Quick Answer
Router security combines access control, maintained firmware and careful network separation. Start with distinct, strong administrator and Wi-Fi passwords, supported WPA3 Personal or WPA2-AES encryption, and updates for your exact router model. Review guest-network isolation and unnecessary remote access separately; no setting guarantees that every connected device is safe.
Your router is the device every gadget in your home relies on to reach the internet, so weaknesses affect everything connected to it. Work through the settings below in order to make your router much harder to break into.
Start with Router Access and Wi-Fi Protection
Your router has two separate logins to secure: the admin account that controls its settings, and the Wi-Fi password your devices use to connect. Change both from their factory defaults before moving on.
How Do You Find and Open Your Router Settings?
Most routers are managed through a web page. To open it, type an IP address, commonly 192.168.1.1 or 192.168.0.1, into your browser. Your router’s default login details and IP address are usually printed on a sticker on the device. Many newer routers, and most models supplied by internet providers, also offer a companion app with access to the same settings.
If neither the sticker nor the app works, check the manufacturer’s support site for your exact model number.
Change the Router Password and Wi-Fi Password
Change any shared factory administrator credential before relying on the router’s other settings. Some routers already have a unique password or require one at first setup; keep that credential private and different from the Wi-Fi password. Use the genuine management address or app documented for the exact model, rather than a login link from an unsolicited message.
- Log in to your router’s admin panel.
- Find the administration or system settings menu.
- Replace the default admin password with a long, unique one not used anywhere else.
- Separately, go to the wireless or Wi-Fi settings and set a new Wi-Fi password.
Use a long, unique Wi-Fi passphrase that your devices support. A password manager can store the administrator credential and recovery information. Keep a protected copy available without depending on the network or account that a configuration error might lock you out of.
Changing the Wi-Fi password disconnects every device until you enter it again. Have your phone or laptop nearby so you can reconnect straight afterwards.
Choose WPA3 or WPA2 AES Encryption
Prefer WPA3 Personal where the router and clients support it; otherwise use WPA2 with AES. Check the actual security mode, since a label containing WPA2 can include legacy compatibility options. Avoid WEP, original WPA and TKIP. Consult the exact model’s instructions before changing a mixed mode needed by older devices.
You’ll find this setting alongside your Wi-Fi password, usually under a “Security” or “Security Mode” dropdown in the wireless settings.
Rename Your Wi-Fi Network Without Relying on a Hidden SSID
Change your default SSID. Factory network names can reveal your router’s make or model to anyone nearby, which may point an attacker towards known weaknesses in that hardware. Choose a name that doesn’t include your address, family name or other identifying details.
A hidden network name is not a substitute for encryption or a strong password. Use a non-identifying name, but do not assume that hiding it prevents someone from finding the wireless network.
Keep the Router Updated and Limit Unnecessary Access
Firmware updates and a few disabled features close off remote attack paths that don’t need your Wi-Fi password. The settings address different paths: internet-facing management, local configuration and requests from connected devices.
Check for Firmware Updates and Enable Automatic Updates
Router firmware is the software that runs the device. Manufacturers release updates to patch discovered security flaws. Check whether automatic security updates are available and enabled for your model; some ISP-managed equipment is updated by the provider.
- Open the admin panel and look for a section labelled System, Administration or Firmware Update.
- Check whether an automatic update option exists and turn it on.
- If your router only supports manual updates, check the manufacturer’s support page for your model and download the latest version directly from there, never from a third-party site.
Support lifetime varies by model, hardware revision, region and provider. Check the manufacturer’s explicit support or end-of-life information and your ISP’s update policy. Working internet access is not evidence that security fixes are still being supplied.
Disable WPS Unless You Have a Specific Need for It
Wi-Fi Protected Setup lets you connect a device by pressing a button or entering a short PIN instead of typing your full Wi-Fi password. The PIN method is vulnerable to brute-force attacks, which can let someone nearby force their way onto your network despite your encryption settings, a risk that makes disabling unused WPS preferable.
Turn WPS off in the wireless settings unless a specific device you own has no other way to connect. New devices will then need the full Wi-Fi password, a minor inconvenience compared with the gap in protection.
Review UPnP and Any Ports It Has Opened
Universal Plug and Play automatically lets apps and devices on your network open ports on your router without asking you first. This is convenient for things like game consoles and smart TVs, but malware already on your network can exploit the feature to reconfigure your router or reach devices it shouldn’t, depending on the router and enabled services.
Disable UPnP when it is not needed, and check whether that affects a legitimate household service. Do not automatically replace it with broad manual port forwarding: an exposed service still needs its own security and maintenance. Ask the provider or a trusted administrator before creating an internet-facing rule.
Turn Off Internet-Facing Remote Management
Remote management lets you log in to your router’s admin panel over the internet, from outside your home network, rather than only from a device connected to your Wi-Fi. Unless you specifically need to change router settings while away from home, keep this feature off. It gives attackers another way to reach your admin login without first being on your network.
Look for “Remote Access,” “Remote Administration” or “Remote Management” in the admin settings and confirm it’s disabled. It’s off by default on most routers, but check rather than assume; the FTC recommends disabling remote management when it is not needed.
Separate Guests and Check Connected Devices
A correctly separated guest network can reduce access from visitors and smart devices to personal computers. Check its actual access rules rather than relying on a different network name.
Set Up Guest Wi-Fi with Its Own Password
A guest network is a second SSID your router broadcasts alongside your main one. It can provide internet access separately from the primary network, subject to the router’s isolation settings. Availability and behaviour vary by model and provider.
- Open your router’s wireless settings and look for a Guest Network option.
- Turn it on and give it a distinct name, separate from your main SSID.
- Set a strong, unique password, different from your main Wi-Fi password.
- Save the settings and connect a test device to confirm it works.
Consider a guest or IoT network for devices that need internet access without access to personal computers. Confirm how the router separates that network from the main LAN and management interface. Some smart-home functions require local discovery, so test the intended service before relying on the separation.
Check Whether Guest and Smart Devices Can Reach Your Main Network
Read the model’s definitions of guest access, access to local network and client isolation. Client isolation can separate guests from one another, while blocking access to the main LAN is a different boundary. A second SSID alone proves neither.
From a guest device you control, check whether the main-network resources and router management interface that should be blocked are reachable. A failed discovery list alone is not proof of isolation: use the router’s documentation and a controlled access check. Do not disable security features merely to make casting or printing work.
Review the Device List and Router Firewall
Check your router’s connected devices list, sometimes labelled “wireless clients” or “DHCP clients”, and confirm you recognise everything on it. The Federal Trade Commission recommends this as a standard check once your router itself is secured, in its guidance on securing internet-connected devices.
Review the router’s firewall status using its documented settings. If an entry in the device list is unfamiliar, identify it before assuming an intrusion; private or randomised device addresses and generic names can be misleading. Block an unauthorised device and change affected credentials when there is a credible access problem.
Understand What Parental Controls, MAC Filtering and a VPN Can Do
Parental controls built into many routers let you manage screen time and filter content by device or profile. If your family needs more control over what children can access, consider dedicated options, such as this comparison of routers with built-in parental controls or guidance on setting up parental controls on your Wi-Fi.
MAC address filtering restricts network access to a list of approved device addresses. It sounds useful, but anyone with the skill to spoof an allowed address can bypass it, so don’t rely on it as a real security barrier, so treat it as an administrative aid rather than strong authentication.
A VPN protects traffic included in its tunnel between the VPN client and server. It does not repair unsupported router firmware or secure every local device automatically. HTTPS protects a separate browser-to-site connection. If you choose a VPN, follow our setup guide for its platform and traffic limits.
Check Your Changes and Know When to Replace the Router
Confirm your settings took effect and check whether your hardware has become the weak point. Settings alone cannot compensate for security flaws that the responsible provider no longer fixes.
Confirm Your Devices Reconnect with the Intended Security Settings
Changing Wi-Fi credentials or the security mode can disconnect devices and require reconnection. Check each device’s Wi-Fi settings screen to confirm it shows the new network name and that the connection is listed as secured, not open.
On most phones and laptops, tapping the connected network’s name shows the security type in use. Confirm it reads WPA3 or WPA2, not an older or unsecured type.
What Should You Do If You See an Unfamiliar Device?
First compare the entry with your own devices and their current network addresses. If it is unauthorised, use the router’s blocking controls and change the affected Wi-Fi password, then reconnect only approved devices. If administrator access may also be compromised, involve the ISP or manufacturer and review router settings, not just the client list.
Some unfamiliar-looking entries may be your own smart plugs, speakers or other IoT gadgets, listed under a generic manufacturer name. Check any device you’re unsure about against your own smart home app before assuming it’s a genuine intrusion.
When Is an Older Router No Longer Safe to Keep?
Plan to replace a router when the responsible manufacturer or ISP confirms that security support has ended, or when its available security modes no longer meet your needs. Do not infer a universal three-to-seven-year lifespan from the purchase date.
Compare the exact hardware revision and installed firmware with the official support information. A recent firmware release can be useful evidence, but the absence of an update in six months does not by itself prove abandonment. If maintenance status is unclear, ask the responsible provider before relying on the router for sensitive use.
A Safer Router Starts with a Few Maintained Settings
Securing a home router is not a one-time task. A strong Wi-Fi password, WPA3 or WPA2 encryption, current firmware, and WPS, UPnP and remote management switched off close the paths attackers use most often. A properly isolated guest network also keeps visitors and smart devices from reaching your personal files.
Revisit these settings periodically, especially after adding smart home devices or when your router notifies you of an update. If children use your network, you may also want to review parental control setup steps once the core router settings are in place.
Frequently Asked Questions
Does a second Wi-Fi name prove the guest network is isolated?
No. Check the router’s guest-to-main-network access rules and client-isolation settings separately. Confirm the intended boundary using the exact model’s instructions and a device you control.
Do the router administrator and Wi-Fi passwords do the same job?
No. The administrator password controls settings; the Wi-Fi password lets a device join the wireless network. Use different strong credentials and protect the administrator account.
Does a six-month gap between firmware updates prove support has ended?
No. Check the exact model, hardware revision, official support status and ISP update policy. A release date alone is not a universal test of ongoing support.
Should I factory-reset a router immediately after an unfamiliar device appears?
Identify the device and assess the problem first. A reset erases settings and may require ISP connection details. For credible administrator compromise, follow the responsible provider’s recovery instructions rather than treating a Wi-Fi password change as a complete repair.
Can a VPN replace router updates and network separation?
No. A VPN protects only included tunnel traffic. Router maintenance, local access controls, guest separation and device security address other risks.
Sources and Image Credits
Sources: FTC home Wi-Fi security guidance; FTC connected-device security. Menu names and isolation behaviour depend on the router model and firmware.
Illustrations: Impulsec.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.