How to secure your home router in an evening

Nine settings to check on your home router, in order, with the attacker mechanism each one shuts and what it costs you when you turn it on.

To secure a home router you need to change nine things, most of them a single toggle in the admin page. Log in at the address on the sticker (usually 192.168.0.1 or 192.168.1.1) and work down this list in order. The first three close the doors attackers actually walk through, so do those even if you stop there.

Every vendor names these menus differently and moves them between firmware versions. I'll say where a setting usually lives and you'll have to hunt a little; the vendor's official support site is the place to look when you can't find one.

1. Change the admin password

This is the password for the settings page, not the Wi-Fi passphrase. Many routers ship with admin / admin, and sticker passwords on popular models are often generated from a pattern that has been worked out.

Why it matters: anything on your LAN, including a compromised phone, a cheap smart plug, or a browser tab hit by cross-site request forgery, can send requests to 192.168.1.1. With the default password those requests are accepted, and the attacker now owns your DNS, your port forwards and your firmware.

How to check: log in with the sticker credentials. If they work, change them. Usually under Administration or System, then Password.

What it costs: one more password to store. Put it in your password manager. The honest password strength checker will show you why a long passphrase beats a clever short one.

2. Turn off remote administration

Why it matters: this setting exposes the admin page to the internet instead of just your LAN. Attackers don't target you. They scan address ranges for routers answering on the admin port and try known credentials and known bugs against every one that replies. With remote admin off, your router is a locked door. With it on, it's a door on a busy street.

How to check: Administration, then Remote Management. Off. If there's a vendor cloud app you don't use, turn that off too.

What it costs: you can't change settings from outside the house. If you genuinely need that, a VPN into your network is the answer, not an exposed admin page.

3. Update the firmware, and find out whether updates still exist

Why it matters: router firmware is a small Linux system with a web server bolted on, shipped in millions of identical units. Bugs get found. The fix only reaches you if you install it.

How to check: Administration, then Firmware Update. Note the current version and date. Then look the model up on the vendor's support site: when was the newest firmware released, and is the model listed as end-of-life?

If the newest firmware is years old and the model is unsupported, no toggle on this page will save it from the next published bug. Budget for a replacement; that's the real cost of this step. If auto-update is offered, turn it on.

4. WPA3 or WPA2-AES, and WPS off

Why it matters: the encryption mode decides whether someone parked outside can read your traffic or join your network. WEP is broken outright. WPA2 with TKIP is weaker than WPA2 with AES (shown as CCMP on some models). WPA3 closes the offline guessing attack WPA2 still allows: capture the handshake once, take it home, guess the passphrase as fast as a GPU permits.

WPS is the push-button pairing feature. Its PIN mode can be brute-forced in two short halves, which hands over the Wi-Fi passphrase.

How to check: Wireless, then Security. WPA3-Personal if every device supports it, WPA2/WPA3 mixed if an old printer refuses. Never WEP, never Open, AES over TKIP. Then Wireless, then WPS: disabled.

What it costs: a few old devices won't join WPA3-only, hence the mixed mode, and WPS off means typing the passphrase into new devices.

5. A guest network for everything you don't trust

Why it matters: the smart TV, the cheap camera, the air purifier with an app. These are the devices most likely to run unpatched firmware with a hardcoded password, and when one is compromised the attacker is inside your LAN with your laptop and the admin page in reach.

A guest network (some routers call it an IoT network) with client isolation lets those devices reach the internet but not each other, and not your main devices. The trust boundary moves from "anything on my Wi-Fi" to "only the devices I chose".

How to check: Wireless, then Guest Network. Enable it, give it its own passphrase, tick client or AP isolation if offered, move the IoT things over.

What it costs: an hour re-pairing devices, and some things break. A Chromecast on the guest network can't be found by your phone on the main one, because that's the point. If you need casting, that device stays on the main network, knowingly.

6. Disable UPnP unless you know why you need it

Why it matters: UPnP lets any device on your LAN tell the router "open port 8080 on the outside and send it to me". No authentication, no confirmation. Convenient for games consoles, and a gift for malware, which can punch its own hole through your firewall.

How to check: Advanced, then NAT Forwarding or WAN, then UPnP. Off. Then read the Port Forwarding list on the same page and delete anything you don't recognise.

What it costs: this is the step most likely to break something. Some multiplayer games and voice chat rely on UPnP and will complain about "strict NAT". The fix is a manual port forward for that one device on that one port, not switching UPnP back on for everything.

7. Change the DNS if you want filtering

The router hands every device a DNS server, usually the ISP's. A filtering resolver that refuses to answer for known malware and phishing domains protects every device without installing anything. Quad9 and Cloudflare's family resolver are the two I'd point people at.

How to check: Network, then WAN or Internet, then DNS.

What it costs: filtering occasionally blocks something legitimate. This step is optional. The first six are not.

8. Read the DHCP client list

This is the only detection step on the list, and the one people skip. The client list ("Attached devices", "Device list", "Network map") shows everything that has asked your router for an address. A name you don't recognise is either a forgotten smart bulb or someone on your Wi-Fi. Search the first six characters of an unknown MAC address to get the manufacturer.

If something is there that shouldn't be: change the Wi-Fi passphrase, which boots every device, then redo steps 1 to 4, because it got in somehow.

9. Securing a home router your ISP supplied

Many ISP routers lock half of these menus: no DNS change, no UPnP toggle, sometimes no firmware version, and remote management kept on for the ISP's own support.

My opinion: if you've read this far, buy your own router and put it behind the ISP box. Ask for bridge or modem-only mode if they offer it. If they don't, plug your router's WAN port into one of their LAN ports, turn off the ISP box's Wi-Fi, and do all nine steps on the router you control. Double NAT is the usual cost, and for most households it never causes a visible problem.

Frequently asked questions

Is the Wi-Fi password the same as the admin password? No, and that confusion is why so many admin passwords are still the default. The Wi-Fi passphrase lets a device join. The admin password lets someone change how the router behaves. Both belong in a password manager.

Does hiding the SSID or filtering by MAC address help? Not meaningfully. A hidden SSID is still broadcast by every client that tries to connect, and MAC addresses are trivially spoofed. Spend the time on WPA3 and the guest network.

What if I think the router is already compromised? Factory reset it, update the firmware before anything else connects, then do the nine steps fresh. A compromised router often points you at fake login pages, so also check whether your email has shown up in a breach and move the important accounts to passkeys or an authenticator app; Yash's piece on passkeys vs passwords vs 2FA explains which stops what.