Your router decides who joins your network, where your traffic goes, and which ports face the internet. Most people set it up once and never open the admin panel again, which leaves factory settings like WPS, UPnP, and default logins running for years. This checklist walks you through every setting worth changing, grouped by the job it does, so you can harden a home router in about 30 minutes.
How to Log In to Your Router Admin Panel
Gather a few things first so you don't lock yourself out halfway through.
- A wired or Wi-Fi connection to the router. Some changes (encryption, firmware) drop every device for a minute, so pick a quiet time.
- The router's local address. Most routers use
192.168.1.1,192.168.0.1, or10.0.0.1. On Windows, runipconfigin Command Prompt and read the Default Gateway line. On a Mac, open System Settings > Network > Details > TCP/IP and check the Router field. - The current admin login. Check the sticker on the router or the manufacturer's app (TP-Link Tether, ASUS Router, NETGEAR Nighthawk, eero).
- A password manager. You will create two new long passwords and you rarely type either one, so store them instead of memorizing them.
If the sticker login still works, treat Method 1 as urgent.
Method 1: Change the Router Admin Password and Disable Remote Management
The admin panel controls DNS, port forwarding, and every security switch, so it gets locked first.
Attackers and botnets like Mirai do not need clever exploits against most home routers. They try published default logins such as admin/admin and admin/password, and they scan for admin pages exposed to the internet.
- Open Administration, System, or Management and find the admin password field.
- Set a random password of 16 characters or more and save it in your password manager.
- Change the admin username too if your router lets you.
- Turn off Remote Management (also labeled Web Access from WAN or Remote Administration). This keeps the login page reachable only from inside your home.
- If your router uses a cloud account through a mobile app, turn on two-factor authentication for that account.
- Log out and log back in to confirm the new login works.
Keep the admin password different from your Wi-Fi password. If they match, anyone you give Wi-Fi access to can also rewrite your router settings.
Need to reach home while traveling? Run a VPN server on the router or use an overlay network like Tailscale instead of exposing the admin page.
Method 2: Update Router Firmware and Turn On Auto Updates
Firmware updates close the holes that automated scanners hunt for, so an outdated router stays exposed no matter how strong your passwords are.
- Note your router model and hardware revision from the label.
- Open Firmware Update, System Update, or Router Update and run a check.
- Install anything available and let the router reboot without interruption.
- Switch on Auto Update if the option exists. Most routers install updates overnight.
- If your router only supports manual updates, download firmware from the manufacturer's support page only, and match the exact hardware revision.
Check the manufacturer's end-of-life list for your model. Once a vendor stops shipping patches, new flaws stay open permanently, and that router belongs in the recycling bin rather than on your network.
Method 3: Switch to WPA3 Encryption (or WPA2-AES)
Encryption decides how hard it is for someone nearby to break into your wireless network or read its traffic.
Go to Wireless > Security and choose a mode from this table.
| Mode | Verdict | Why |
|---|---|---|
| WPA3-Personal | Best choice | SAE handshake resists offline password guessing |
| WPA2/WPA3 Transition | Good for mixed devices | Older gadgets use WPA2, newer ones get WPA3 |
| WPA2-Personal (AES/CCMP) | Acceptable fallback | Safe with patched devices and a strong passphrase |
| WPA2-TKIP or WPA | Avoid | Deprecated cipher with known attacks |
| WEP or Open | Never | Cracks in minutes or has no protection at all |
Avoid any Auto option, since some routers quietly fall back to TKIP with it. The Wi-Fi Alliance has required WPA3 support for certified devices since July 2020, so most hardware from the last few years handles it. If you run the 6 GHz band on a Wi-Fi 6E or Wi-Fi 7 router, that band requires WPA3 anyway.
While you are in the wireless settings, look for Protected Management Frames (also called PMF or 802.11w). WPA3 requires it, but on WPA2 you can switch it on yourself. PMF blocks forged disconnect frames that attackers use to kick devices off your network. Set it to Optional or Capable if an older device struggles, or Required if everything connects fine.
Method 4: Change Your Wi-Fi Password and Default SSID
Even WPA3 can't save a network with a guessable password, so the passphrase and network name come next.
- Generate a Wi-Fi password of 16 to 24 random characters, or use four or five unrelated words strung together.
- Skip names, birthdays, phone numbers, and addresses.
- Rename the SSID if it still shows the brand default, such as NETGEAR54 or TP-Link_A4B2. A default name tells an attacker your exact router model and which flaws to try.
- Pick a name that does not reveal your surname, flat number, or router model.
Leave SSID broadcast on. Hiding the network name adds almost nothing, because your own phones and laptops still call out that name in probe requests, and hidden networks cause auto-connect problems.
Change the Wi-Fi password when you suspect someone has it or after an ex-roommate or contractor leaves. Rotating a strong password on a timer matters far less than having a strong one in the first place.
Method 5: Disable WPS and UPnP and Remove Unused Port Forwarding
These three features open doors automatically, and most homes don't need any of them.
WPS (Wi-Fi Protected Setup) checks its 8-digit PIN in two halves, so an attacker needs roughly 11,000 guesses instead of 100 million. Tools like Reaver still crack it in hours, and no firmware update can fix the design. Open Wireless > WPS and switch off both the PIN method and the push-button method, since some routers keep them as separate toggles.
UPnP (Universal Plug and Play) lets any device inside your home ask the router to open a port, with no password. That helps game consoles, but malware on one infected laptop or camera can use the same feature to open its own path through your firewall. Find it under Advanced > NAT or Advanced > UPnP and turn it off. If a console then shows a strict NAT type, add manual port forwarding for only the ports its maker lists.
Port forwarding rules pile up over the years. Open NAT, Port Forwarding, or Virtual Server and delete any rule you can't explain, such as one for a game server you stopped running or a camera you replaced. Never forward ports for remote desktop (3389), file sharing (445), Telnet (23), or the router's own admin page.
Method 6: Set Up a Guest Network to Isolate IoT Devices
Isolating IoT gear stops one hacked gadget from reaching your laptop, phone, or NAS.
Cheap cameras, plugs, bulbs, and smart TVs often run old firmware that their makers barely update. Put them on a separate network so a compromise stays contained.
- Turn on the Guest Network and give it its own name and strong password.
- Enable AP Isolation or Client Isolation, and disable Allow guests to access local network.
- Move these devices to it:
| Device | Network |
|---|---|
| Laptops, phones, tablets, work computers | Main network |
| Smart TVs, streaming sticks | IoT network |
| Cameras, video doorbells | IoT network |
| Smart plugs, bulbs, thermostats, speakers | IoT network |
| Visitors' phones | Guest network |
If your router supports VLANs (many ASUS, UniFi, and pfSense setups do), create a dedicated IoT VLAN with a firewall rule blocking traffic toward your main VLAN. That gives stronger separation than a basic guest SSID.
Casting devices and some smart speakers need local discovery to work with your phone. Add a narrow exception for them rather than switching isolation off for the whole network.
Method 7: Enable the Router Firewall and Change DNS Servers
The router's firewall blocks uninvited inbound connections, and its DNS setting decides where every lookup in your home goes.
Open Security > Firewall and confirm these are on:
- SPI Firewall (Stateful Packet Inspection)
- DoS Protection
- Respond to WAN Ping set to off, sometimes labeled Stealth Mode or Block WAN Requests
Next, open WAN > DNS or Internet > DNS. If the servers listed there look unfamiliar and you never set them, someone may have hijacked your router, so reset it and redo this checklist. Otherwise, replace your ISP's servers with a resolver that filters malicious domains:
| Provider | Primary | Secondary | What You Get |
|---|---|---|---|
| Cloudflare | 1.1.1.1 | 1.0.0.1 | Fast, privacy-focused |
| Cloudflare for Families | 1.1.1.2 | 1.0.0.2 | Adds malware blocking |
| Quad9 | 9.9.9.9 | 149.112.112.112 | Blocks known malicious domains |
Setting DNS at the router covers every device at once, including smart TVs and cameras that offer no DNS setting of their own. If your router supports DNS over HTTPS or DNS over TLS, switch it on so your ISP can't read your lookups.
Method 8: Test Your Router for Open Ports and DNS Leaks
Settings sometimes fail to apply or reset after an update, so test from the outside instead of trusting the admin panel.
- Scan your public IP with an online port scanner. A hardened home router should show almost nothing open. Unexpected open ports usually mean UPnP or remote management is still active.
- Run a DNS leak test to confirm lookups reach the resolver you chose and not your ISP.
- Check WPS from a Wi-Fi analyzer app on your phone. Some routers keep WPS running even after you switch it off in the panel.
- From a phone on the guest network, try to open a shared folder or printer on your main network. If you can reach it, isolation isn't working.
For a deeper look at your own LAN, nmap lists every live host and its open services:
nmap -sn 192.168.1.0/24
nmap -sV 192.168.1.50The first command sweeps the subnet for active devices. The second lists open ports and service versions on one device, which helps you spot Telnet, RDP, or an unprotected web panel on a camera or NAS.
Method 9: Check Who Is Connected to Your Wi-Fi
A short routine catches intruders and drifted settings long before they cause damage.
Open the Connected Devices, DHCP Client List, or Network Map page once a month and match each entry to something you own. Phones use randomized MAC addresses, so a familiar phone can show up under a strange name. Investigate before you panic.
If you confirm an unknown device, change the Wi-Fi password. Your own devices reconnect with the new password and the intruder drops off.
Use this rhythm to stay on top of it:
- Monthly: connected devices and firmware updates
- Every three months: remote management, UPnP, WPS, firewall, DNS, and port forwards
- After any new smart device: confirm it landed on the IoT network
- After a power cut or firmware update: spot-check that your settings survived
How to Tell If Your Router Has Been Hacked
Certain symptoms point to a hijacked router, and each one takes a minute to check.
- DNS servers you never set. A hijacked router often points lookups at a malicious resolver that sends you to fake sites.
- Admin accounts or port forwards you didn't create.
- Browser redirects to unfamiliar pages or fake login screens.
- Unknown devices on the connected list, or one device pushing unusually heavy traffic.
- Settings that keep reverting after you change them.
If you see any of these, factory reset the router, install the latest firmware from the manufacturer's site, and redo this checklist with brand new admin and Wi-Fi passwords. Treat any card or password you entered on a suspicious page as exposed and change it. The FTC's home Wi-Fi guidance covers the same basics if you want a second reference.
Router Security Myths: Hidden SSID, MAC Filtering, and VPNs
A few popular tips cost you time without blocking real attacks.
- Hiding the SSID: your devices still broadcast the name, and hidden networks connect less reliably.
- MAC address filtering: anyone who can sniff your traffic can copy an allowed MAC address in seconds. It adds upkeep for every new device and stops only casual neighbors who already know your password.
- Buying a new router for security alone: a supported Wi-Fi 6 router with WPA3 and current firmware beats a Wi-Fi 7 router left on default settings. Replace hardware when it only supports WEP or WPA, or when updates stop.
- A VPN as a router fix: a VPN encrypts traffic leaving your device, but it does nothing about a weak admin password, open WPS, or a hacked camera on your LAN.
Frequently Asked Questions
Does changing my Wi-Fi password secure my router?
No. The Wi-Fi password only controls who joins the network. The admin password, firmware, WPS, UPnP, remote management, and encryption mode are separate settings, and an attacker can exploit any of them even when your Wi-Fi password is strong.
Can someone hack my router from outside my home?
Not through a properly secured Wi-Fi connection alone. Remote attacks usually go through exposed remote management, unpatched firmware, unneeded port forwards, or a compromised cloud account linked to the router app. Closing those paths blocks most internet-based attacks.
Should I leave UPnP on for gaming?
You can, but it lets any program on your network open ports without asking you. A safer setup turns UPnP off and forwards only the ports your console maker publishes. If you keep UPnP on, keep every device on that network patched.
Is WPA2 still safe to use?
WPA2 with AES (CCMP) and a long, random passphrase stays reasonable for devices that can't run WPA3. Avoid TKIP entirely. Where your router allows it, use WPA2/WPA3 transition mode so newer devices get the stronger handshake.
Do wired devices need protection if my router gets hacked?
Yes. The router handles DNS and routing for every device, wired or wireless. A hijacked router can send your desktop to fake sites just as easily as your phone.
Related Guides
- How to Fix Slow WiFi: 14 Proven Methods to Speed Up Your Connection
- Your Wi-Fi Router Is Watching You: The BFI Tracking Attack That Needs No Phone or Password
- Wi-Fi Routers Can Track You Without Your Phone: KIT Researchers Reveal the BFId Attack
- Why Snapchat or Signal Can Appear in Router Logs Even When the Apps Are Not Installed
