Checklistify

Home Network Security Audit

Most home networks run on settings configured years ago — default credentials unchanged, firmware unpatched, and smart devices sharing a network with laptops holding financial records. This 90-minute audit tells you exactly what to check, where to find each setting, and what to change, with no IT background required. For more background and examples, see the guidance below; for built-in tools and options, use the quick tools guide.

Author
Checklistify Editorial Team
Last Updated

Checklist

0 done•48 left•9 of 10 sections collapsed

0%

Which threats are actually targeting your network right now?

The items in this checklist do not carry equal risk. Understanding how attackers actually prioritize home networks helps you decide where to focus first if you cannot complete everything in a single session.

🚨 Automated, constant — running 24/7

Botnets continuously scan the public internet for routers with default admin credentials, unpatched firmware, and exposed remote management ports. This is not targeted at you specifically — it is automated scripts sweeping every IP address in sequence. You are not a victim being chosen; you are a number in a range being checked. These attacks succeed in seconds when the right conditions are met, and they never stop running.

⚠️ Proximity-based — requires being nearby

Wi-Fi password brute-force and WPS exploitation require physical proximity to your signal. Dense apartment buildings and urban neighborhoods substantially elevate this risk. Shared parking lots, building lobbies, and adjacent units are all well within range. These attacks are slower than automated internet scanning but can run passively for hours without the attacker remaining physically present.

💡 Lateral movement — after an initial foothold

Once inside a flat, unsegmented network — through a compromised device, a shared password, or a trusted guest — an attacker can probe every other connected device. File sharing ports, Remote Desktop, SMB shares, and NAS admin panels are all visible and reachable. Network isolation does not prevent the initial compromise; it converts the compromised device from a launchpad into a dead end.

📝 Passive surveillance — ongoing and invisible

Unencrypted DNS queries and ISP traffic logging do not grant access to your devices, but they enable continuous monitoring of every household member's online activity — every domain your devices contact, timestamped. This requires no active attack, affects every device automatically, and continues indefinitely unless you change the DNS configuration at the router level.

📖 600,000 routers, one bad week

In 2016, the Mirai botnet compromised over 600,000 internet-connected devices, including home routers and cameras, many of them using factory-default credentials. Those devices were marshaled to generate enough traffic to simultaneously take down Twitter, Netflix, Reddit, and Amazon for millions of users across North America and Europe. The device owners had no idea their hardware was involved. Most noticed only that their internet felt sluggish. ISPs detected the anomalous outbound traffic; the owners assumed a local outage. A common entry point: factory-default credentials were still enabled.

📖 The pivot problem on flat networks

A recurring pattern in reported home network intrusions: an attacker gains access to a smart home device through a default credential or unpatched vulnerability, then uses that foothold to scan the same network for higher-value targets. On a flat network, a smart TV can see open file sharing ports, NAS admin panels, and printer interfaces without any elevated access. The IoT device was the door; the unprotected network architecture was the hallway. Isolating IoT devices does not make the camera unhackable — it makes the camera a dead end instead of a springboard to everything else.

Audit or replace? A decision framework

Before investing 90 minutes in configuration, confirm the router is worth configuring. Hardening a device with an unpatched critical vulnerability or no guest network capability produces a false sense of security — thorough configuration cannot compensate for fundamental hardware or software limitations.

FactorAudit itReplace it
Router ageUnder 5 years5+ years old
Last firmware release from manufacturerWithin 12 months2+ years ago
Known unpatched CVE on this modelNone foundYes, critical severity
WPA3 encryption supportSupportedWPA2 maximum
Guest network capabilityAvailableNot supported
Manufacturer support statusActiveEnd-of-life declared

Three or more Replace signals: replace before auditing. A Wi-Fi 6 router with active manufacturer support (Asus AX series, TP-Link Archer AX, Eero Pro 6) runs $80–$150 — roughly one year of a single streaming subscription.

🔍 Three external checks before you open the admin panel

These tools give you an outsider's view of your network in under 10 minutes and can fundamentally shift your priorities before you change a single setting.

Shodan.io — what the internet sees when it looks at your IP

Find your public IP address at whatismyip.com, then search it at shodan.io. A properly secured home router returns zero results — no open ports, no service banners, no device fingerprinting. Any open ports listed (common home router offenders: 8080, 23, 22, 7547, 443) mean your router or a device behind it is reachable from the public internet. Shodan findings take priority over the normal audit sequence — address them before anything else.

nvd.nist.gov — check your exact router model for published vulnerabilities

Search your router's exact model number at the National Vulnerability Database. Filter by severity score. A CVSS score of 9.0 or above on your specific model with no corresponding patch in the current firmware is a replace-immediately signal — no configuration change compensates for a remotely exploitable, unauthenticated vulnerability in the router's core software. This check takes 2 minutes and tells you immediately whether the audit is even worth running.

haveibeenpwned.com — check whether household credentials are already exposed

Enter every email address used by household members at haveibeenpwned.com. If an address appears in a breach that included passwords, and those passwords were reused anywhere in your household — on the router admin panel, on Wi-Fi-connected accounts, or on any service accessed from home devices — you may already be compromised through credential stuffing rather than a network-level attack. Old breaches from 5+ years ago frequently surface here, and the credentials from those breaches remain in active use by automated attack tooling today.

🚨 If you suspect you are already compromised

Warning signs: admin login credentials that suddenly do not work, devices behaving abnormally without explanation, internet speeds significantly slower than your subscribed plan, or an ISP notification about unusual outbound traffic from your address. If any apply, run this sequence before the audit — not alongside it.

  1. 1

    Physically disconnect sensitive devices from the network immediately.

    Use mobile data for banking and email until the audit is complete. On a router-level compromise, unencrypted traffic from every connected device may be readable by whoever controls the router. This is not overcaution — it is the appropriate response to an unknown threat with an unknown scope.

  2. 2

    Factory reset the router.

    Some router malware — notably VPNFilter, which affected over 500,000 devices in 2018 — can survive a standard reboot, so a full factory reset is the safer baseline response. Hold the physical reset button for 10–30 seconds (check your model's instructions — duration varies). This clears all configuration, including any backdoors installed by the attacker. Reconfigure from scratch using this checklist immediately after.

  3. 3

    Change passwords on all accounts accessed from that network.

    Do this from a device using mobile data — not from any device that was connected to the compromised network during the incident. Prioritize email (the master key to every other account via password reset), banking, cloud storage, and any service with saved payment methods. Treat any unencrypted traffic sent during the compromise window as potentially captured.

  4. 4

    Contact your ISP.

    ISPs can provide outbound traffic logs, temporarily block your IP from participating in known botnet traffic patterns, and advise if your address appears on industry blacklists. Some ISPs proactively detect when a customer's IP is active in botnet behavior and can share the timeline of that activity — a useful input when trying to understand the scope of the incident. They are a significantly underused resource during home network emergencies.

🧮 Where your 90 minutes actually goes

First-time audits consistently run longer than expected — not because individual steps are technically demanding, but because discoveries along the way require investigation. This breakdown includes contingency time for what you are likely to find.

External pre-audit checks (Shodan, NVD, HIBP)10 min
Admin credentials and remote access settings10 min
Firmware update including router restart15 min
Wi-Fi settings and reconnecting all devices20 min
Guest and IoT network setup and device migration15 min
Connected device identification and cleanup20 min
Firewall, DNS, and audit documentation15 min
Contingency for unexpected findings+30 min

The connected device section alone regularly runs 30+ minutes in households with 15 or more devices. Identifying every ESP module, smart plug, and forgotten tablet by MAC address is genuinely slow work — but it is the section most likely to surface something you did not know was there.

Home Router, Wi-Fi, and DNS Security

These official references verify the router hardening, wireless security, and protective DNS steps this audit is built around.

Master This Checklist Quickly

Every important button and option for this pre-made checklist, shown in a glance-friendly format.

Start Here

  1. 1

    Click any item row to mark it complete.

  2. 2

    Use the note row under each item for quick notes.

  3. 3

    Use the tool row for undo, redo, reset, and check all.

  4. 4

    Use Save Progress when you want to continue later.

Checklist Row Tools

UndoRedoResetCheck allCollapse/Expand sectionsShow/Hide detailsInline notes

Top Action Buttons

Share

Open all sharing and export options in one menu.

Email DraftContinue on another devicePrint or Save as PDFPlain Text (.txt)Word (.docx)Excel (.xlsx)

Add & Ask

Open one menu for apps and AI guidance.

NotionTodoist CSVChatGPTClaude

Copy and customize

Create a new editable checklist pre-filled with your chosen content.

Save Progress

Adds this checklist to My Checklists and keeps your progress in this browser.

Most Natural Usage

Track over time

Check items -> Add notes where needed -> Save Progress

Send or export

Open Share -> Choose format -> Continue

Make your own version

Copy and customize -> Open create page -> Edit freely