Skip MAC Filtering and Hidden SSIDs — Do These Six Things Instead

Home router guides have recommended the same two tricks for fifteen years: hide your network name and filter by MAC address. Neither appears in current CISA or FTC guidance, and there is a good reason for that. Here is what those agencies do recommend.

Why MAC filtering does not do what it looks like it does

MAC filtering asks the router to admit only devices whose hardware addresses appear on a list. It sounds like a guest list. It behaves like one written in pencil, posted on the front door.

Two facts undo it. First, MAC addresses are broadcast in the clear as part of ordinary Wi-Fi operation — they are not encrypted even on a WPA3 network, because the device needs them before encryption is negotiated. Anyone within range can read the list of permitted addresses. Second, a MAC address is a software setting on virtually every modern device; changing it takes one command.

So an attacker reads a permitted address off the air and sets their own adapter to match. The filter you maintain by hand, and that annoys you every time a guest visits, stops nobody who was going to be a problem.

And why hiding the network name is worse than doing nothing

A “hidden” network simply stops the router from including its name in periodic broadcasts. The network is still there and still visible to anyone running standard tools, because your own devices announce the name whenever they look for it.

That last part is the sting. To connect to a hidden network, your laptop and phone have to actively call out for it — wherever they happen to be. A device configured for a hidden home network broadcasts that network’s name in every café and airport it visits. You have not hidden your network; you have made your devices advertise it in public.

What to do this evening instead

1. Open your router’s admin page and change the admin password. The FTC’s wording: change the “default administrative username, password, and network name to something unique”, and do not use a name, address or anything else guessable.
2. Set encryption to WPA3 Personal. If the router only offers WPA2, choose WPA2 AES specifically. If it offers only WEP or WPA, the router is old enough that replacing it is the security fix.
3. Turn off WPS. The push-button pairing feature. CISA is explicit about this one.
4. Turn off remote management unless you actively use it, since it exposes the admin interface to the internet.
5. Update the firmware, and turn on automatic updates if the router supports them.
6. Put untrusted devices on the guest network. Smart plugs, cameras, TVs and anything else that phones home does not need to sit on the same network as your laptop.

Where the real risk sits

Almost every home network compromise starts in one of two places: an admin password that was never changed from the sticker on the box, or firmware that has not been updated in years. Not the SSID being visible.

It is worth being honest about why the old advice persists. Hiding the SSID and filtering MACs are both visible — you can see yourself doing them. Changing the admin password and enabling automatic firmware updates takes five minutes and then looks like nothing happened. The invisible ones are the ones that work.

Sources: FTC: securing your home Wi-Fi network · CISA: home network security · CISA: secure our world — home network guidance

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from CISA and the FTC. Security guidance changes; where our earlier version of this page said something different, we say so above rather than editing it out quietly.