The second network you already paid for
Every router sold in the last decade has a Guest Network feature. Most users never enable it. It's the easiest way to secure your home against a category of attack most people don't realise exists.
Why it matters
Your smart bulb, smart TV, smart plug, baby monitor, wireless printer, and cheap no-name security camera all connect to the same Wi-Fi as your laptop and phone. Most of them haven't received a firmware update since 2019. Many ship with hardcoded default passwords. Some phone home to servers in countries you've never heard of.
If any one of them is compromised — and a surprising number are — the attacker has a foothold inside your LAN. From there they can see your laptop, probe for shared folders, attempt to intercept traffic, and scan for other vulnerable devices.
The fix: put IoT on a different network
A Guest Network is a separate SSID with an isolation flag: devices on it can reach the internet but not each other, and not your main network. Your smart bulb lives there alone.
Setup (5 minutes)
- Log in to your router (usually
192.168.1.1or192.168.0.1). - Find "Guest Network", "Guest Wi-Fi", or "Secondary SSID".
- Enable it. Give it a name like
PixelzHome-IoT(something distinct from your main). - Enable "AP Isolation" or "Client Isolation" — this is the critical checkbox.
- Enable "Disable access to local network" or similar — this blocks the guest from reaching your main LAN.
- Set a strong password.
- Reconnect each IoT device to this new network, one by one.
What goes on which network
Main network (trusted):
- Your laptop, desktop, phone, tablet
- Network-attached storage (NAS)
- Work devices
Guest/IoT network:
- Smart bulbs, plugs, switches
- Smart speakers (Alexa, Google Home)
- Smart TV, streaming sticks
- Security cameras, doorbell cameras
- Printers (unless you really need to print from everywhere)
- Any device made by a brand you've never heard of
Bonus: give actual guests the same network
When a friend asks for your Wi-Fi, give them the IoT network password. They get internet, they can't see your NAS or laptop. Everybody wins.
Takeaway
Zero cost, 5-minute router setting, meaningful reduction in your household attack surface. One compromised IoT device on an isolated network is contained. The same device on your main network is a disaster.