Home Cybersecurity Checklist 2026: A Whole-Household Audit

A home cybersecurity checklist covers six areas: the router everyone shares, the smart devices on the network, the other people in the house, the accounts nobody clearly owns, what happens when a device is lost, and money and identity. Done together in one evening, it closes the gaps a personal checklist misses — and if you only have an hour, four steps cover most of the realistic damage: change the router's admin password, turn on transaction alerts, put every adult's email behind a second factor that is not a text message, and get the backup drive off the computer it backs up.

A Household Audit, Not a Personal One

Most security checklists are written for one person and one laptop. Homes do not work like that. A home has a shared router, a television that talks to the internet, a partner with their own accounts, possibly a child with a tablet, a printer nobody has updated since it was unboxed, and a drawer of old phones.

The weak point in a household is almost never the person reading the checklist. It is the account nobody owns, the device nobody patches, and the shared password everybody knows.

So this is deliberately not the personal, tiered, do-this-today list — that one exists separately as the complete cybersecurity checklist for 2026 and it is the better starting point if you are securing yourself rather than a household. This page is the audit you run for the home: the shared surfaces, the other people, and the things with a plug.

Set aside an evening. Work through it with whoever else lives there, because half of it needs their cooperation and none of it works if it is imposed.

Part 1 — The Shared Front Door

Everything in the house passes through one box, and it is usually the least-maintained device in the building.

• Change the router's admin password from whatever is printed on the sticker, and store the new one in a shared vault.
• Check for firmware updates, and check whether the model still receives them at all. A router the manufacturer stopped supporting is a permanent open window.
• Confirm the wireless network is on WPA3, or WPA2-AES if not every device supports WPA3.
• Turn off remote administration unless you genuinely need it.
• Turn off WPS, the push-button pairing feature.
• Open the router's list of connected devices and identify every entry. Anything you cannot name is worth investigating.

Those are the six that matter most. The deeper version — network segmentation, DNS choices, running a VPN at the router — is in how to secure your home network, and this checklist deliberately stops at the point where that one begins rather than repeating it.

Part 2 — The Things With Plugs

Smart devices are the part of a home nobody audits, because they do not feel like computers.

• Put every smart device on the guest network rather than the main one, so a compromised bulb cannot reach a laptop.
• Change the default credentials on anything that has them — cameras and doorbells especially.
• Turn off remote access and cloud streaming on devices where you do not use those features.
• Check whether each device still receives firmware updates, and for how long it will. In the UK, the product security regime that came into effect on 29 April 2024 requires makers of consumer connectable products to publish a minimum security update period with an end date, to give information on how to report security issues, and to ship passwords that are unique per product or set by the user — so the support period should be findable before you buy.
• Remove devices you no longer use from the network and from their apps.
• Ask, for cameras in particular, who else has an account on them. Old flatmates and previous owners linger.

The general principle is blunt: a device that cannot be updated should not be on the same network as anything you care about. Guest network, or off.

Part 3 — The Other People

This is the section that gets skipped and the one that produces the most real-world trouble.

• Give every adult their own account on shared services, rather than one login passed around.
• Set up family sharing on the password manager so shared credentials — the streaming account, the utility login, the router — live in a shared vault rather than in a group chat.
• Agree on what happens when someone leaves the household. Which passwords change, and who changes them.
• Set up child accounts properly, with an age-appropriate profile rather than an adult account with a filter bolted on.
• Talk, once, about the specific scams that target your household. A message claiming to be from a family member asking for money is the one that catches people who know better.
• Agree a rule: nobody acts on an urgent request that arrives by message without confirming it another way.

Part 4 — The Accounts Nobody Owns

Every household has these. They are the ones registered to an address that no longer works, or to a person who no longer lives there.

• The utilities, broadband and mobile accounts. Confirm who they are registered to and that the contact details are current.
• The council, tax and government portals.
• The insurance and pension logins.
• The domain name, if the household owns one, and whatever email depends on it.
• Loyalty and delivery accounts with a saved card.

For each: confirm the recovery email is one somebody still reads, confirm the recovery phone number is a number somebody still holds, and turn on a second factor. That last step follows the order in how to set up two-factor authentication, and the recovery codes it produces need somewhere to live — see 2FA recovery codes explained.

Part 5 — Devices and What Happens When One Walks

That last row is the one people learn the hard way. A backup permanently plugged into the machine it backs up is not a backup against ransomware, because whatever encrypts the computer encrypts the drive attached to it. The mechanics of that are in ransomware protection in 2026.

Part 6 — Money and Identity

• Turn on transaction alerts on every card and account. This is the single highest-value setting in this document.
• Check a credit report for accounts nobody in the household opened.
• Consider a credit freeze if anyone in the household has been in a significant breach. In the US, the Federal Trade Commission says freezes are free to place and lift and must be set with each of the three bureaus; other countries have their own credit-reference agencies.
• Check each adult's email address against the breach indexes, using the method in checking whether your email was hacked.
• Decide whether continuous monitoring is worth it for your household. What it does and does not do is in best identity theft protection 2026.

A Worked Evening Plan

The Maintenance That Keeps It True

An audit decays. The version that survives is short.

Monthly, ten minutes. Check the router's connected-device list. Check the breach dashboard. Confirm backups are actually running.

Quarterly, half an hour. Router firmware. Smart-device firmware. Review who has access to shared accounts.

Yearly, an hour. Sign out of sessions everywhere. Audit the password vault for dead accounts. Review app permissions on every phone. Check that recovery details on the important accounts are still reachable.

What This Costs, Honestly

Most of the list is free. The router settings, the account hygiene, the conversations and the alerts cost nothing but the evening. The paid parts are a password manager, and optionally an antivirus subscription and identity monitoring — a modest amount per month for a household, and the free tier of a manager covers a single person adequately.

Do not spend anything before the free items are done. A subscription on top of a router with its factory password is money spent in the wrong order.

The Counter-Argument

There is a reasonable objection to a list this long: nobody completes it, and a partially-completed checklist can leave someone feeling protected when they are not. That is fair.

So if you do nothing else from this page, do four things. Change the router's admin password. Turn on transaction alerts. Put every adult's email behind a second factor that is not a text message. Get the backup drive off the machine it backs up. Those four cover most of the realistic damage, and they take under an hour between them. The rest is genuine improvement, but it is improvement on a foundation those four provide.

Frequently asked questions

How should a household handle shared credentials and streaming accounts?

Give every adult their own account on shared services rather than passing around a single login. Set up family sharing on the password manager so that shared credentials, such as streaming accounts and utility logins, live safely inside a shared vault instead of floating around in a group chat.

What are the four most important security steps if you do nothing else?

Change the router admin password, turn on transaction alerts, put every adult email behind a second factor that is not a text message, and get the backup drive physically off the machine it backs up. These four actions cover most realistic damage and take under an hour.

How should smart devices be handled on a home network?

Put every smart device on the guest network instead of the main one so a compromised bulb cannot reach a laptop. Change default credentials on devices like cameras and doorbells, turn off unused remote access, and remove any old devices you no longer use from the network.

How often should you perform maintenance on your home security audit?

Spend ten minutes monthly to check the router connected device list, check breach dashboards, and confirm backups are running. Spend half an hour quarterly on router and smart device firmware and reviewing access, and spend an hour yearly signing out of sessions and checking recovery details.

Sources checked 16 October 2026: UK Government, "The UK Product Security and Telecommunications Infrastructure (Product Security) regime"; US Federal Trade Commission, "What To Know About Credit Freezes and Fraud Alerts". Editorial content.