Contact GitHub

Home & Travel Security

Lock down your home router, isolate guests and smart-home devices, and stay safe on public Wi-Fi and while traveling.

Overview

The rest of this manual is about how wireless networks break. This page turns that around: it is the practical, plain-language guide to keeping your own Wi-Fi safe, at home and on the road. None of it requires special tools, and every recommendation here tracks the published guidance of the FTC, CISA, the NSA, the FCC, and the Wi-Fi Alliance, cited at the end.

Lock down your home router

Most home networks are only as strong as a few router settings most people never open. Five changes do almost all of the work:

  • Change the router's admin login. Your router has two separate logins: the Wi-Fi passphrase devices use to join, and an administrator account that controls the router itself. They are not the same, and the admin password is the one attackers look up by model number. Change it first; if someone reaches the admin side, they can undo everything else.
  • Use WPA3 (or WPA2-AES) with a long passphrase. Set the encryption to WPA3-Personal, or WPA2-Personal (AES/CCMP) if WPA3 is not offered. Never use WEP or WPA/TKIP; if those are the only options, the router is old enough to replace. Choose a long passphrase, a short sentence is better than a short complex string.
  • Turn off WPS. The eight-digit WPS PIN is brute-forceable in hours regardless of how strong your passphrase is, and disabling it is the only real fix. See WPS for why.
  • Keep firmware updated, and retire end-of-life routers. Turn on automatic updates if the router offers them; a router the manufacturer no longer patches is a standing risk.
  • Disable remote administration and UPnP unless you specifically need them. Both widen the attack surface from the internet side for convenience you probably are not using.

Separate networks for guests and smart-home devices

Almost every modern router can broadcast a second guest network, and it is the single most useful thing most people never turn on. Put visitors on it, and put your IoT and smart-home devices (cameras, plugs, TVs, speakers) on it too. Those devices are the least-patched, least-trustworthy things on your network; keeping them on a separate, isolated network means a compromised smart bulb cannot reach your laptop, your files, or the router's settings.

INTERNET ROUTER WPA3 / WPA2-AES MAIN NETWORK laptops, phones (trusted) reach each other + the internet your private devices live here GUEST / IoT NETWORK visitors + smart-home devices internet only, isolated cannot reach your main network isolation: a hacked smart device stays trapped on the right
A guest/IoT network keeps untrusted and rarely-patched devices walled off from the laptops and phones that hold your data. Most home routers offer this with one toggle.

While you are in the settings: rename the network (SSID) to something that is not your name, address, or unit number, and do not bother hiding it, a hidden network is trivially discovered and protects nothing. Real security comes from the encryption and the passphrase, not from a secret name. For each smart device, change its default password, turn on automatic updates, and enable two-factor authentication if it is offered.

Public Wi-Fi: assume someone is listening

Open Wi-Fi at a coffee shop, hotel, or airport is convenient and, by default, unencrypted: anyone else on the same network can potentially see unprotected traffic. Worse, an attacker can stand up an evil twin, a rogue access point with the same name as the real one, and a captive-portal phishing page that copies the normal sign-in screen to harvest what you type. The FBI specifically warns travelers about evil twins on hotel and airport networks.

YOUR PHONE at the airport "Airport WiFi" (real) the legitimate network "Airport WiFi" (attacker) same name, evil twin sees your traffic, phishes logins your phone cannot tell them apart Safer: use your phone's own cellular hotspot for anything sensitive.
An evil twin advertises the same network name as the real one, so the device cannot distinguish them. The reliable defense is to avoid the choice entirely: use your own cellular connection for sensitive activity.

Safer habits on the road

  • Prefer your own cellular connection. For banking, email, or work, your phone's mobile data or personal hotspot is far safer than any public network. The FCC makes this point directly.
  • If you must use public Wi-Fi: stick to sites showing https (the lock), avoid logging into anything sensitive, log out when done, and consider a reputable VPN, which encrypts everything between your device and the internet. HTTPS has made public Wi-Fi much safer than it used to be, but it protects the contents of a page, not which sites you visit, and it does not save you from a fake captive portal.
  • Verify the network name with staff. Evil twins win by looking right. Ask for the exact name before connecting, and do not connect to lookalikes.
  • Tame your device's radios. Turn off auto-join for open networks, and "forget" a public network after you leave so your phone does not silently rejoin a same-named twin later. Turn Wi-Fi and Bluetooth off when you are not using them, or use airplane mode, and leave MAC-address randomization on.
  • Keep the basics current. Patch your operating system and browser, and use a screen lock and device encryption so a lost or stolen device keeps its secrets.

You are also being counted

Even when you never connect, a phone with its radios on constantly announces itself, and those signals can be used to track movement through a venue. The device-off and minimize-radios advice above is the simplest mitigation; for the full picture of how Wi-Fi, Bluetooth, and cellular signals are used to locate people, and what genuinely blocks it (down to Faraday pouches), see Wireless and Health.

Sources

(c) 2026 VTEM Labs, Inc. All rights reserved. | vtemlabs.com