or managed devices.
  • Give smart devices their own network when the router can make a third name. The NSA says that, at a minimum, wireless should be split into primary Wi-Fi, guest Wi-Fi, and an IoT network. IoT means internet-connected equipment that is not a work computer, such as a camera or a speaker. The NSA says this split keeps less secure devices from communicating directly with more secure ones.
  • If the router offers only one extra name, put visitors and internet-only devices on that guest name. That keeps them off the work Wi-Fi, which is the FTC's rule. A third name, for smart devices alone, is the split the NSA describes when the router can make it. If yours cannot, use the help section.

5. Turn off remote management and UPnP

  • Turn off remote management. The FTC says to turn it off. Remote management lets someone open the settings from the internet. The NSA says to disable remote administration, and to make configuration changes only from the internal network.
  • Turn off UPnP. The NSA says to disable Universal Plug-n-Play (UPnP). Together with turning off remote administration, the NSA says these steps help close holes that may enable an attacker to compromise the network.
  • Log out of the admin account once those switches are off.

These three guides do not discuss Wi-Fi Protected Setup (WPS). That is the button or PIN some routers offer for joining Wi-Fi. If WPS is on the same screen and you are not sure what the switch does, leave it and use the help section.

6. Rename the default network name

The network name is the SSID. It is the name phones list when they look for Wi-Fi.

  • Change the default name to something unique. The FTC says to change the default name of the router. CISA says that leaving the manufacturer's default could allow someone to identify the type of router and possibly exploit known vulnerabilities.
  • Leave the new name visible. The NSA says to change the default SSID to something unique, and not to hide it. Hiding the name "adds no additional security to the wireless network and may cause compatibility issues." CISA also describes hiding the name so a network is harder to find. Follow the NSA on this point: rename it, and leave it visible.
  • Give the guest network its own name so staff can tell the two apart.

7. Check the devices that are connected

  • Open the list of devices on the work Wi-Fi. The FTC says to limit that network to business-owned, operated, or managed devices. CISA says to allow only authorized users on the network.
  • Keep a device only when you recognize it as a work computer, phone, or printer. Remove a name you do not know. Visitors and smart devices belong on the separate Wi-Fi from step 4.
  • Write the date and how many devices you kept. A dated note is the record. You are not building a full inventory today.

When to call for help

Ask the person who installed the router, or your internet provider, when any of these are true:

  • You cannot sign in, or you already changed the admin password and no longer have it.
  • The security list does not include WPA2 or WPA3.
  • The update page says the router is at end of life, or it offers no updates. The NSA says to replace a routing device when support ends, so it can still be patched.
  • The router cannot make a separate network for guests. The NSA says to use the router's features for a separate guest network. If the box from the internet provider will not allow it, the NSA says to consider a router you own, connected to that box, so you control the wireless settings.
  • A device you do not recognize is still on the work Wi-Fi after you remove it.
  • WPS is on the screen and you are not sure whether to change it.

An owner can finish the list when the router offers these settings. Call when it does not.

Sources

Educational content only — not legal, insurance, or compliance advice.

Need help implementing this in Houston?

Houston Secure IT can walk through MFA, backups, and a practical baseline with you.

Request a Houston consult

713-364-8666 — Houston Secure IT / shop line