Which Wi-Fi security setting should you use?

The short answer

Your router has a Wi-Fi security setting, and the FTC says what to pick: "To encrypt your network, simply update your router settings to either WPA3 Personal or WPA2 Personal." It adds that WPA3 is the newer and best of the two, "but both will work to scramble your information."

For most homes that is the whole decision. The rest of this article explains the names, what to do if your router offers neither, and the other Wi-Fi settings the agencies mention.

What the setting does

The FTC explains: "Encryption scrambles the information sent through your network." It also describes the risk of having no protection. Unless your network is password protected, "any device within range" (yours, a guest's or a stranger's) "can pull the signal from the air and use your internet connection."

WPA stands for Wi-Fi Protected Access, and the number is the version. You will usually see the word Personal next to it, which is the choice the FTC names for a home. Many routers also list an Enterprise option. The Wi-Fi Alliance, the industry group that certifies Wi-Fi equipment, says WPA3 Enterprise gives users "higher-grade security protocols for sensitive data networks". The FTC names only the Personal options for a home.

Why WPA3 over WPA2, and when WPA2 is fine

CISA's archived page says: "Use the strongest encryption protocol available." The Wi-Fi Alliance describes one reason WPA3 is stronger: "Users of WPA3-Personal receive increased protections from password guessing attempts". It also says WPA3 networks "Disallow outdated legacy protocols".

The FTC says both WPA3 Personal and WPA2 Personal work. So if you have a phone, TV or console that cannot join a WPA3 network after you switch, WPA2 Personal is an option the FTC gives as well. Some routers also offer a mixed WPA2 and WPA3 setting. The pages we read do not discuss it, so we do not give advice on it. If you are unsure, pick one of the two the FTC names.

If your router offers neither

The FTC asks the question directly and answers it: "Older routers have WPA and WEP, which are outdated and not secure." Its steps, in order:

1. "If those are the only options listed, try updating your router software."
2. "Then check again to see if WPA2 or WPA3 are available."
3. "If they're not, consider getting a new router to keep your information secure."

If you reach step 3, our article on how long a router should last covers how to tell whether yours still gets updates. For the steps to find your router's menus, see how to sign in to your router.

Two passwords, not one

The FTC says "There are two passwords on your router that you'll need to reset" and describes them:

• "The Wi-Fi network password: This is the one you use to connect your devices to the network." The FTC says "A unique and secure Wi-Fi network password prevents strangers from getting onto your network."
• "The router admin password: This is the one that lets you into the administrative side of the device."

The FTC explains why the second one matters: "If a hacker managed to log into the admin side of your router, the hacker could change the settings (including your Wi-Fi network password). That would undo any other security steps you may be taking." Steps for the admin password are in change your router admin password.

Other Wi-Fi settings the agencies mention

• WPS. CISA says: "Disable Wi-Fi Protected Setup (WPS)." Its reason: "a design flaw in the WPS specification for PIN authentication significantly reduces the time required for a cyberattacker to brute force an entire PIN". The FTC also lists WPS among features to turn off.
• The network name. The FTC says to change the default network name "to something unique". CISA's reason is that the default name usually points to the maker: "Because the device's default SSID typically identifies the manufacturer or the actual device, an attacker can use this to identify the device and exploit any of its known vulnerabilities." CISA adds: "Make your SSID unique and not tied to your identity or location".

The pages we read do not mention hiding the network name or filtering by device address, so we do not give advice on those here.

How to change it

This part is general, and the exact menu names differ by brand and model, so look for the words and not the layout.

1. Sign in to your router. If you have never done it, use the guide linked above.
2. Look for a section called Wireless, Wi-Fi or Security, and a setting named Security, Encryption or Authentication.
3. Choose WPA3 Personal or WPA2 Personal, then save.
4. Expect your devices to disconnect after you save, so you will need to join them again. Write down the Wi-Fi password first.

If a device will not rejoin, the first thing to try is the other of the two choices the FTC names.

What Network Check can and cannot tell you

The website check looks at your router from the internet side. It cannot see your Wi-Fi security setting or how strong your Wi-Fi password is, so a good result says nothing about either. You have to look at the router's menus for those. Running the check is still worth doing after you change settings.

Sources

• Federal Trade Commission, "How To Secure Your Home Wi-Fi Network" (consumer advice, December 2022): consumer.ftc.gov
• CISA, "Home Network Security" (archived page, released February 1, 2021): cisa.gov
• Wi-Fi Alliance, "Security" (the industry group's own description of its security programs, undated): wi-fi.org

Quotes are copied from those pages. We read them directly on November 10, 2026. Agencies revise and archive pages, so check the originals for anything you plan to rely on. The Wi-Fi Alliance page describes its own standards, so treat it as the maker's account and not an independent review.