Mayank's answer had the most important part right: use WPA2 (not WEP and not no-password). However, I want to add some points.
You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase. Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way. (And some devices will even by default store your wifi passwords in the cloud for you!) I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy (also see discussion here). Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.
MAC address filtering is trivial to bypass and annoying to manage. MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver. Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers. Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address. (Yes, two different computers using the same MAC address at the same time would cause problems, but you can wait until they no longer are using it.) Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device). People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.
Disabling SSID broadcast leads to a loss of features for no concrete gain in security. Your mobile devices will not be able to automatically connect to the wifi network. Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me. (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2). Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.
Make sure WPS (Wifi Protected Setup) is disabled. Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses. Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).
As an aside, for a tad bit of extra security, I'd suggest changing your access point's SSID from the default (e.g., linksys / NETGEAR) to something uncommon. The access point is used as the salt of the PMK (pairwise master key) in WPA2-PSK before it goes through the HMAC, hence an attacker who has observed a four-way handshake and has attacked a similar network previously can potentially save themselves some time by storing the PMKs from various common passwords with the known salt (granted they'll still have to find the PMK that generates the PTK to match the observed 4-way handshake).
TL;DR - Use WPA2 with a strong passphrase, disable WPS on your router (and change your SSID to not be something super common). If you want you can use MAC address filtering or disable SSID broadcast, though any patient eavesdropper can easily bypass either protection.