Your router is the single device standing between your entire home network and the internet. Yet most people never change a single setting after plugging it in — leaving default passwords, outdated firmware, and open doors that attackers know how to find. Here’s what to change, in priority order.
Why Your Router Is a Target
Every device in your home — phones, laptops, smart TVs, cameras — funnels through the router. Compromise the router and an attacker can intercept traffic, redirect you to fake banking sites (DNS hijacking), or quietly add your network to a botnet. Router attacks are often silent: everything keeps working while someone else watches. A few minutes of configuration closes the most exploited holes.
Settings to Change Now
- Change the admin password. Routers ship with defaults like admin/admin printed in the manual — and in every attacker’s wordlist. Log into your router’s admin panel (usually at an address like 192.168.1.1) and set a strong, unique password immediately.
- Update the firmware. Router firmware patches fix critical vulnerabilities. Check for updates in the admin panel now, then enable automatic updates if your router supports them. If your router is so old the manufacturer stopped releasing updates, replace it.
- Use WPA3 (or WPA2-AES) encryption. In wireless settings, set security to WPA3-Personal if available, otherwise WPA2-AES. Never use WEP or WPA — both are broken and crackable in minutes.
- Set a strong Wi-Fi password. Use a long passphrase (20+ characters). This is the key that keeps neighbors and drive-by attackers off your network — see our home Wi-Fi guide for the full walkthrough.
- Disable WPS. Wi-Fi Protected Setup (the push-button or PIN pairing feature) has a well-known brute-force flaw. Turn it off in wireless settings and pair devices with the password instead.
- Turn off remote administration. “Remote management” or “WAN access” lets anyone on the internet reach your router’s login page. Unless you have a specific reason, disable it — manage the router only from inside your home.
- Disable UPnP (or review it). Universal Plug and Play lets devices open ports automatically — convenient, but malware abuses it to punch holes in your firewall. Gamers and some apps need it; everyone else should turn it off.
- Change the default network name (SSID). An SSID like “NETGEAR-5G” tells attackers your router’s make and model — and its known vulnerabilities. Pick a neutral name that doesn’t identify you or the hardware.
- Enable the guest network for visitors and IoT. Most routers offer a guest network — use it for visitors’ phones and for smart-home gadgets, keeping them isolated from your computers and NAS (more in our IoT security guide).
- Review connected devices monthly. The admin panel shows every device on your network. An unfamiliar device is worth investigating immediately.
Advanced (Worth Doing)
- Switch to trusted DNS. Consider a reputable DNS provider with malware filtering instead of your ISP’s default — it can block known malicious domains network-wide.
- Disable unused services. Telnet, FTP servers, and media servers running on the router are extra attack surface. If you don’t use them, turn them off.
- Reboot occasionally. A monthly reboot clears certain types of router malware that live only in memory.
When to Replace Your Router
If your router no longer receives firmware updates, lacks WPA2/WPA3, or is more than about five years old, no settings tweak fully protects it. Modern routers also bring meaningful security upgrades: automatic updates, WPA3, and better guest-network isolation. It’s one of the highest-value security purchases a household can make.
Your ISP’s Router: Use It Wisely
Many people use the router their internet provider supplied — and that’s fine, as long as you treat it like any other router: change the admin password, update the firmware, and disable remote management. ISP routers sometimes have one extra quirk: the provider may retain remote management access for support purposes. Look for settings like “remote assistance” or TR-069 management and disable what you don’t need, or ask your ISP directly what access they retain.
One caution: some ISP-supplied routers broadcast a public hotspot from your connection — often opt-out, buried in your ISP account settings. That hotspot is isolated from your network, but if the idea bothers you, log into your ISP account and turn it off. And if your provider’s router is old, locked down, or missing basic security features, consider putting it in bridge mode and running your own modern router behind it — you get full control over security settings without fighting the provider’s firmware.
Whatever hardware you use, write down what you changed: the admin password, the Wi-Fi password, and the key settings. A simple note saves hours when you need to troubleshoot, reset, or replace the unit later — and store it somewhere safe, not on a sticky note attached to the router itself.
The Bottom Line
Router security isn’t complicated — it’s just neglected. Change the defaults, update the firmware, use strong encryption, and isolate guests and gadgets. Thirty minutes today protects every device in your home for years.
About the Author
