A VPN moves trust; it does not remove it. Your ISP stops seeing which sites you visit, and the VPN provider starts. That is a good trade when you have a specific reason (your ISP sells browsing data, you are on a network you don't control, you need to appear in another country), and a poor one when you simply want to "be secure": almost all traffic is already encrypted by HTTPS, so a VPN adds little against the threats most people actually face. It does not make you anonymous, and it does not stop sites fingerprinting or tracking you once you have logged in. If you do use one, pay for it (free providers monetise your traffic) and pick one with an audited no-logs record such as Mullvad or IVPN. For genuine anonymity, use Tor instead.

If you configure your VPN on your router, firewall, or home server, then traffic from all devices will be encrypted and routed through it, without needing individual VPN apps.

When using a VPN, it is extremely important to exclusively use the DNS server of your VPN provider or secure service.

OpenVPN and WireGuard are open source, lightweight, and secure tunneling protocols. Avoid using PPTP or SSTP.

Use DNS-over-HTTPS which performs DNS resolution via the HTTPS protocol, encrypting data between you and your DNS resolver.

Typically they’re manufactured cheaply in bulk in China, with insecure propriety firmware that doesn't receive regular security updates.

It is possible for a malicious script in your web browser to exploit a cross-site scripting vulnerability, accessing known-vulnerable routers at their local IP address and tampering with them.

You should update your network name, choosing an SSID that does not identify you, include your flat number/address, and does not specify the device brand/model.

WiFi SSIDs are scanned, logged, and then published on various websites, which is a serious privacy concern for some.

Wi-Fi Protected Setup provides an easier method to connect, without entering a long WiFi password, but WPS introduces a series of major security issues.

Universal Plug and Play allows applications to automatically forward a port on your router, but it has a long history of serious security issues.

Do not grant access to your primary WiFi network to visitors, as it enables them to interact with other devices on the network.

Services like Telnet and SSH that provide command-line access to devices should never be exposed to the internet and should also be disabled on the local network unless they're actually needed.

Close any open ports on your router that are not needed. Open ports provide an easy entrance for hackers.

When protocols such as PING, Telnet, SSH, UPnP, and HNAP etc are enabled, they allow your router to be probed from anywhere in the world.

You should treat your router's admin panel with the utmost care, as considerable damage can be caused if an attacker is able to gain access.

It's common to want to pump your router's range to the max, but if you reside in a smaller flat, your attack surface is increased when your WiFi network can be picked up across the street.