Home and Small-Business Network Privacy

Everything you do online passes through one box: the router or "gateway" your internet provider supplied. Most people never open its settings. That is a pity, because a few changes there make you harder to track, harder to break into and harder to identify. This guide is for homes and small offices. Larger organizations have IT staff for this.

A note on menus. Routers and provider gateways all look different, and they change with every firmware update. So this guide names settings, not screens. If you cannot find one, search the router's own pages for the name, or check the manufacturer's manual. Where a setting is locked by your provider, see the bring-your-own-router section further down.

Start here: the five that matter most

• Change the default administrator login. The password on the router's settings page is not the Wi-Fi password. If it is still the factory default, or printed on a sticker, anyone who joins your Wi-Fi can take over the router. Use a long, unique password kept in your password manager.
• Use strong Wi-Fi encryption and a long passphrase. Choose WPA3 if all your devices support it, or WPA2 with AES. Never WEP, plain WPA, TKIP or "open". Use a passphrase of four or five random words or 16 or more characters.
• Turn off WPS. The push-button and PIN setup feature has well-known weaknesses. It is convenient once and risky forever.
• Keep the firmware up to date. Turn on automatic updates if the router offers them. If your router no longer gets updates from its maker, replace it: an unpatched router is the most common way home networks are taken over.
• Turn off remote administration. Reaching the router's settings from the internet should be off unless you deliberately need it.

↑ Back to the section list

Wi-Fi settings for privacy

• Rename the network, and keep personal details out of the name. Default names often reveal the router's make and model, which tells an attacker which flaws to try. Do not use your surname or your address.
• Add _optout_nomap to the end of the network name (for example HomeNet_optout_nomap). Companies build public maps of Wi-Fi networks to work out where a phone is. Two suffixes are widely used to leave your network out: _nomap is documented by Google, and Mozilla's location service and several open Wi-Fi databases honor it too; _optout is the one Microsoft has used. Put both on the end and you cover them all. Microsoft's own support pages now also point to a separate opt-out request for access points, so use that as well if you want to be thorough. These are opt-out conventions, not laws: not every company respects them. You will need to reconnect your devices to the renamed network.
• Do not rely on hiding the network name. A "hidden" network is easy to find and can make your devices announce its name everywhere they go. It is not a security measure.
• MAC address filtering is weak. Addresses can be seen and copied. It is fine as a nuisance, not as protection.
• Turn on a guest network for visitors, and put smart-home devices on it too. Guests then cannot reach your computers or files, and a cheap smart bulb with poor security cannot be used to reach your laptop. Make sure "client isolation" or "no access to the local network" is on for that network.
• If your router can schedule Wi-Fi, make a separate network for the kids that switches off after hours. Many routers let you set active times for each network name. Give the children's devices their own network with its own passphrase, and set it to go quiet at bedtime and on school nights. It also keeps their devices off the network your computers and files are on. Some things to know:
  • It is a nudge, not a lock. A child can still use mobile data, a neighbour's Wi-Fi or a friend's hotspot, and some can find the passphrase. Talk with them about why, as well as setting the schedule.
  • Schedule the network, not the whole router, if anything on your network has to stay on all night, such as alarms, cameras, smart locks or a medical device. Keep those on a separate always-on network.
  • Time limits for individual devices can fail because modern phones use a different, random hardware address for each network. A separate network for the kids' devices avoids that problem.
  • Some routers pair the schedule with a family-filtering DNS service or built-in content filters. Turn on what fits your family, and remember filters are imperfect.
  • The same idea works in a small office: switch off the guest and staff Wi-Fi outside working hours, so nobody is quietly connecting to your network overnight.
• Use different passphrases for the main and guest networks, and change the main one if someone you no longer trust has had it.
• Look at your provider's public hotspot. Some providers broadcast a separate public Wi-Fi network from your gateway for their other customers. It is usually kept apart from your own, but you may prefer to switch it off. It is often an option in your account settings or on the gateway.

↑ Back to the section list

Router settings worth checking

• UPnP. This lets programs open holes in your firewall automatically. Turn it off unless a game or device truly needs it, and review any "port forwarding" or "virtual server" entries you no longer use.
• Features you do not use. USB file sharing, media servers, "cloud" access and vendor apps that manage the router remotely all add exposure. Some routers send usage data to their maker's servers. Read what an app collects before you sign in to one.
• DNS. Your provider's default DNS lets it log every site you visit by name. Where the router allows it, set a privacy-focused resolver, ideally with encrypted DNS. Our DNS leak check and the About DNS article explain how, and the Resources page lists options.
• The provider's own analytics and marketing. Your account settings may include options about using your network data for marketing or "Wi-Fi insights". Look for a privacy or marketing preferences section and opt out of what you do not want.
• Firewall and IPv6. Keep the router's firewall on. If IPv6 is enabled, make sure its firewall is on as well.
• Logs and parental controls. These can store, and sometimes upload, records of which sites each device visits. Turn on only what you need.

↑ Back to the section list

Your devices' names and sharing settings

Your computers, phones and TVs announce themselves on the network, and on any public Wi-Fi they join, by name. Those names are often more revealing than people realize.

• Rename devices that carry your name or make. Names like Pauls-Laptop or Jennifers-iPhone appear in router device lists, on shared networks and in scan results. A plain, neutral name, or a random one, gives away nothing. Look for "device name" or "rename this PC" in the settings of each device.
• Change the Windows workgroup name from WORKGROUP. Every home Windows PC that was never changed uses the same default, so it tells a scanner nothing about you but it also tells them the setup is untouched. Changing it is a small tidy-up, not real security: an attacker still finds your machine by address. It has one practical catch: computers that share files with each other in the old way need the same workgroup name, so change all of them to the same new name, or leave it if you rely on that.
• Set unfamiliar networks to "Public". When Windows asks whether a new network is Private or Public, choose Public unless it is your own home or office. That turns off the file, printer and device discovery that would otherwise announce your machine to strangers.
• Turn off file and printer sharing you do not use, and remove shared folders you forgot about. On a small-business network, share with named accounts only, never with "Everyone".
• Turn off the old sharing protocol SMBv1 if your Windows still has it. It is decades old and has been used by major worldwide malware attacks. Modern versions of Windows leave it off by default, and only very old equipment still needs it.
• Do the same on other systems. Macs and Linux computers have a computer name and sharing settings too, and phones share their own name with the networks they join.

↑ Back to the section list

NAT: what it does and does not do

NAT (network address translation) is how a home router lets many devices share one public internet address. Your phone, laptop and TV all appear to the internet as the router. A side effect is that unsolicited connections from outside have nowhere to go, because the router does not know which device they are for, unless you have set up port forwarding or UPnP has opened a door. That gives NAT a reputation as a firewall.

• It is a helpful accident, not a security feature. The real protection is the router's firewall. Keep both on, and keep port forwards to the minimum.
• It hides your inside layout. Outsiders see one address, not your list of devices. It does not hide what those devices do once they connect out to a website.
• Double NAT happens when two routers are chained, for example the provider's gateway and your own router. It breaks some games and remote access. Bridge mode, above, is the usual cure.
• Some providers add a second layer. With "carrier-grade NAT", many customers share one public address, so you cannot receive incoming connections at all, and port forwarding will not work. It can make you slightly harder to single out by address, and it makes remote access to your own network harder. Ask your provider if you need a dedicated address.
• IPv6 usually has no NAT. Each device may have its own public address, so the router's firewall is doing all the work. Make sure it is on.

↑ Back to the section list

Extenders, mesh systems and guest networks

A Wi-Fi extender repeats your signal into a far corner of the house, and a mesh system uses several units that work together. Both can quietly undo your guest network.

• Check that the guest network reaches the extender or mesh unit, and stays isolated. A simple extender often repeats only your main network. A guest who joins through the extender may land on the main network instead of the guest one. Some extenders and most mesh systems can broadcast a separate guest name with the same isolation; many cheap ones cannot.
• Give any extra guest name the same care as the main one: a strong passphrase, no personal details, and _optout_nomap on the end.
• A second router chained behind your main one does not isolate guests. It hides the guests' devices from the rest of your network, but they can still reach devices on the main side unless you block that. Use the guest-network feature, and check that "client isolation" or "no access to the local network" is on.
• The best build is wired. An access point connected to the router by an Ethernet cable is faster and more secure than a wireless extender, and supports separate guest names on better models. In an office, the same idea keeps staff and guest Wi-Fi apart.
• Extenders are small computers and need updates too. Change the default login, turn off WPS on them as well, and replace one the maker no longer updates.
• Test it. Join the guest network from a phone, then try to open the router's settings page or reach a computer on your main network. It should fail.

↑ Back to the section list

Bring your own router, and bridge mode

Many people's router is a rented or supplied "gateway" that combines a modem, a router and Wi-Fi in one box. It is convenient, and the provider often controls its settings and can manage it remotely. That is why some people use their own router instead.

What "bring your own router" gives you

• You decide what runs on it, when it updates and which features are on. Routers designed for security-minded users, or running open-source firmware such as OpenWrt, give far more control than most supplied boxes.
• Your Wi-Fi, firewall and DNS settings are yours, not whatever the gateway allows.
• You may stop paying a rental fee, depending on your provider.

What bridge mode is

If you keep the provider's gateway, you can often put it in bridge mode (some call it "IP passthrough"). The gateway then only passes the connection through, and your own router does the routing, Wi-Fi and firewall. If you skip that step, you end up with two routers in a row, "double NAT", which causes odd problems with games, calls and remote access. Turn off the gateway's Wi-Fi once your own router takes over, so you are not broadcasting two networks.

What to know before you try

• Not every provider allows it, and some gateways do not support a true bridge mode. Check with your provider, or look at your gateway's settings for the words bridge, passthrough or "modem mode". A "DMZ" setting that points at your router is a similar trick but not the same thing.
• Fiber and cable connections differ. Some fiber services use a separate box that you keep, and a router of your own plugs into that. Some cable services let you buy your own modem. Some phone or TV services still need the provider's gateway.
• Support gets thinner. The provider may not help with problems past its own equipment.
• It does not hide you from your provider. The provider still sees your connection and, without a VPN or encrypted DNS, the sites you visit. Your own router only gives you control of what is behind it. See VPN/TOR. Some people run a VPN on the router itself to cover every device.
• You become responsible for updates. Own equipment is only safer if you keep it patched.

↑ Back to the section list

Small-business basics

• Keep networks apart: staff, guests, and anything that takes payments should be on separate networks. Card terminals and cameras should not sit with the office computers.
• Know what is on your network. You cannot protect what you cannot list. Scan your own network now and then and investigate anything you do not recognize (tools below).
• Change the Wi-Fi passphrase and admin passwords when someone leaves. Remove their accounts, too.
• Turn on two-factor authentication everywhere, especially email and the router or cloud accounts that manage it. See our settings checklists.
• Back up, and keep one copy offline. The usual rule is three copies, on two kinds of storage, with one held elsewhere. Test that a restore works. A backup you have never tried is a hope.
• Patch everything: computers, phones, printers, the router. Retire equipment that no longer gets updates.
• Train people to spot phishing. Most break-ins begin with a message, not a hacker. See Scams.
• Have a plan for a bad day. Know who to call, and check your staff's and customers' addresses at breach check after an incident.
• Know your limits. A home or small-office setup has no round-the-clock monitoring. When you handle other people's sensitive data, or something goes wrong, hire a local IT professional.

↑ Back to the section list

Offering Wi-Fi to customers (restaurants, cafés, shops)

Free Wi-Fi is a nice touch, and it is also a way to put strangers on the same network as your till. Done well, it costs you very little risk. The rule is simple: customers get their own network, and nothing they can reach matters.

The essentials

• Keep customer Wi-Fi completely separate from your business systems. Payment terminals, the till, back-office computers, printers and cameras must not be reachable from the customer network. Card-payment rules (PCI DSS) expect payment equipment to be kept apart from anything customers can reach, so ask your payment provider what they require.
• Use a real guest network, not the staff one with a new name. Switch on "client isolation" so customers' devices cannot see each other or your equipment, and confirm the guest network cannot reach the router's settings page. Test it from a phone.
• The best arrangement is separate hardware. Ideally the payment systems run over their own wired connection or their own internet line, and customer Wi-Fi uses a different one. If you have to share one line, use a router or access point built for business that supports separate networks properly, not a home box with a second name added.
• Do not reuse a passphrase. Never give customers the staff or office Wi-Fi password, even once. Change staff passphrases when people leave.
• Cap the speed for guests so one customer streaming video cannot slow down your card machines and online orders.
• Turn it off when you are closed. Use the router's Wi-Fi schedule so the guest network is not running overnight.
• Keep the equipment updated, change the default administrator login, and turn off WPS, just as at home.

Pay-at-the-table devices?: give the customers their own router

Many restaurants use handheld card readers or tablets that staff carry to the table over Wi-Fi. Those devices have to talk to the register and the rest of the payment system, so they belong on the business network. The safest way to protect that network is to make sure customers are never on it. The ideal is a separate router, on separate hardware, just for customer Wi-Fi.

• Two sides, kept apart: the business network (register, handhelds, order tablets, back-office computers, printers) and the customer network. Customers get only the second one. Nothing on the customer side should be able to reach the business side.
• Separate hardware is better than a guest name on the same router. A router with a guest feature is far better than nothing, but a completely separate customer router, ideally on its own internet line, means a mistake or a flaw on the customer side cannot reach the payment system.
• Secure the business Wi-Fi the handhelds use: WPA2 or WPA3, a strong passphrase, WPS off, and a passphrase that never goes to customers. Change it when staff who knew it leave.
• Do not label it. A network called "POS" or "Payments" advertises what is on it. Use a neutral name, and add _optout_nomap to keep it off public location maps.
• Make sure the business Wi-Fi covers the whole dining room. If handhelds drop out at far tables, add a wired access point on the business network. Do not connect them to the customer Wi-Fi as a fix.
• Keep the routers physically out of reach. Behind the bar or in a locked office, not on a shelf where anyone can plug into them.
• Ask your payment provider what they require. Card-payment rules (PCI DSS) and many providers set specific rules for the network payment devices use and for keeping customers off it. Some devices use the mobile network instead of Wi-Fi. Follow their guidance over this general advice.
• Keep the devices themselves updated, locked away when not in use, and counted at the end of each shift.

Open or password?

• A password on the wall is better than no password. On a completely open network, what customers send can be read by anyone nearby. A shared passphrase on the menu or receipt encrypts each customer's connection. Change it now and then.
• WPA3 "Enhanced Open" encrypts an open network without a password, if your equipment and the customers' devices both support it. It is a good option to look for on newer equipment. Support varies, so test it.
• Beware of copycats. Anyone can set up a network with the same name as yours to trick your customers. Put the exact network name on a sign, and do not use names like "Free WiFi" that anyone can copy.

Customers' privacy and your own liability

• Collect as little as you can. Some Wi-Fi systems ask customers for an email address, name or phone number in exchange for access. Only ask for what you need, say what you will do with it, and follow the privacy law where you operate. A simple "accept the terms" page needs no personal data at all.
• Know what your equipment logs. Some systems record which sites customers visit. Turn off what you do not need. Whatever you keep is something you must protect and might be asked to hand over.
• Check the local rules. Some countries and cities have laws about keeping records of users or verifying who they are, and you may be responsible for what people do on your connection. Ask a local lawyer or your internet provider, and put short terms of use on the sign-in page.
• Consider filtering. A family-filtering DNS service or the router's built-in filter can block known bad and adult sites, which is worth it for a family restaurant. Filters are imperfect.
• Tell customers the truth. A small sign saying "This network is shared and not private. Use websites that start with https, or a VPN, for anything sensitive" costs nothing and builds trust.

Make the sign. Our guest Wi-Fi sign maker turns your guest network name and passphrase into a printable sign with a QR code, so customers join with their phone camera. It runs in your browser, and nothing is sent or stored.

Not ready to do this safely? Not offering Wi-Fi is a legitimate choice. A cheaper alternative is to let customers use their own phones' data. If you offer it, do it properly or ask a local IT professional to set it up once.

↑ Back to the section list

Quick version

• Change the router's admin password, use WPA3 or WPA2-AES with a long passphrase, and turn off WPS and remote administration.
• Keep the firmware current, or replace a router that no longer gets updates.
• Rename the Wi-Fi network without personal details, add _optout_nomap, and put guests and smart devices on a guest network.
• Give your devices neutral names, set unfamiliar networks to Public, and turn off sharing you do not use.
• Remember NAT is a helpful accident, not a firewall, and check that your guest network survives any extender or mesh you add.
• Consider your own router with the provider's gateway in bridge mode, if your provider allows it and you will keep it updated.
• If you offer customer Wi-Fi, give it a separate network with isolation, keep payment systems apart, and collect as little as you can. If staff take card payments at the table on handhelds, the ideal is a separate router just for customers, so they are never on the business network.
• Scan your own network now and then, and only your own.

Best available precautions, not guarantees.

↑ Back to the section list

Network Resources What’s on my network

These are programs you download. They are outside this site and not under our control, and they change over time, so always get them from the official site.

What is on my network?

• Fing - finds and identifies devices on your Wi-Fi and flags ones you do not recognize. Free with paid extras. It may want an account, so read what it collects.
• Angry IP Scanner - fast, free and open source. Scans a range of addresses and shows which devices are active.
• Advanced IP Scanner - free. Finds devices and shared folders on Windows networks.
• Lansweeper IP Scanner - free. Lists active devices by address and hardware ID without needing passwords.
• LanScan - a scanner for Mac, with a free version and paid upgrades.

Is anything exposed?

• Nmap - the standard free, open-source tool for discovering devices and finding open ports and services. It takes some learning. On Windows the installer also includes Zenmap, a graphical front end with saved scan profiles, so you do not need a separate download.
• SoftPerfect Network Scanner - a Windows scanner for hosts, open ports and shared resources. Paid, with a trial.
• LizardSystems Network Scanner - a Windows scanner for computers, shares and access rights. Free for personal use, and paid for business.

Why is it slow, or what is that traffic?

• Wireshark - free, open source packet analyzer for troubleshooting DNS, DHCP, slowness and odd traffic. Powerful, and it needs care and practice.
• ntopng - shows which devices and services use your bandwidth. A free community edition exists, with paid editions.

Keep watching it (mostly for small businesses)

Monitoring tools watch devices around the clock and send alerts. They are usually overkill at home, and they only help if someone reads the alerts.

• PRTG Network Monitor - dashboards, alerts and bandwidth history. A free tier with limits, and paid tiers.
• WhatsUp Gold - device availability and performance monitoring, with a limited free edition.
• ManageEngine OpManager - monitors routers, switches, servers and printers, with a limited free edition.
• LibreNMS - free, open source, self-hosted monitoring. More setup work.
• Zabbix - free, open source, self-hosted monitoring of devices and services. More setup work.

Free tiers and limits change, so check each vendor's page before you commit.

Last updated 2026-09-24