AP Hardening Checklist
One-page AP hardening — firmware, admin, crypto, segmentation for YOUR lab AP.
Visual · t15_ap_hardening
Harden AP before red labs touch it. Original Cyberlium.
Your lab AP should model what production should look like.
Checklist for $LAB_SSID AP: change default admin password, disable WPS, disable remote admin from WAN, latest firmware, WPA3 or WPA2 with strong PSK, PMF enabled, unique SSID not cloned from bank names, management VLAN separated from client LAN, guest network isolated if used. Use checklist during defense lab — not as prep to attack neighbors.
1. Admin and firmware
Non-default creds, HTTPS admin only on LAN, auto-update or scheduled firmware.
Disable WPS PIN — WPS attacks are historical lesson, not neighbor sport.
Command guide
Try these commands — Admin and firmware
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AP hardening checklist — https://www.wi-fi.org/discover-wi-fi/security CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager sudo apt install nmap
macOS: Use airport / System Settings
Command — copy this
brew install nmap
Windows: Use netsh wlan (built-in)
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
nmcli device show 2>/dev/null | grep -iE 'GENERAL.HWADDR|IP4.ADDRESS' | head -5 nmap -sn 192.168.1.0/24 2>/dev/null | grep -i 'Nmap scan' | head -3 || echo 'Inventory YOUR lab LAN gear only'
Primary tools to practice this lesson: nmcli, nmap. Reference sites: AP hardening checklist (https://www.wi-fi.org/discover-wi-fi/security); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Crypto and SSID
WPA3-SAE or long random WPA2 PSK; PMF required/ capable.
Avoid SSID names impersonating banks or corp portals.
3. Segmentation
Lab client VLAN vs management; firewall between lab and home LAN.
Log association and deauth events if AP supports it.
4. What you ship: AP hardening checklist
Admin + crypto + segmentation checklist for $LAB_SSID.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Leave default admin/password on lab AP 'because it's isolated.'
- Right: Checklist written. Next: defense lab.
Mission: AP hardening checklist
1) Admin/firmware section. 2) Crypto/PMF section. 3) Segmentation/logging section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “WPS still on consumer APs?”
APPLY: WPS on AP should be:
APPLY: True or False: Default admin password is OK on lab AP.
APPLY: PMF belongs on: