Recommended Free Tools
Start with four changes: protect every UniFi administrator account with multi-factor authentication, choose a Wi-Fi security mode that your clients actually support, place guest and IoT equipment on separate networks with Network Isolation, and keep the UniFi applications and devices updated. Then verify which traffic your firewall, switch and access-point isolation controls really block. The exact menus and available features depend on your UniFi Network version, gateway and switch model.
1. Protect the UniFi administrator account before changing anything else
An attacker who gains the UniFi UI Account can alter SSIDs, create accounts, change firewall rules and adopt devices. Secure that account first, then review who else has administrative access.
As an Amazon Associate I earn from qualifying purchases.
Enable multi-factor authentication
- Sign in to your UniFi UI Account.
- Open the account or security settings and enable multi-factor authentication (MFA).
- Enroll an app that generates one-time passcodes, or a hardware security token if the account interface offers and supports it.
- Store recovery codes offline and test a second sign-in before removing your old method.
Ubiquiti documents app-based one-time passcodes and hardware tokens as MFA options. The documentation does not establish compatibility for a particular token model or standard, so verify that your UI Account accepts the token before purchasing one.
Free tools Windows power users keep installed
One-click scans. No signup required.
Reduce administrator privileges
Use role-based permissions so each person has only the access needed for their job. Keep full owner or super-administrator rights for one or two trusted accounts; give a family member or installer a narrower role when they only need to view status or perform limited changes. Remove accounts that are no longer used and review the permission list after an installation or support session.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review activity logs
Keep system and administrator activity logs available. A sign-in from an unfamiliar time, a newly created administrator, an SSID change or an unexpected firmware update is a reason to rotate credentials and investigate immediately. Logs are useful only if their retention and time settings are correct, so confirm that the console has the right date, time zone and network connectivity.
2. Choose Wi-Fi encryption that balances security and compatibility
In UniFi Network, wireless settings are under Settings > WiFi. Change one SSID at a time and check the actual client list first. Phones and laptops may support WPA3 while older printers, cameras, plugs and embedded controllers may not.
| Mode | Security result | Compatibility consequence | When to use it |
|---|---|---|---|
| WPA2/WPA3 mixed | Allows modern WPA3 clients while retaining WPA2 protection. | Usually the broadest compatibility, but a badly behaved legacy client can still fail to join. | Best starting point for a mixed household fleet. |
| WPA3-only | Requires WPA3-capable clients and modern protection. | Older clients and some IoT devices cannot connect. | Use on a dedicated SSID after confirming every client supports it. |
| WPA2-only | Maintains older-client support. | Does not require WPA3; newer clients lose the benefits of WPA3 on that SSID. | Legacy IoT equipment, older hardware or compatibility cases. |
| OWE | Encrypts an otherwise open guest network without a shared password. | Only clients that support OWE can use the protected association; it still needs network isolation. | Open-style guest access where compatible clients are expected. |
Ubiquiti recommends WPA2/WPA3 mixed mode for many environments. WPA2-only may be necessary for older IoT devices or some PPSK deployments. WPA3-only is stricter and can strand clients, so create a separate modern SSID rather than breaking a working household network without a migration plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep Protected Management Frames enabled
Protected Management Frames (PMF) help prevent forged management traffic. Optional enables PMF for clients that support it while preserving compatibility with clients that do not. Required enforces PMF for every client and is stronger, but older clients may be rejected. WPA3-only and OWE require PMF.
Ubiquiti states: “PMF is essential for securing modern networks, but disabling it should only be considered in cases where specific clients can’t connect otherwise.” If a device fails after enabling PMF, test PMF Optional on that SSID, update the device firmware, or move the device to a dedicated legacy IoT SSID. Disabling PMF globally should be the last resort.
Rank #2
- Standard OATH compliant TOTP token (time based)
- 6-digit OTP code with countdown time bar
- Zero footprint: no need for the end user to install any software
- Secure, sturdy, and long-life hardware design
- Easy to use - Portable key chain design. These tokens will only work with Symantec VIP Access. These tokens will not work for any other Multi-Factor Authentication services, besides Symantec VIP Access.
Leave group rekey at its default unless you have a specific reason
Group rekeying refreshes the key used for broadcast and multicast traffic. Changing the interval without a documented interoperability or policy requirement can trigger unnecessary reconnects and does not substitute for segmentation, strong passwords or current firmware. Keep the UniFi default while troubleshooting client compatibility.
Do not treat a MAC allowlist as segmentation
MAC allowlists can provide simple admission control when devices use stable, non-randomized MAC addresses. Modern phones and operating systems may randomize their MAC address, making allowlists brittle. Ubiquiti points to PPSK as a more flexible way to assign devices or users; neither method replaces a separate guest or IoT network.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →3. Put guests and IoT devices on separate networks
A password alone does not stop a compromised camera, television or visitor laptop from reaching trusted computers on the same LAN. Create separate networks (and VLANs where your gateway and switching design support them) for at least:
- Trusted: personal computers, phones, storage and management devices.
- IoT: cameras, speakers, appliances and other devices that need internet access but rarely need to initiate connections to trusted clients.
- Guest: visitors’ devices, with internet access and no route to internal networks.
Enable Network Isolation
- Open the network settings for the guest or IoT network.
- Enable Network Isolation and save the change.
- Reconnect a test client and verify that it can reach the internet but cannot reach a trusted device or management interface.
Ubiquiti describes Network Isolation as automatically configuring firewall rules to block inter-VLAN traffic. Its guest Wi-Fi guidance recommends the same control for a guest VLAN. The label and location can vary by UniFi Network release, so use the network’s current settings panel rather than assuming every console has identical menus.
Isolation is directional at the network boundary: it blocks traffic between networks. It does not automatically stop two devices that remain on the same VLAN from communicating with each other. A smart television and an IoT camera on one IoT VLAN may still exchange local traffic unless you add a control designed for same-network clients.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Pick the isolation layer that matches the traffic you need to block
| Control | Blocks | Does not automatically block | Availability notes |
|---|---|---|---|
| Gateway firewall or zone policy | Routed traffic between networks or security zones. | Client-to-client traffic that never crosses the gateway. | Zone-Based Firewall requirements include UniFi Network 9.0 or newer and a supported gateway version; exact support is hardware dependent. |
| Switch ACL | Selected traffic between devices within a VLAN on supported switches. | Features unavailable on the particular switch or traffic outside the ACL scope. | Ubiquiti lists model-specific exceptions; check the switch documentation before designing around an ACL. |
| AP Client Isolation | Client-to-client communication through the same access point. | Traffic through another AP, a wired switch, or a routed network unless other controls also apply. | Use as an access-point layer, not as a replacement for VLAN and gateway policy. |
For a simple household that only needs guests and IoT blocked from trusted networks, Network Isolation is the lower-complexity choice. Add AP Client Isolation on a guest SSID when guests should not discover one another over Wi-Fi. Use switch ACLs only when your switch supports the required rules and you need same-VLAN control.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →5. Use zone-based firewall policies for deliberate exceptions
Network Isolation is intentionally broad. A custom zone-based policy is appropriate when one service must cross the boundary—for example, allowing a trusted phone to reach a specific IoT controller while denying every other trusted-to-IoT connection. Define the smallest source, destination, protocol and port scope that works, then test both the permitted and denied paths.
Check version and gateway requirements
Ubiquiti’s Zone-Based Firewalls documentation lists UniFi Network 9.0 or newer and Gateway 4.1 or newer among the requirements. The feature was documented with the UniFi Network 9.0.108 Official Release, but that does not mean every gateway or later release exposes the same controls. UniFi Network 9.3 and 9.4 documentation shows different menu paths. Confirm support for your console and gateway before planning a migration around zones.
Build rules in a safe order
- Write down the networks or zones involved and the exact service that must pass.
- Create a narrow allow rule for that source, destination, protocol and port.
- Place the broader deny rule after the allow rule if the interface evaluates policies in order.
- Apply the policy during a maintenance window and keep an existing administrator session open.
- Test the approved service, an unrelated service and access to the gateway management interface.
Keep a recovery path: a local administrator account, console access where available, or a documented rollback of the last policy. A rule that blocks DNS, DHCP or management traffic can make a network appear offline even when the gateway itself is healthy.
Application filtering is a supplemental control
UniFi provides simple application blocking and more granular application filtering through zone-based policies. Treat filtering as targeted policy enforcement, not as a replacement for separate networks. An application category can change, use alternate domains or be encrypted; segmentation still limits what a compromised device can reach.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Keep the controller, gateway, switches and access points current
Updates close defects and security weaknesses, but an update can also change behavior or require a reboot. UniFi’s Update Manager centralizes update review and lets administrators select a release channel and configure automatic updates.
Choose a release channel deliberately
The documented channels include Official and Early Access. Official is the conservative choice for a home that values predictable operation. Early Access can expose newer fixes and features sooner, but it carries greater change risk. Do not assume a build is current from its number alone; check the release notes shown for your console and device.
Choose automatic, scheduled or manual updates
| Strategy | Advantage | Trade-off |
|---|---|---|
| Automatic | Applies approved updates with little maintenance. | A reboot or behavior change may occur when nobody is watching. |
| Scheduled | Places reboots in a chosen maintenance window. | Requires a reliable schedule and awareness of devices that must stay online. |
| Manual | Maximum control over testing and timing. | Easy to postpone indefinitely and miss a security fix. |
Update options may be in the associated UniFi application settings rather than on the device page. Review the console, gateway, switch and AP update states separately; updating the controller does not necessarily update every adopted device. Before a scheduled update, export or otherwise preserve a known-good configuration, confirm remote access is not your only recovery path, and plan for brief service interruption.
7. A practical verification checklist
After changing settings, test from each network instead of trusting the labels.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Sign in with MFA and confirm that only intended administrator accounts remain.
- From a guest client, verify internet access and failure to reach trusted hosts and UniFi management pages.
- From an IoT client, verify required cloud access while testing that it cannot initiate connections to trusted computers.
- From two guest clients on the same AP, test whether AP Client Isolation prevents peer communication.
- If same-VLAN isolation is required, test the switch ACL with both allowed and denied traffic.
- On each SSID, reconnect an older device and a current device after changing WPA, PMF or OWE settings.
- Check that DHCP, DNS, casting, printing and any explicitly allowed local service still work.
- Review the activity log for the configuration change and confirm the intended update channel and schedule.
8. Troubleshoot common breakage without weakening the whole network
An IoT device will not connect after a Wi-Fi change
Confirm whether it supports WPA3, PMF and the selected band. Try WPA2-only with PMF Optional on a dedicated IoT SSID, update its firmware, and avoid changing the trusted SSID merely to accommodate one legacy device.
Best Value
- OTP token that provides secure remote access with strong authentication
- Easy to use and easy to carry
- Expected battery life is approximately 7 years
Guests can still see one another
Network Isolation blocks inter-network traffic, not necessarily client-to-client traffic on one VLAN. Enable AP Client Isolation for wireless peers and investigate switch ACL support if wired guest devices also need separation.
A local service stopped working after isolation
Identify the exact source and destination, then add a narrow zone-policy exception if the service is necessary. Do not disable Network Isolation globally just to restore broad access. Remember that discovery protocols often need additional, carefully scoped allowances.
You lost access after a firewall or ACL change
Use the remaining local session or console path to disable the last rule, then reapply it with narrower criteria. Keep an out-of-band or local recovery method before making policy changes remotely.
9. Suggested order for a weekend hardening pass
- Enable MFA, remove unused administrators and confirm logs.
- Inventory clients on every SSID and record legacy devices.
- Set WPA2/WPA3 mixed mode and PMF Optional where compatibility is uncertain; reserve WPA3-only for verified modern clients.
- Create guest and IoT networks, enable Network Isolation and test access.
- Add AP Client Isolation or supported switch ACLs where same-network communication must be restricted.
- Use zone-based policies only for documented exceptions and verify version and gateway requirements.
- Select an update channel and automatic, scheduled or manual behavior, then apply updates during a recovery window.
This sequence limits avoidable exposure first, preserves a way back when a client fails, and makes every exception explicit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
