Your broadband router is the busiest door in your house. Phones, laptops, tablets, smart speakers and games consoles all walk through it every day, usually without you giving it a second thought. The good news is that you do not need to be a network engineer to keep it reasonably secure. A handful of small, sensible changes — most of them taking less than ten minutes — will keep out the overwhelming majority of unwanted visitors.

Start With the Router's Own Password

There are two passwords on your router, and most people only ever think about one of them. The one you type to get online is the wireless key. The other, far more important one, guards the router's settings page — and it is often still set to something like "admin" or "password".

Those defaults are printed on the sticker on the back of the router, and they are listed in manuals and online guides. Anyone within range of your wireless signal who knows the make and model can look them up in seconds.

• Open a browser on a device connected to your home network and type the router's address into the address bar. The usual ones are 192.168.0.1 and 192.168.1.1, and the correct address is normally on that same sticker.
• Log in with the default details, then find the option labelled administrator password, router password or account settings and change it.
• Use something long and unique. You will rarely need it, so writing it down and keeping it somewhere safe at home is perfectly sensible.
• While you are in there, look for anything called remote management, remote access or WAN administration and switch it off. You should only ever need to change settings from inside your own home.

Choose Proper Wireless Encryption

Encryption is what stops someone nearby reading the traffic flowing between your laptop and your router. Older standards such as WEP and the original WPA can be cracked in minutes with free tools, so they should never be used.

In the wireless security settings, choose WPA2 or, if your router offers it, WPA3. If you see an option for WPA2/WPA3 mixed mode, that is a good compromise for older gadgets that cannot manage WPA3 on their own.

• Set a passphrase of at least twelve characters. Three unconnected words strung together is a memorable and genuinely strong choice.
• Turn off WPS, the push-button pairing feature. It is convenient, but it is also one of the easiest ways into a network.
• Check both the 2.4GHz and 5GHz bands. Some routers let you set them separately, and it is easy to secure one and forget the other.
• Change the wireless network name if you like, but avoid using your flat number, surname or house name. There is no need to advertise whose network it is.

If you have changed the wireless password, remember that every device in the house will need the new one. Do it when you have a spare half hour, and start with the device you are using to manage the router.

Review Who Is Actually Connected

Every router keeps a list of connected devices, sometimes called attached devices, client list or DHCP clients. It is one of the most useful pages you will ever look at, and almost nobody does. Have a look once a month or so and read through the names.

• You will usually recognise most of them: phones, laptops, the television, the thermostat, a couple of smart plugs.
• If something unfamiliar appears, do not panic. It may be a device named with a random string of letters, or a neighbour's phone that briefly latched on.
• Rename the devices you recognise so future checks are quicker. Most routers let you do this, and it turns a confusing list into a clear one.
• If you genuinely cannot account for a device, change the wireless password. Everything will drop off, and you can reconnect your own kit one item at a time.

Set Up a Guest Network

Most routers supplied in the last few years can broadcast a second, separate wireless network for visitors. Use it, and use it for more than guests. Cheap smart plugs, robot vacuums and budget security cameras often receive few security updates, so keeping them off your main network limits the damage if one is ever compromised.

Give the guest network a different password, and check the settings for an option such as client isolation or access to local network. With that switched on, guest devices can reach the internet but cannot see your computers, printers or network storage. Visitors get online, your own files stay private, and you never have to hand out your main password again.

Keep the Router Updated and Tidy

Routers run software, and that software occasionally has flaws that get fixed by the manufacturer. Check the administration pages for a firmware update option and, if there is an automatic update setting, turn it on. If your router is more than five or six years old and no longer receives updates, it is worth asking your internet provider whether a newer one is available.

• Restart the router every few weeks. It clears glitches and applies updates that were waiting.
• Leave the built-in firewall switched on, and only set up port forwarding if a specific piece of software genuinely requires it.
• Remove any port forwarding rules you no longer use. Old rules for a games console sold years ago are a needless open door.
• If you move house or change provider, factory reset the router before passing it on.

None of this is complicated, and none of it needs to be done all at once. Change the administrator password today, check the encryption tomorrow, and glance at the connected devices list next weekend. Ten minutes every few months is a very small price for a quiet, private and reliable home network.