Your router is the single most-attacked device you own, and almost nobody configures it. Effective router security takes about twenty minutes once, then ten minutes a quarter.

It is the front door to everything: every laptop, every phone, every camera, every smart device, and the connection to your bank. It is also usually the oldest computer in the building, running firmware from the manufacturer with an interface nobody has looked at since it came out of the box.

The good news is that router security is about twenty minutes of work, costs nothing, and permanently removes the most common class of home network attack. The FTC’s guidance on securing your home Wi-Fi is the reference, and it is worth noting that almost nobody completes it.

Do This First: The Four Things Everyone Skips

Before anything else, these four changes cover the large majority of real risk:

1. Change the administrator password. Not the Wi-Fi password — the admin account. It is factory-set, identical on every unit of that model, and published online.
2. Update the firmware. Routers are among the most exploited devices in the world, and vendors patch for years after sale.
3. Use WPA3 or WPA2-AES encryption. Disable WEP entirely. It has been broken for decades.
4. Disable remote administration from the internet. This is a single checkbox and it closes a large number of attack paths.

Do those four and you are ahead of the overwhelming majority of home users. Everything below is refinement.

1. The Admin Account: The Most Commonly Forgotten Password

Almost nobody changes this, and it is the most valuable credential in your home.

Your router has two separate password systems. The Wi-Fi password is what devices use to join the network. The admin password is what you use to log into the router’s control panel. They are completely different things, and people consistently change only the first.

So the router sitting in your home has a default admin password that anyone can look up from the model number. The practical consequences:

• Someone on your network, or anyone who has briefly been on it, can reconfigure the router completely
• DNS settings can be changed to silently redirect your browsing
• Port forwarding can be added, exposing internal devices to the internet
• Parental controls, firmware and wireless settings can all be disabled

Change it. Make it long and unique. Write it in the same password manager holding your other credentials rather than on a sticker on the router.

2. Firmware: The Job You Will Never Do If You Do Not Do It Now

Router firmware is updated far more often than any other device you own, and almost never automatically.

Set a recurring reminder — quarterly is reasonable — to log into the admin panel and check for updates. This is worth doing properly because routers are a favoured target: they are internet-facing, rarely patched promptly, and often configured with no security awareness at all.

Two related points worth knowing:

• Replace routers that are out of support. Consumer router vendors typically provide security updates for a limited window. Once that ends, the device is permanently exposed. Modern routers also lose processing headroom over time, which matters if you want features like parental controls or VPN support.
• Note the support end date when you buy. It is the number that determines when you replace it, and it is easier to record at purchase than to research in five years.

3. Encryption: WPA3, and Get WPS Off

Wireless encryption has three settings worth understanding, and one legacy feature that should be off.

Setting	Status	Action
WPA3	Current standard	Use if your devices support it
WPA2-AES	Still acceptable	Use if WPA3 is unavailable
WPA2-TKIP	Weak	Disable
WEP	Broken	Disable
WPS	Design-insecure	Disable

Disable WPS. Wi-Fi Protected Setup was designed to let a phone join a network by pressing a button. The mechanism it uses to do that is fundamentally insecure, and a long series of practical attacks have exploited it. There is no scenario where enabling WPS is worth the risk — the normal password join process is barely longer.

One related setting: disable SSID broadcast only if you have a reason. Hiding the network name adds no meaningful security and makes your devices noisier, because they then have to probe for it constantly. It is security theatre; skip it.

4. Guest Network: The Highest-Value Feature Nobody Uses

This is the most useful control on the entire router, and it is buried in a submenu most people never open.

Create a guest network on the same router, and put your IoT devices on it: cameras, TV, smart speakers, printers, plugs, the smart meter, the inverter monitoring interface. Your own laptop, phone and tablet stay on the main network.

The guest network is normally isolated by the router itself, meaning a compromised smart TV cannot reach your laptop at all. This is a real hardware-level boundary, not a software rule that malware can work around. It is the single most effective thing you can do to limit the blast radius of a vulnerable device, and it takes about two minutes.

You do not need to understand VLANs or configure anything advanced — the isolation is built in. We covered the same reasoning from the device side in IoT security for inverters and smart devices.

5. Router Security Settings Worth Knowing About

Once the basics are done, these matter:

• Disable UPnP, or restrict it. Universal Plug and Play lets any device on your network open ports on the router without asking. Convenient for games and video calls, and it quietly removes a layer of protection. If you turn it off, you will need manual port forwarding for some applications.
• Disable remote administration (WAN access). The router’s admin panel should never be reachable from the internet. If you need to manage it while away, use a VPN, not port forwarding.
• Change the admin panel URL, if the option exists. This is mild obscurity rather than real security, but it costs nothing.
• Set the DNS servers deliberately rather than accepting whatever the ISP pushes. Your ISP’s resolvers can log every domain you visit.
• Turn on automatic security updates for the router, if the firmware offers it.
• Review the connected device list monthly. Look for anything you do not recognise. This is free intrusion detection for the most common home compromise.

Good router security is mostly subtraction. That last item deserves emphasis. A surprising number of home network intrusions are discovered by someone noticing a device they do not own. It takes thirty seconds and it is the closest thing a normal household has to monitoring.

A 20-Minute Checklist

1. Log into the admin panel (usually 192.168.1.1 or 192.168.0.1, printed on the router).
2. Change the admin password to something long and unique.
3. Check for firmware updates and install any available.
4. Set encryption to WPA3, or WPA2-AES if needed.
5. Disable WPS, WEP, WPA-TKIP and remote administration.
6. Decide on UPnP — off unless you genuinely need it.
7. Create a guest network and move all smart and IoT devices onto it.
8. Note the router’s support end date in your calendar.
9. Change the Wi-Fi password if you have never changed it since install, and make it long.
10. Review the connected device list and remove anything unfamiliar.

Set a recurring quarterly reminder for steps 3 and 10. That is the entire ongoing maintenance requirement.

What to Do If the Router Has Been Compromised

If you see an unfamiliar device, notice DNS settings you did not change, or suspect someone has been on the admin panel:

1. Reset the router to factory settings from the device menu
2. Change the admin password, and the Wi-Fi password
3. Update the firmware to current
4. Re-apply the configuration above, this time before reconnecting devices
5. Revoke any sessions in your provider’s app, if your router is managed through one

A factory reset is genuinely the correct response rather than a last resort, because a compromised router can retain settings you cannot see and cannot remove by hand. It takes fifteen minutes and gives certainty.

Frequently Asked Questions

How often should I update my router firmware?

Check quarterly, and immediately after any security news about your model. Routers are among the most exploited devices in use, and vendors often patch quietly without announcing it.

Is hiding my Wi-Fi network name worth doing?

No. It provides no real protection and makes your devices transmit more as they search for the network. Spend the effort on WPA3 and a guest network instead.

Should I use a guest network or buy a second router?

A guest network on the same router is usually sufficient and simpler. Separate hardware is worth considering for untrusted guest visitors you want completely isolated, or for a home office that must be genuinely separate.

Can someone break into my Wi-Fi if I have a strong password?

Modern WPA2-AES or WPA3 encryption is not practically crackable directly. The realistic risks are weak or default admin passwords, unpatched firmware, and WPS. Fix those and the password strength matters far less.

Do I need a VPN for my home network?

Not for security at home on a normal connection. A VPN matters when you need to reach your own devices remotely while away, in which case it is much better than port forwarding. On public Wi-Fi, a VPN is worth using.

How do I know if an unknown device is on my network?

Check the connected device list in the router’s admin panel or in your provider’s app, and compare it against what you actually own. Do this monthly. It is the most effective intrusion detection available in a normal home.

Key Takeaways

• Change the admin password. It is the most forgotten and most valuable credential you have.
• Disable remote administration, WPS and UPnP.
• Use WPA3 or WPA2-AES, and update firmware quarterly.
• Put all IoT devices on a guest network — real hardware isolation, in two minutes.
• Review connected devices monthly. It is free intrusion detection.

Next: securing the smart devices that sit on that guest network, and the attack chain these gaps enable.

Image: “Wireless Router” by Dinkun Chen, CC BY-SA 4.0, via Wikimedia Commons.

Sources: FTC: How To Secure Your Home Wi-Fi Network · CISA: Secure Our World · NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide