The typical home network has accumulated a decade of devices, several of which nobody remembers connecting, at least one running firmware from a manufacturer that stopped issuing updates years ago. It works, so nobody looks at it. That is reasonable right up until a compromised device becomes a foothold into everything else on the same network.
An hour of deliberate review finds nearly everything worth finding.
What changed in 2026
- Smart device populations grew. More connected things per household meant more devices with weak update stories sharing a network with computers holding real data.
- Router vendors improved defaults. Automatic firmware updates and unique per-device passwords became more common out of the box, closing the two worst historical gaps.
- Private network tunnels went mainstream. Consumer-friendly mesh networking made remote access without port forwarding genuinely easy.
- Network-attached storage remained a prime target. Internet-exposed storage devices continued to be scanned and exploited at scale.
The audit, in order
| Step |
What to look for |
Why first |
| 1. List connected devices |
Anything unrecognized |
You cannot secure an unknown inventory |
| 2. Check remote administration |
Should be off |
Direct path to router control |
| 3. Check port forwarding and UPnP |
Should be empty and off |
Exposes internal services publicly |
| 4. Verify firmware is current |
Auto-update on if available |
Unpatched router is the whole network |
| 5. Change default credentials |
Router and every device |
Still the most exploited weakness |
| 6. Review Wi-Fi security |
Modern encryption, strong passphrase |
Legacy modes are broken |
| 7. Separate smart devices |
Guest or IoT network |
Limits lateral movement |
| 8. Identify unsupported devices |
No updates in years |
These are the real risk |
Remote administration and port forwarding come early because they are the settings that turn a local problem into an internet-facing one. Universal Plug and Play deserves specific attention: it lets devices open ports on your router without asking you, which is convenient and means your exposure is decided by the least trustworthy gadget you own. Turn it off and forward nothing.
Isolating the devices you cannot fix
Every household has devices that will never receive another update — a camera from a defunct brand, a smart plug from a vendor that moved on, a television whose manufacturer stopped caring after two years. You are not going to replace all of them, and they should not be on the same network as your laptop.
Most modern routers support a guest network, and putting smart devices on it costs nothing. Guest networks typically isolate clients from the main network, so a compromised device can reach the internet and not your file shares, printers, or computers. If your router supports proper VLAN separation, better still, but a guest network captures most of the benefit for no effort.
Check for the thing most people miss: a network-attached storage device or home server reachable from the internet. These are actively scanned for and are the single most damaging item to get wrong, because they hold everything. Use a private network tunnel for remote access instead of exposing them — the reasoning is in NAS buying guide.
Finally, consider a DNS service with filtering at the router level. It blocks known-malicious domains for every device on the network, including the ones you cannot install anything on.
Common mistakes
- Leaving UPnP enabled. Your devices decide your exposure.
- Port forwarding for convenience. A tunnel is easier and safer.
- Ignoring unsupported devices. They will not be patched; isolate them.
- Never updating router firmware. The router protects everything else.
- Reusing the Wi-Fi password everywhere. Guest network exists for this.
- Auditing once. New devices arrive constantly. Repeat annually.
FAQ
How do I see everything connected?
The router's admin interface lists connected clients. Expect unrecognized names — many devices report unhelpful identifiers, so cross-reference by manufacturer prefix.
Is a guest network really isolated?
Usually yes, though implementations vary. Check your router's documentation for whether client isolation is enforced between guest and main networks.
Do I need a separate firewall?
For most homes, no. The router's built-in firewall plus not exposing services covers the realistic threat model.
What about a VPN?
A commercial VPN protects traffic on untrusted networks and does nothing for devices inside your home. A private network tunnel for remote access is the different and more useful tool here.
Where to go next
For storage security specifically, read NAS buying guide. For account security, password manager migration and passkey migration guide.