Securing Remote Workers: Home Wi-Fi, Devices, VPN
When your team works from kitchens, spare rooms and coffee shops, your office network is now dozens of home routers you have never seen. This checklist shows you how to secure remote workers step by step: the home Wi-Fi, the devices, the connection back to company systems and the habits that hold it all together.
Key takeaways
- Start with the home router: change the default admin password, update the firmware and use WPA2 or WPA3 encryption.
- Keep work on separate work devices or managed work profiles, with full-disk encryption, automatic updates and a screen lock.
- Give staff a VPN or zero-trust access to company systems instead of opening those systems to the whole internet.
- Avoid public Wi-Fi for sensitive tasks, or use a VPN or a phone hotspot when there is no choice.
- Write the rules down on one page so every remote worker follows the same baseline.
Remote and hybrid work is normal for small businesses now, from a two-person design studio to a twenty-person accounting firm. The problem is that the security you built for the office does not follow people home. The firewall in your server cupboard does nothing for a laptop on a home network shared with a games console, a smart doorbell and a teenager's downloads.
You cannot control every home, but you can set a clear baseline and give people the tools to meet it. This checklist splits the job into four layers: the home network, the work device, the connection back to company systems and the daily habits of the person using them. It goes deeper than our general cybersecurity checklist and focuses only on people who work away from the office.
Layer one: lock down the home network
The home router is the front door for everything a remote worker does. Many are installed by an internet provider and never touched again, which means they may still run old firmware and a default admin password printed on a sticker.
Change the router's default admin password
Every router has an admin page where settings are changed. If the login is still the factory default, anyone who gets onto the network, or in some cases anyone who knows the model, may be able to change those settings. Ask staff to log in to the router once, set a long unique admin password and store it in their password manager. This is different from the Wi-Fi password that family members and guests use.
Update the router firmware
Router makers release firmware updates to fix security flaws. Many newer routers can update automatically; turn that on where it exists. If a router is so old that the maker no longer releases updates, it is time to replace it. For key staff, some businesses simply buy a supported router and treat it as company equipment.
Use strong Wi-Fi encryption
Check that the Wi-Fi network uses WPA2 or, better, WPA3 encryption. Older settings such as WEP or an open network without a password are not acceptable for work. Use a long Wi-Fi passphrase, and if the router offers a guest network, put visitors and smart home gadgets on it so they are kept apart from the work laptop.
Pro tip
Do not ask staff to "secure their router" with no guidance. Send a short, illustrated guide for the most common router brands in your area, or offer a fifteen-minute video call where someone walks them through the admin page. People follow instructions they can see.
Layer two: secure the work device
The device is where the data actually lives. A well-protected laptop on a weak home network is still in a far better position than a neglected laptop on a perfect one.
Separate work and personal use
The cleanest option is a company-owned laptop used only for work. When that is not possible, for example with freelancers or staff who use their own phone for email, use managed work profiles. Both major mobile platforms and many device management tools let you keep work apps and data in a separate container that you can wipe without touching personal photos or messages.
Shared family computers are the weakest setup. Children install games and browser extensions, partners use the same login, and nobody knows what has been clicked. Make "no company data on shared family devices" a firm rule.
Turn on full-disk encryption
Laptops get left on trains and stolen from cars. Full-disk encryption keeps the data unreadable without the login. Windows offers BitLocker or device encryption on many editions, and Macs include FileVault. Phones encrypt their storage when a passcode is set. Check that encryption is actually on, not just available, and store recovery keys somewhere the business can reach them.
Automatic updates and endpoint protection
Turn on automatic updates for the operating system, browser and business apps. Keep built-in malware protection active, or use endpoint protection with a central dashboard so you can see which devices are up to date without asking each person.
Screen lock, every time
Set devices to lock after a few minutes of inactivity and require a password, PIN or biometric to unlock. Teach the habit of locking the screen whenever you step away, even at home. A screen left open on a kitchen table is visible to visitors, delivery drivers and anyone on the other side of a video call.
| Setting | Company-owned laptop | Personal device (BYOD) |
|---|---|---|
| Full-disk encryption | Required, enforced centrally | Required before work data is allowed |
| Automatic updates | Enforced by device management | Required, checked periodically |
| Work data location | Anywhere on the device | Only inside a managed work profile or app |
| Remote wipe | Whole device | Work profile only |
| Screen lock | Enforced after a short idle time | Required, with a passcode |
Common mistake
Letting staff save company files to a personal laptop "just for the weekend." Those files end up in personal cloud backups and old download folders you will never find. Give people a proper way to work remotely so they are not tempted to work around you.
Layer three: connect safely to company systems
Remote workers need to reach email, files, accounting software and sometimes systems that sit in the office. How they connect matters as much as the device they use.
VPN or zero-trust access
A business VPN creates an encrypted tunnel between the worker's device and your company network, so traffic cannot be read on the way. It also means internal systems do not have to be exposed directly to the internet. Zero-trust access is a newer approach: instead of putting a device "inside" your network, it checks the user, the device and the request each time and grants access to one specific app at a time. Many small businesses that rely mostly on cloud apps use the security features of those apps, such as conditional access, together with a zero-trust or VPN product for anything still hosted in the office.
Whichever route you take, protect it with multi-factor authentication. A VPN login with only a password is a door with a cheap lock.
Business VPN
- Familiar and widely supported
- Good for reaching office file servers and older systems
- Encrypts traffic on untrusted networks
Things to watch
- A connected device may reach more of the network than it needs
- VPN appliances need prompt patching
- Zero-trust tools can limit access more precisely, app by app
Keep files in managed cloud storage
Store work files in a business cloud service with sharing controls and version history, not on the device's desktop. If a laptop is lost, the files are safe, and if ransomware strikes, version history and proper backups help you recover. Restrict sharing links so documents are not left open to "anyone with the link."
Public Wi-Fi: avoid it for sensitive work
Hotel, airport and cafe Wi-Fi is convenient, but you do not know who runs it or who else is connected. Fake hotspots with believable names also exist. Set a simple rule: no payroll, banking or customer data on public Wi-Fi. If someone must work from a cafe, they should connect through the company VPN, or use their phone as a personal hotspot instead.
Example
Imagine Priya, a bookkeeper at a small firm, is waiting for a delayed train and needs to approve a supplier payment. The station Wi-Fi is free, but the company rule says no banking on public networks. She switches on her phone's hotspot, connects her encrypted work laptop to it, signs in with MFA and approves the payment. It takes two extra minutes and removes the unknown network from the picture entirely.
Layer four: habits that keep it working
Technology covers most of the risk, but remote workers also face problems the office protected them from without anyone noticing.
- Physical privacy: position screens away from windows and shared spaces, and use headphones for confidential calls. Lock the laptop away when the house has visitors.
- Printing and paper: avoid printing customer data at home. If you must, shred it rather than putting it in household recycling.
- Smart speakers and cameras: keep confidential conversations away from devices that listen for wake words, or mute them during sensitive calls.
- Reporting: remote workers cannot lean over to a colleague and ask "does this email look odd?" Give them a quick channel, such as a dedicated chat thread, to report suspicious messages and lost devices immediately.
- Lost or stolen devices: make it clear that people should report a lost laptop or phone the same day so you can lock or wipe it. Reassure them that reporting fast matters far more than the loss itself.
Roll out the baseline in a week
You do not need a large project to bring remote workers up to standard. A small business can usually set the baseline in a week.
- Write a one-page remote work security policy. List the minimum rules: router password changed, WPA2 or WPA3 Wi-Fi, encrypted work device, automatic updates, screen lock, VPN or zero-trust access, no sensitive work on public Wi-Fi, report losses the same day.
- Inventory devices. Note who uses which laptop and phone for work, who owns it and whether it is encrypted and updated.
- Set up device management where you can. Even a basic device management tool lets you enforce encryption, updates and screen locks and wipe a lost device.
- Turn on MFA for remote access. Cover email, cloud storage, the VPN or zero-trust tool and any admin consoles.
- Run a short home network session. Walk staff through their router settings on a call and collect a simple confirmation that each item is done.
- Review every quarter. Check the device list, remove access for anyone who has left and confirm updates are still being applied.
If you are in the UK, the NCSC publishes free guidance for small organizations on home working and device security, and in the US, CISA offers free resources for small businesses. Both are worth a look when you write your own one-page policy.
Remote worker security checklist
- Router admin password changed from the default
- Router firmware up to date, or automatic updates switched on
- Home Wi-Fi uses WPA2 or WPA3 with a strong passphrase
- Guest network used for visitors and smart home devices
- Work done on a company device or a managed work profile
- Full-disk encryption on, with recovery keys stored by the business
- Automatic updates and malware protection active
- Screen locks after a short idle period
- VPN or zero-trust access, protected by MFA
- Files kept in managed cloud storage, not on the desktop
- No sensitive work on public Wi-Fi without a VPN or hotspot
- A fast way to report lost devices and suspicious messages
Frequently asked questions
Do remote workers need a VPN if all our apps are in the cloud?
Not always. If everything runs in well-secured cloud apps with MFA and device checks, a traditional VPN may add little. A VPN or zero-trust tool is still useful for anything hosted in the office and for protecting traffic on untrusted networks such as public Wi-Fi.
Can I make staff change settings on their own home router?
You can set it as a condition of remote work and provide help, but it is their equipment. For roles that handle sensitive data, many businesses supply a company router or rely on the VPN and device controls so the home network matters less.
Is it safe to let freelancers use their own laptops?
It can be, if you limit what they reach. Give them access only to the apps and folders they need, require MFA and ask them to confirm their device is encrypted and updated. Remove their access the day the project ends.
What should someone do if their work laptop is stolen?
Report it to the business immediately so you can lock or wipe it and sign it out of company accounts. Then report the theft to the police. If the device held personal data and was not encrypted, you may also need to consider your data protection duties.
Related reading
The bottom line
Securing remote workers comes down to four layers: a router that is updated and properly locked, a work device that is encrypted and managed, a protected route back to company systems and habits that keep data private at home and on the move. Put the baseline on one page, help staff meet it, and check it every quarter. Remote work then stops being a gap in your defenses and becomes just another place your team gets things done safely.
