How to test your home Wi-Fi security safely
Testing your home Wi-Fi security can be as simple as checking the router, reviewing connected devices, and scanning only hardware you own. The goal is not to “hack” your household; it is to expose weak defaults, outdated firmware, unnecessary sharing, and services that should never have been reachable from the internet.
A useful Australian audit starts with the equipment in the hallway or lounge: the NBN box, the provider’s Wi-Fi gateway, any mesh nodes, and a cable modem if the property uses one. Telstra, Optus, Aussie Broadband and iiNet commonly supply or support the gateway, while the NBN unit may not control Wi-Fi at all. Record model numbers, firmware versions, administrator addresses and the device list before changing anything.
Establish ownership and a baseline
Only test systems you own or have clear permission to assess. Do not scan neighbouring Wi-Fi, random public hotspots or devices on a work network. A ping sweep on your own LAN is low risk, but an indiscriminate scan can trigger alerts or affect someone else’s service.
Create a written baseline: router and extender models, firmware, Wi-Fi security mode, guest networks, port-forwarding rules, DNS settings and connected clients. Photograph labels and export the client list where possible. Australian broadband packages often bundle an ISP-supplied gateway, so compare its firmware with the provider’s release notes rather than installing unverified firmware from a forum.
Map the network with low-impact tools
Begin with the gateway’s connected-device list and traffic counters. Wireshark can reveal DNS queries, device names, protocols and certificate metadata, but a laptop on Wi-Fi normally sees only its own encrypted traffic. If the gateway can export a capture, use that; otherwise inspect one laptop’s traffic and note the limitation.
For a controlled port check, run Nmap against a single authorised address, for example nmap -sV 192.168.1.25, replacing it with an address confirmed in the router’s DHCP list. A discovery command such as nmap -sn 192.168.1.0/24 should use the exact range shown by your gateway, not an assumed home range. Then run a browser-based DNS-leak test and compare the resolver with the one configured in the router.
Review the controls on the gateway
The most consequential controls live on the gateway. Change every default administrator and Wi-Fi password, use WPA2-AES or WPA3 with a unique passphrase, enable automatic firmware updates, disable WPS, turn off remote administration, and update the WAN-facing software supplied by your ISP. A hidden SSID is cosmetic; it does not replace strong encryption or current firmware.
Put cameras, game consoles, speakers and other IoT hardware on a guest network, especially if it lacks firmware support. In a Sydney or Melbourne apartment, nearby hotspot names may belong to neighbours, while an extender often appears as the ISP name plus “Extender”; confirm ownership before changing it. That separation is increasingly relevant as brain-computer interface research moves beyond medical trials and connected health hardware becomes more common.
Audit clients, apps and unofficial software
Walk through phones, laptops, televisions, printers, cameras, baby monitors and smart plugs. Remove forgotten devices, review each app’s camera, microphone, location and nearby-device permissions, and prioritise automatic operating-system updates. Change reused passwords in the password manager, then enable multifactor authentication on email and the router’s administration account where supported.
Avoid third-party WhatsApp modifications offered as security tests: unofficial builds can change update handling and expose message databases. Audit the genuine app from the official store, confirm two-step verification, and treat unexpected reinstall prompts or access notices as a reason to revoke active sessions.
Compare the useful auditing options
The router dashboard and vendor guidance should come first because they expose the settings that matter. A packet analyser adds visibility, while an active scanner is useful for a controlled service inventory rather than producing a dramatic security score.
| Tool or check | What it can reveal | Limits and cautions |
|---|---|---|
| ISP router dashboard | Firmware, clients, DNS, Wi-Fi mode | Features and menus differ by provider |
| Wireshark | DNS queries, protocols and certificate metadata | Usually sees only captured traffic; HTTPS stays encrypted |
| Nmap | Local devices, open ports and service versions | Use only authorised ranges; active probes can be noisy |
| Browser DNS-leak test | Whether queries reach the expected resolver | Checks the current network only |
| ACSC guidance | Priorities for Australian home-network risks | A checklist, not an automated scanner |
Read each result in context. An open printer port may be acceptable on a guest network but suspicious on the main LAN; a closed port is not automatically a fault. ACSC guidance is especially useful for Australian households because it prioritises default credentials, unsupported software and insecure remote access without selling a product.
Remediate findings and repeat the audit
Prioritise findings by exposure and effort: update firmware, reset default credentials, remove unused port forwarding and remote-management entries, then place cameras, game consoles and other IoT devices on a guest network. If a device or account looks compromised, disconnect it, change the relevant password, restore the device from a clean backup, and contact the ISP. Cyber Centres Australia and the ACSC provide national guidance and incident support.
The lifecycle lesson in second-life EV batteries applies to connected hardware: a product may remain useful long after its security patches stop. Keep a dated record of firmware versions, rotate the administrator passphrase if it may have been exposed, and repeat the client-list and DNS-leak check monthly. The first concrete step is to open the gateway’s local settings page and record its current firmware version in a household security inventory.