How to Keep Your Home Office Network Secure

This matters more for remote workers than for casual users. On a client's helpdesk, a company's code repository or a payroll system, your home Wi-Fi is part of the security perimeter. A weak router can expose your employer's data as well as yours.

This guide covers Nigerian home setups: ISP-supplied fibre routers, MiFi devices, phone hotspots used as backup, shared compound Wi-Fi, and the technician who still knows your admin password. It gives the settings to change, a checklist to follow and the warning signs to watch for. The advice draws on published guidance from the US Cybersecurity and Infrastructure Security Agency (CISA), the US Federal Trade Commission (FTC) and the UK's National Cyber Security Centre (NCSC).

Quick answer

Log into your router or MiFi and change the default admin password. Set Wi-Fi to WPA3 Personal, or WPA2 Personal (AES) if WPA3 isn't offered. Install firmware updates. Turn off WPS, UPnP and remote management. Create a guest network for visitors and smart devices. Check the list of connected devices every month. Secure your phone hotspot the same way, and follow any VPN or device rules your employer sets.

Why your home network matters when you work remotely

A home network is every device that shares your internet connection: the router or MiFi, your laptop and phone, a smart TV, a CCTV camera, and your younger brother's gaming console. They all sit behind one front door, the router.

When that front door uses a default password or outdated software, someone nearby or online may be able to change its settings. They could redirect your traffic, watch which sites you visit, or reach other devices on the same network. CISA warns that most network devices come with default administrator passwords to make setup easier, and that these defaults are easy to find. On many MiFi devices in Nigeria, the default is printed on a sticker under the battery cover.

For remote workers, the risk goes beyond personal data. You may handle customer records, invoices, passwords to client tools or unreleased code. If your network is compromised and that data leaks, your employer will judge you on how the leak happened, not on how good your internet was.

Network security is one layer of working safely from home. Account security (strong passwords and two-factor login) and spotting phishing emails matter just as much. Our guide to cybersecurity for people working from home covers the full picture. This page stays on the network.

Know what you're securing: router, MiFi or hotspot

Most Nigerian remote workers use one or more of these three connection types. Each has its own settings page, and the advice below applies to all of them.

To find the admin page of a router or MiFi, check the label on the device. It usually lists an address (often something like 192.168.1.1 or 192.168.0.1), a username and a default password. Type the address into a browser while you're connected to that network.

Some ISPs manage the router remotely and lock certain settings. If you can't reach a setting, contact your provider and ask two things: whether they push firmware updates automatically, and whether they can disable remote management for customers. The FTC recommends asking your ISP whether it updates the router for you.

The router settings to change first

Do these steps in order. Most routers take about 30 minutes, and you only need to do it properly once.

1. Change the admin username and password

The admin password controls the router's settings. The Wi-Fi password lets devices join the network. They are different passwords, and both need changing.

The FTC advises setting a separate, strong admin password and not using your name, address or the router brand in the network name. For the password itself, the NCSC suggests three random words, which makes a password long enough to resist cracking but still easy to remember. The NCSC also notes that swapping letters for look-alike symbols (0 for o) adds little protection. A password manager can generate and store the password for you. See our guide to password managers for remote workers.

This step matters most if someone else set up your connection. If a technician, landlord or neighbour configured the router, assume they still know the admin login, and change it.

2. Set the strongest Wi-Fi encryption your device supports

Encryption scrambles traffic between your devices and the router so that people nearby can't read it. In the security or wireless settings, pick one of these:

• WPA3 Personal: the newest and strongest option.
• WPA2 Personal with AES: acceptable if WPA3 isn't offered.
• WPA2/WPA3 mixed mode: a reasonable compromise if an older device in the house can't connect on WPA3.

The FTC says that if your router only offers WEP or WPA, you should update its software and check again, and replace the router if WPA2 or WPA3 still isn't available. CISA's home network security guidance also recommends WPA3 Personal with AES encryption. If you see "TKIP" in the options, avoid it.

3. Change the network name (SSID)

The network name (SSID) is the name devices see when they search for Wi-Fi. A default name like "MTN-MiFi-4B2C" or a router model name tells an attacker which device you have and which known flaws to try. A name like "Adeyemi Flat 3" tells strangers exactly whose network it is.

Pick something neutral that identifies neither you nor the device. CISA recommends a name that doesn't reveal your identity or location.

Some guides suggest hiding the network name altogether. Hidden networks can still be found with free tools, and hiding the name can make your own devices harder to reconnect. A strong password and WPA3 or WPA2 protect you far better.

4. Update the firmware, and keep it updated

Firmware is the software that runs the router. Manufacturers release updates to fix security flaws. CISA and the FTC both tell users to check the manufacturer's website for the latest version, and the FTC suggests registering the router so you get update notices.

Look for an "auto-update" option in the admin page and turn it on. If there isn't one, put a reminder in your calendar to check once a month. A router the manufacturer no longer updates is a liability. The NCSC's advice on smart devices in the home treats a device's support date as a "use by" date, and the same logic applies to routers and MiFis.

5. Turn off WPS, UPnP and remote management

These three features exist for convenience, and all three widen the ways into your network:

• WPS (Wi-Fi Protected Setup) lets devices join with a button press or a short PIN. The FTC and CISA both advise disabling it.
• UPnP (Universal Plug and Play) lets devices on your network open connections to the internet without asking you. CISA recommends turning it off unless you specifically need it. Some games and video apps use it, so test your work tools after switching it off.
• Remote management lets someone change router settings over the internet. CISA advises turning this off so unauthorised people can't access and change your router's configuration.

While you're there, check that the router's built-in firewall is on. CISA notes that some firewalls are switched off by default.

6. Log out of the admin page

When you finish, log out. The FTC specifically advises this so that a browser session left open doesn't give someone else access to your settings.

Separate your work devices from everything else

Your work laptop shouldn't share a network with every smart TV, cheap CCTV camera and visitor's phone in the house. If one of those devices is compromised, it's on the same network as your work.

Use a guest network for visitors and smart devices

Most modern routers can broadcast a second network, usually called a "guest network". The FTC recommends a guest network with its own name and password, which limits who knows your main password and keeps visitors' infected devices off your primary network.

A practical split for a Nigerian home office:

• Main network: your work laptop and work phone only.
• Guest network: family members' phones, visitors, the smart TV, the decoder and smart plugs.

If your router can't run a guest network, a cheap second router or a separate MiFi for the household does the same job.

Treat cameras and smart devices with care

The FTC's guidance on securing home security cameras recommends putting cameras on a separate network from your computers, changing default passwords, installing firmware updates and turning on two-factor login for the camera's cloud account. The NCSC adds that you should disable remote access on smart devices if you don't need it.

If you have a CCTV camera that covers your workspace, check what the camera can see. A screen with client data on it, visible to a camera feed hosted by an unknown app, is a data leak waiting to happen.

Don't share your network with neighbours

Sharing one Wi-Fi subscription across a compound or a block of flats is common and saves money. For remote work it's a poor idea, because everyone on the network can see each other's devices. If you have to share, put the neighbours on the guest network and keep the main network to yourself. If people you no longer trust have the password, change it.

Securing MiFi and phone hotspots

Many Nigerian remote workers use a MiFi as their main connection, or a phone hotspot as backup during outages. Both are small Wi-Fi routers and need the same care.

MiFi devices

Open the MiFi admin page (the address is on the label or in the manual) and work through the same list: change the admin password, change the Wi-Fi name and password, set WPA2 or WPA3, and turn off WPS. Many MiFis ship with the Wi-Fi password printed on a sticker, so anyone who picks the device up in a café or co-working space can read it. Change it on day one.

Also check for firmware updates in the admin page or the network's app. MiFi devices are often left on the factory software for years.

Phone hotspots

On your phone's hotspot settings:

• Set a long password, not your phone number or "12345678".
• Choose WPA3 or WPA2 if the phone offers a security option (many Android phones do).
• Turn the hotspot off when you finish working, so it isn't broadcasting all day.
• Check the connected-devices list, which most phones show on the hotspot screen.

A hotspot from your own phone, protected with a strong password, is a reasonable backup for work. Public Wi-Fi at an eatery, airport or hotel is a different matter: you don't control it, and you can't see who else is connected. If you must use it, use your employer's VPN, or switch to your own hotspot for anything sensitive. Our guide to using a VPN safely for remote work explains when a VPN helps and when it doesn't.

Extra protections that are worth the effort

These go beyond the basics. They're useful for anyone handling sensitive client data, and they cost little or nothing.

Use a filtering DNS service

DNS (Domain Name System) translates website names into the numeric addresses computers use. Your ISP's DNS is the default. A filtering DNS service also blocks known malicious sites.

Quad9 is a free public DNS service run by a not-for-profit foundation based in Switzerland. It needs no account and blocks lookups of known malware, phishing and botnet domains. Its addresses are 9.9.9.9 and 149.112.112.112. You can enter them in your router's DNS settings so every device benefits, or on a single laptop. If your employer's VPN or device management sets its own DNS, leave that alone: company settings take priority.

Back up and protect the data on your devices

Network security reduces the chance of an attack. Backups limit the damage if one happens. CISA recommends regular, encrypted backups to external media or a cloud service. For work files, use whatever storage your employer provides (often Google Drive, OneDrive or SharePoint) rather than copying client data to personal drives.

Keep work and personal devices apart where you can

If your employer gives you a laptop, use it only for work and connect it only to your main network. Don't let family members use it for homework or games. If you use your own laptop, create a separate user account for work. Our guide on the equipment you need for a remote job covers hardware choices.

Nigerian realities that affect network security

Some risks come from local conditions, not from hackers.

Power cuts, surges and factory resets

Frequent outages and generator changeovers can damage routers, and some faults or repairs end with a factory reset. A reset wipes your settings and brings back the default admin password, the default Wi-Fi name and sometimes an open network.

After any reset, repair or replacement, run through the router checklist again. Keeping the router and MiFi on an inverter or UPS (uninterruptible power supply), with a surge protector, cuts both the outages and the resets.

Technicians and installers

When an ISP installer, a "Wi-Fi guy" or an estate IT contractor sets up your connection, they often keep a note of the admin password, or set something simple so they can come back to fix it. Once installation is done, change both the admin password and the Wi-Fi password. If they need access again, change the passwords afterwards.

Two connections, two sets of settings

Many remote workers keep two internet providers, or a router plus a MiFi, so that one outage doesn't cost them a shift. That doubles the work: both devices need the same settings. Our guides to internet options for working remotely in Nigeria and improving your internet connection cover choosing a backup. Whichever you pick, secure it the day you buy it, not the day you first need it.

A monthly network check for remote workers

Security settings drift. Devices get added, firmware goes out of date, someone gets the password. This 10-minute routine keeps things tidy:

1. Open the router and MiFi admin pages and look at the connected-devices list. Identify every device. CISA advises monitoring for unknown devices.
2. Remove or block anything you don't recognise, then change the Wi-Fi password.
3. Check for firmware updates on the router, MiFi and any cameras.
4. Confirm that WPS, UPnP and remote management are still off, especially after any reset.
5. Check that the guest network is still separate and its password hasn't been shared too widely.
6. Update your laptop's operating system and browser, and restart if prompted.

Example (hypothetical): Chiamaka works remote customer support for a UK software company from Ibadan. She has a fibre router and a MiFi backup. On the first Monday of each month, before her shift starts at 9am Lagos time (8am in London in winter), she spends 10 minutes on this checklist. One month she finds an unfamiliar device on the main network: it turns out to be a cousin who got the password from her brother. She moves the cousin to the guest network and changes the main password. The routine is small, and that's the point: it catches problems before they become incidents.

Signs your network may be compromised, and what to do

Warning signs include:

• Devices you don't recognise in the connected list.
• Router settings you didn't change, such as a new DNS address or remote management switched back on.
• Your browser landing on strange pages or showing certificate warnings on sites that normally work.
• Your admin password suddenly not working.

If you see any of these, act in this order:

1. Disconnect your work laptop from the network and switch to your phone hotspot.
2. Tell your employer's IT or security team straight away, especially if work accounts or client data might be affected. Most employers would much rather hear early.
3. Factory-reset the router (usually a pinhole button held for about 10 seconds) and set it up again from scratch using the steps above.
4. Change the passwords for important accounts from a clean device, and check that two-factor login is on. See our guide to setting up two-factor authentication for work accounts.

If the problem started with a suspicious email or link, our guide to avoiding phishing attacks while working remotely explains what to check next.

What your employer may require

Many international employers set their own rules for home workers, and those rules override general advice like this page. Common requirements include connecting through a company VPN, using a company-managed laptop with security software installed, not using public Wi-Fi for work, and reporting lost devices or suspected breaches within a set time.

Read your contract and any IT or acceptable-use policy before your first day. If something here conflicts with company instructions, follow the company and ask IT about the difference. If you're interested in this kind of work as a career rather than just as good practice, our cybersecurity analyst career guide explains how people in Nigeria move into remote security roles.

Frequently asked questions

Is home Wi-Fi safe enough for remote work?

Yes, if you've secured it. A home network with a changed admin password, WPA3 or WPA2 encryption, current firmware and visitors kept on a guest network is a reasonable place to work from. An unsecured router with default settings is not. Many employers add a company VPN on top for extra protection.

Do I still need a VPN if my home Wi-Fi is secure?

Use one if your employer requires it, and many do. A secure home network protects traffic between your devices and your router. A company VPN also protects the connection to the company's systems and lets them control access. For personal use at home, a VPN matters less than getting your router settings right.

Is a MiFi more secure than a home router?

No, not by default. A MiFi is a small router with the same weak points: default passwords, old firmware and WPS. It is portable, which makes it easier to lose or for someone to read the password sticker. Secure it the same way you'd secure a fixed router.

Is it safe to use my phone hotspot for work calls and client systems?

Yes, it's generally safe if the hotspot has a strong password and WPA2 or WPA3, and you turn it off when you're done. Your own hotspot is far safer than public Wi-Fi in a café or hotel. Check the connected-devices list now and then to make sure nobody else has joined.

How can I tell if someone is using my Wi-Fi without permission?

Log into your router or MiFi admin page and look at the list of connected devices. Any device you can't identify should be blocked, and you should change the Wi-Fi password. Unexplained slow speeds or data running out faster than usual can also be signs.

Should I put my work laptop on a separate network?

Yes, where you can. Keep the work laptop on your main network and move visitors, smart TVs, cameras and household devices to a guest network. If one of those devices is compromised, the separation makes it harder for an attacker to reach your work machine.

How often should I change my Wi-Fi password?

You don't need to change it on a fixed schedule if it's long and strong. Change it whenever someone you no longer trust has it, after a technician visit, after a factory reset, or if you see unknown devices on the network.

What should I do with an old router that no longer gets updates?

Replace it. The FTC advises replacing a router that can't use WPA2 or WPA3, and a router the manufacturer no longer updates won't receive fixes for new security flaws. If the router came from your ISP, ask whether they offer an upgrade.

Key takeaways

• The router or MiFi is the front door of your home office network: change its admin password and Wi-Fi password first.
• Use WPA3 Personal, or WPA2 Personal with AES, and replace any device that only supports WEP or WPA.
• Turn off WPS, UPnP and remote management, keep firmware updated and check that the firewall is on.
• Put visitors, family devices and smart gadgets on a guest network, away from your work laptop.
• Secure backup connections (MiFi, phone hotspot) the day you get them, and run the router checklist again after any reset or repair.
• Check connected devices monthly, and tell your employer's IT team quickly if something looks wrong.

Next steps

Spend 30 minutes this week working through the router steps above on every connection you use for work, then add the monthly check to your calendar. If you're still looking for remote work, browse remote jobs open to applicants in Nigeria and save a search to get daily email alerts for new matching roles. Before you apply, read how to spot remote job scams in Nigeria. A secure network won't help if the "employer" is a fraud.

Sources

• Home Network Security, CISA
• How To Secure Your Home Wi-Fi Network, FTC Consumer Advice
• How To Secure Your Home Security Cameras, FTC Consumer Advice
• Smart devices: using them safely in your home, NCSC (UK)
• Three random words, NCSC (UK)
• Quad9