Your router decides who gets onto your network and what reaches every phone, laptop, TV and camera in your home. Most people plug it in, connect once and never open its settings again. That habit leaves factory logins, old encryption modes and risky convenience features switched on for years.
You can fix nearly all of it in one sitting of about 30 minutes. This guide walks through each change in the order that makes the most sense, explains what it protects against, and flags the steps that can knock devices offline so you can plan around them.
Quick Checklist: The 5 Changes That Matter Most
Short on time? Do these five first, then come back for the rest:
- Replace the router's admin username and password.
- Set a long, unique Wi-Fi password.
- Switch encryption to WPA3 or WPA2-AES.
- Turn off WPS and remote management.
- Install the latest firmware.
How to Log In to Your Router Settings
Every change below happens in the router's admin panel. To reach it:
- Connect a computer to the router, ideally with an Ethernet cable so a settings change doesn't cut you off mid-edit.
- Find the gateway address. On Windows, run
ipconfigin Command Prompt and read the Default Gateway line. On a Mac, open System Settings > Network > Wi-Fi > Details. On a phone, tap the info icon next to your Wi-Fi network and look for Router or Gateway. - Type that address into a browser. Common ones are
192.168.0.1,192.168.1.1and10.0.0.1. Some brands also use web names such astplinkwifi.netorrouterlogin.net. - Sign in with the credentials on the router's sticker or in its manual.
Many internet providers and router brands also offer a mobile app that exposes the same settings with less menu digging. Use whichever you find easier.
Pick a quiet time. Firmware updates and encryption changes disconnect every device for a few minutes, so avoid starting during a video call or a big download.
How to See Who Is Connected to Your Wi-Fi
Start by looking, not changing. Open the page labeled Connected Devices, Device List, Attached Devices or Client List. It shows each device's name, IP address and MAC address.
Match every entry to something you own. Smart plugs and robot vacuums often show up as strings of random letters and numbers, so expect a few puzzles. Note anything you can't identify. You will lock those devices out naturally when you change the Wi-Fi password in the next sections, and this list gives you a baseline to compare against later. If you also spot odd app names in your router logs, our guide explains why Snapchat or Signal can appear in router logs even when the apps aren't installed.
Change the Default Router Admin Username and Password
Your router has two separate credentials, and people often confuse them:
- The admin login controls the router's settings.
- The Wi-Fi password lets devices join the network.
Fix the admin login first. Attackers and botnets scan for routers that still accept factory pairs like admin/admin or admin/password, because those lists are public. Anyone who gets into the admin panel can switch off encryption, change your DNS, or open ports, so a strong Wi-Fi password alone won't save you.
Look under Administration, System, System Tools or Management. Change the username if the router allows it, then set a long, unique password. If your router or its cloud account supports two-factor authentication, turn it on.
Save the new password in a password manager or write it down somewhere safe. If you lose it, most routers force a factory reset, which wipes every setting you are about to configure.
Never reuse the Wi-Fi password as the admin password. Doing so hands control of the router to everyone you share Wi-Fi with.
Create a Strong Wi-Fi Password
Length matters far more than odd symbols. Current guidance from NIST favors long passphrases over forced complexity rules, and a joint NSA and CISA home network guide suggests aiming for 20 characters or more.
An easy pattern: string four or five unrelated words together, such as copper-lantern-mango-skyline-otter. It types easily on a TV remote and resists guessing far better than Sharma@2015. Skip names, birthdays, phone numbers and house numbers, since guessing tools try those first.
Change it under Wireless, Wi-Fi Settings or Wireless Security. Every device drops off when you save, including any unknown device you spotted earlier. Reconnect your own gear and keep the passphrase somewhere your household can find it.
Change it again whenever you suspect someone has it who shouldn't, such as after a roommate moves out.
Switch to WPA3 or WPA2-AES Encryption
In the same wireless security menu, pick the security mode. Here is how the options stack up:
| Mode | Verdict |
|---|---|
| WPA3-Personal | Best choice when all your devices support it |
| WPA2/WPA3 transition (mixed) | Good choice for homes with a mix of new and old devices |
| WPA2-Personal with AES (CCMP) | Acceptable fallback for older routers |
| WPA2 with TKIP, WPA, WEP | Unsafe, never use |
| Open (no password) | Never use |
WPA3 swaps WPA2's handshake for one called SAE, which blocks attackers from capturing your handshake and guessing the password offline at leisure. If your router only offers WPA2, choose the AES option and make sure TKIP is off.
Fix Devices That Won't Reconnect After Switching to WPA3
Switching modes is the change most likely to break things. Older printers, smart bulbs, cameras and some laptops only speak WPA2 and may refuse to reconnect after you enable WPA3. If that happens:
- Fall back to WPA2/WPA3 transition mode, or
- Run a separate 2.4 GHz network on WPA2-AES just for the older gear, ideally the isolated IoT or guest network described below.
Also update the drivers or operating system on any laptop that struggles, since that alone often fixes WPA3 connection loops.
Disable WPS, UPnP and Remote Management
Routers ship with features that trade security for easy setup. Turn these off unless you have a specific need:
WPS (Wi-Fi Protected Setup). WPS lets devices join with a button press or an 8-digit PIN. The PIN design is flawed: the router checks the two halves separately, which shrinks the guessing job to about 11,000 tries. Free tools can crack it from outside your house in hours. Some routers keep the PIN method active even when the button is off, so check the WPS page itself and confirm everything is disabled.
UPnP (Universal Plug and Play). UPnP lets any device on your network open ports through your firewall without asking you. Game consoles like it, but so does malware. Turn it off and only re-enable it if a game or app genuinely stops working. You'll usually find it under Advanced, NAT Forwarding or Network Settings.
Remote management. Often labeled Remote Access or Web Access from WAN, this exposes the admin panel to the entire internet. Most people never need it. If you do, use a VPN to reach home instead of leaving the panel open.
Telnet, FTP and WAN ping replies. If your router lists these, disable them. They add attack surface and give you nothing.
Update Your Router Firmware (Back Up Settings First)
Firmware is the router's operating system, and updates patch the flaws that botnets exploit. An unpatched router stays vulnerable to known, published attacks that need no special skill.
Before you update:
- Find Backup, Backup & Restore or Export Config under the System or Administration menu and save the file. Some updates reset the router to factory defaults, and this file restores your work in seconds.
- Read the release notes if you rely on smart-home gear, since an update occasionally breaks compatibility with older devices.
- Stay on Ethernet and leave the router alone until it reboots on its own.
Look for Firmware Update, Router Update or Firmware Upgrade. Turn on automatic updates if your model offers them. If not, set a monthly reminder to check.
Know when to retire a router. The FBI warns that end-of-life routers no longer get security fixes and actively draw botnet attention. Replace yours if the maker has stopped issuing updates, if it can't do at least WPA2-AES, or if it won't let you disable WPS and remote management. If your provider supplied the router, ask them for a newer model. If you plan to buy your own, check our picks for the best WiFi routers before you decide.
Set Up a Guest Network and Isolate Smart Home Devices
Smart plugs, cameras, TVs and voice assistants rarely get updates and often carry weak security. If one gets compromised on your main network, it can reach your laptop, phone and NAS directly. A separate network limits that damage.
Open Guest Network or Guest Wi-Fi, give it its own name and passphrase, and enable client isolation (sometimes called AP isolation or "isolate from main network"). CISA recommends this kind of separation for IoT gear. Some newer routers offer a dedicated IoT network or VLAN option. Use that if you have it.
A practical layout:
- Main network: phones, laptops, work devices
- IoT network: cameras, plugs, bulbs, thermostats, TVs
- Guest network: visitors
Watch for broken controls. Isolation can stop your phone from casting to a TV or controlling smart bulbs over the local network, and some speakers won't join guest networks at all. Most smart devices work through the maker's cloud and don't care. For the few that need local control, test each one and keep only those on the main network rather than dropping isolation for everything.
Turn On Your Router's Firewall
Nearly every home router includes an SPI (Stateful Packet Inspection) firewall that blocks unsolicited traffic from the internet. It's normally on by default, but check under Security or Firewall anyway. Enable any DoS protection or port scan detection option you see.
If your network uses IPv6, confirm the router's IPv6 firewall blocks unrequested inbound traffic too, because IPv6 doesn't get the incidental shielding that NAT gives IPv4.
Rename Your Wi-Fi Network and Switch to a Secure DNS
Rename the network. Default names like NETGEAR54 or TP-Link_8A2C reveal your router brand and sometimes the model, which tells an attacker which known flaws to try. Pick something neutral with no surname, flat number or address in it.
Optionally switch DNS. Your router sends every website lookup to a DNS resolver. A filtering resolver such as Quad9 blocks many known malware and phishing domains before your devices even connect. Set it in the router's Internet or WAN settings so every device benefits. While you're there, note the current DNS values. If they ever change without you touching them, treat that as a sign someone tampered with the router.
Hidden SSID and MAC Filtering: Why They Don't Secure Your Wi-Fi
Two popular tips cost you convenience and buy almost no security:
- Hiding your network name. Your own devices still broadcast the name while searching for it, so anyone with basic tools can find it. Hidden networks also cause flaky auto-connect behavior. The NSA and CISA advise against it.
- MAC address filtering. An attacker can watch the air, copy an allowed MAC address and spoof it in seconds. Maintaining the allow list just becomes a chore every time you buy a gadget.
A strong passphrase and modern encryption do the real work. Spend your effort there.
How to Tell If Your Router Has Been Hacked
Watch for these signs:
- Devices you don't recognize keep reappearing in the connected list after you change the Wi-Fi password.
- The DNS servers in your router settings differ from what you set or what your provider assigned.
- Settings you turned off, such as remote management, switch themselves back on.
- Your admin password stops working even though you didn't change it.
- Web pages redirect to unfamiliar sites or show odd pop-ups on every device.
If you spot any of these, factory reset the router, install the latest firmware, and redo this checklist with brand-new passwords.
Monthly Router Security Check (5 Minutes)
Security slips back over time as you add devices and forget settings. Once a month:
- Scan the connected devices list for anything unfamiliar.
- Check for a firmware update if auto-update is off.
- Confirm WPS, UPnP and remote management are still off, since some updates turn them back on.
- Take a fresh config backup after any change.
If something looks wrong, such as unknown devices returning, DNS servers you didn't set, or settings that changed on their own, factory reset the router, update its firmware, and redo this checklist with brand-new passwords.
Frequently Asked Questions
How can I tell if someone is using my Wi-Fi without permission?
Open the router's connected devices list and look for names or MAC addresses you don't recognize. Slow speeds at odd hours can also hint at it. Change the Wi-Fi passphrase to kick everyone off, then reconnect only your own devices.
Is the 5 GHz band more secure than 2.4 GHz?
No. Both bands use the same encryption, so security depends on your mode and passphrase. The 5 GHz signal does travel a shorter distance, which slightly reduces how far outside your home it reaches, but don't treat that as protection.
Where do I find my Wi-Fi password if I've forgotten it?
Check the sticker on the router if you never changed it. Otherwise, sign in to the admin panel and open the wireless security page, or look at the saved network details on a computer or phone that's already connected.
Can I schedule or restrict internet access at certain times?
Yes, on most routers. Look for Parental Controls, Access Control or Schedule. You can pause specific devices, set bedtime cutoffs for kids' tablets, or limit guest network hours.
Do I still need a VPN on my home network?
Not for basic router security. A VPN encrypts traffic beyond your router and hides your activity from your internet provider, which helps for privacy and matters much more on public Wi-Fi. It doesn't replace any step above.
Should I turn my router off when I leave home?
It cuts exposure while you're away, but it also takes down security cameras, smart locks and anything else that needs the internet. For most homes, a properly hardened router can stay on.
What's the single most important change if I only have five minutes?
Change the router's admin password and disable WPS. Those two changes shut the doors that automated attacks try first.
