You changed the security setting in your router's admin page from WPA2 to WPA3. Phones and recent laptops reconnect fine, but a printer, a home camera or a few-year-old tablet either cannot find the network or reports a wrong password. The password did not change.

The Wi-Fi Alliance security page states three conditions for WPA3 networks: “Use the latest security protocols”, “Disallow outdated legacy protocols”, and “Require use of Protected Management Frames (PMF)”. The last two are what breaks connections. The same page adds that “PMF is required for all new certified devices”.

1. Check when the failing device was made

What PMF is appears in the Wi-Fi Alliance article on Protected Management Frames. Built on the IEEE 802.11w amendment, it provides integrity protection for unicast and broadcast management frames, and “It is a fundamental component and therefore required to always be used for Wi-Fi CERTIFIED WPA3 and Wi-Fi CERTIFIED Enhanced Open networks.”

The same article gives a date: “As of July 2020, WPA3 will be mandatory for all Wi-Fi CERTIFIED devices. At this time, all certified devices will also support Protected Management Frames.” Devices certified after July 2020 support PMF; older ones are not guaranteed to. If the device that dropped off predates that, suspect its capability before you keep changing settings.

The article also sets out the three PMF settings a router can expose. Of Disable it says “It is not recommended to use this setting”, reserving it for clients that cannot do PMF and hit connection issues on Capable. Capable is where both kinds of client can connect: “This should be the default option for an encrypted Wi-Fi network based on WPA2.” Mandatory means “Only PMF-capable clients can connect to the network”, and “WPA3-Personal only mode and WPA3-Enterprise with 192-bit security mode activate this option as default.” Switching to WPA3-only turns PMF on as a requirement.

2. Move the security setting to transition mode

Apple's recommended settings for Wi-Fi routers and access points puts it plainly: “Set to WPA3 Personal for better security, or set to WPA2/WPA3 Transitional for compatibility with older devices.” It also explains the mode: “WPA2/WPA3 Transitional is a mixed mode that uses WPA3 Personal with devices that support that protocol, while allowing older devices to use WPA2 Personal (AES) instead.” On WPA3 Personal itself the document says “It works with all devices that support Wi-Fi 6 (802.11ax), and some older devices” — Wi-Fi 6 gear is covered, anything older varies by product. The same document also notes what to do after a change: “After changing settings, you might need to forget the network on each device that previously joined the network.”

3. Check whether you split the band names

Giving the 2.4 GHz band its own SSID for older gear is a common move. The same Apple document says the opposite: use one name across all bands, because “If you give your 2.4 GHz, 5 GHz, or 6 GHz bands different names, devices might not connect reliably to your network, to all routers on your network, or to all available bands of your routers.” On a router with 6 GHz, it adds that Apple devices supporting Wi-Fi 6E will flag a network with mismatched band names as having limited compatibility.

4. If you must step down, know how far

If transition mode still fails, what remains is WPA2 Personal (AES). Apple's document calls that “appropriate when you can't use one of the more secure modes” and says to pick AES as the cipher. It also lists settings to avoid: WPA/WPA2 mixed modes, WPA Personal, every WEP variant (WEP Open, WEP Shared, WEP Transitional, Dynamic WEP), anything with TKIP in the name, and turning security off. Stepping down to WPA2 and stepping down to WPA/WPA2 mixed are not the same move.

Some things these documents do not answer. None of the three names where a given manufacturer puts the PMF setting or what it calls it in the admin page; that belongs to the router maker's manual. Whether a specific printer or camera supports WPA3 is also not answerable from Wi-Fi Alliance material; that is in the product spec sheet or a firmware notice.