Security · Topic 5 of 5
Wireless Security with WPA, WPA2 and WPA3
Compare WPA, WPA2 and WPA3, choose between Personal and Enterprise modes, and follow the basic steps to secure the wireless network on a home router.
- 4 min
- The order from oldest and weakest to newest and strongest is WEP, WPA, WPA2, WPA3.
- WPA2 uses AES encryption and is widely used. WPA3 is the newest and uses SAE.
- Personal mode uses one shared passphrase. Enterprise mode uses individual accounts and a central server.
What it is
Wireless security protects the radio link between your devices and the access point.
Radio signals travel through walls, so anyone nearby can pick them up. Without protection, others could join your network or read your traffic.
WPA stands for Wi-Fi Protected Access. It is a family of standards that encrypt wireless traffic and control who may join. This page covers its three versions and the basic setup of a home router.
How it works
The access point and the client agree on a security mode, then use it to prove identity and encrypt the traffic.
The versions
| Version | Notes |
|---|---|
| WEP | The oldest scheme, with serious flaws. Do not use it |
| WPA | The first replacement for WEP. It is older and no longer recommended |
| WPA2 | Uses strong AES encryption. Very widely used |
| WPA3 | The newest. Stronger protection, including for weak passwords |
Each version improved on the last. WPA2 is still common and is considered acceptable when a strong passphrase is used. WPA3 is the best choice when all devices support it.
What WPA3 improves
WPA3 Personal replaces the old key exchange with one called SAE, which stands for simultaneous authentication of equals. It makes it much harder for an attacker who records the sign in to guess the passphrase offline.
Some routers offer a mixed mode, often shown as WPA2 and WPA3 together. This lets older devices join through WPA2 while newer ones use WPA3. The cost is that the network is only as strong as the oldest mode it allows.
Personal and Enterprise
| Mode | How users sign in | Typical place |
|---|---|---|
| Personal | Everyone uses the same shared passphrase | Homes and small offices |
| Enterprise | Each user signs in with their own account, checked by a central server | Companies, schools |
Enterprise mode uses a standard called 802.1X and an authentication server, commonly a RADIUS server. It is more work to set up, but each person has their own credentials. When a person leaves, one account is disabled, and nobody else needs a new passphrase.
With Personal mode, anyone who knows the passphrase can join. If it is leaked, it has to be changed on the router and on every device.
Securing a home router
These steps give a good basic setup.
- Change the default administrator password of the router.
- Choose WPA3, or WPA2 if older devices need it, and not WEP or open.
- Set a long, unique passphrase for the wireless network.
- Change the default network name, or SSID, so it does not reveal the router model.
- Keep the router software up to date.
- Turn off remote management from the internet unless it is needed.
- Use a separate guest network for visitors and smart devices.
Some routers offer WPS, a quick way to connect devices with a button or PIN. Its PIN method has known weaknesses, so many guides advise turning it off.
Other wireless security ideas
Hiding the SSID is not real protection, as the name can still be found. MAC address filtering is also weak, because addresses can be copied. They can be extra steps, but encryption and a strong passphrase matter most.
An open network with no password has no encryption. Public Wi-Fi is often open, so avoid sensitive tasks on it, or use a VPN.
What to remember for the exam
Seven facts cover most questions on this topic.
- The order from oldest and weakest to newest and strongest is WEP, WPA, WPA2, WPA3.
- WPA2 uses AES encryption and is widely used. WPA3 is the newest and uses SAE.
- Personal mode uses one shared passphrase. Enterprise mode uses individual accounts and a central server.
- Enterprise mode uses 802.1X and commonly a RADIUS server.
- On a home router, change the default admin password, use a strong passphrase and keep the software updated.
- Hiding the SSID and MAC filtering are weak protection.
- Open networks have no encryption.
For a home network, pick the newest mode that all your devices support, and use a long unique passphrase.
Common mistakes
These four errors appear again and again.
Leaving the default router password. Anyone who knows it can change the router settings.
Choosing WEP or open for an old device. Upgrade the device, or use a separate network for it.
Relying on a hidden SSID. It does not stop a determined person.
Picking Enterprise for a small home. It needs an authentication server, so Personal is the usual home choice.
A mixed mode network can be only as strong as its weakest allowed mode.
Check yourself
Work through these three questions.
Which is newer and stronger, WPA2 or WPA3?
WPA3 is newer and stronger.
What is the difference between Personal and Enterprise mode?
Personal mode uses one shared passphrase. Enterprise mode gives each user their own account, checked by a central server.
Which two steps help to secure a home router?
Change the default administrator password and set a long, unique passphrase on the wireless network.
Topic 5 of 5 in Security
Test yourself on Security
The full Cisco CCST 100-150 Networking question bank has 749 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.