How to secure and maintain your wifi router

How to secure and maintain your wifi router: change the default logins first

A router ships with two separate passwords, the admin login and the Wi-Fi network password, and both need to be changed from their factory defaults before anything else matters.

Shopping for a specific model? See our full wifi router roundup — 10 models compared on the specs that decide it.

It's easy to assume the Wi-Fi password you type into your laptop is the only credential a Wi-Fi router needs. It isn't. The Federal Trade Commission's consumer guidance draws a clear line between the two: the network password lets a device join your Wi-Fi, while the admin password lets someone into the router's settings panel itself, where they could change your DNS, open ports, or lock you out entirely. Leaving the admin side on its factory default is the bigger risk, because those defaults are printed on a sticker on the device and published in manuals that anyone can search.

The FTC's advice is specific: change the default administrative username, password, and network name to something unique, and avoid using your name, address, or the router's brand in any of them. A password manager makes this painless since you never have to remember the string yourself. If you're wondering whether changing your router's default password actually matters, the practical reason is straightforward: default credentials get compiled into public lists that anyone, not just a skilled attacker, can search by device model.

Worth doing at the same time: rename the network itself. CISA notes that a default SSID can hint at the exact router model in use, which narrows down which known vulnerabilities an attacker would try first. A generic name that says nothing about brand, address, or household works better than something identifiable.

Pick the right encryption setting

WPA3 Personal is the current standard; WPA2 Personal with AES is the acceptable fallback on older hardware, and anything labeled WEP or WPA (without a number) should be replaced rather than patched.

Encryption is the setting most people never open because the router usually picks something on its own out of the box. That default isn't always the strongest option available. CISA notes that WPA3 is currently the strongest encryption available, with WPA and WPA2 still in use on older hardware, and recommends WPA2 at a minimum for any network. The FTC frames it the same way, calling WPA3 the newer and best encryption currently available, with WPA2 Personal as the acceptable step down.

If your router's admin panel only offers WEP or plain WPA, that's not a settings problem, it's a hardware age problem. Those older protocols have known weaknesses that a password change can't fix. In that case the more honest fix is a replacement router rather than another tweak to the same box; our wifi router hub is a reasonable starting point if you're comparing what's changed in the years since your current unit shipped.

One practical note: switching encryption standards can briefly disconnect every device on the network, since each one has to reconnect using the new protocol. Plan the change for a moment when nobody's mid-videocall.

Keep firmware current without obsessing over it

Check for firmware updates roughly every three months if your router lacks automatic updates, and install security-labeled updates as soon as they appear rather than waiting for the next scheduled check.

Firmware is a Wi-Fi router's own operating system, and it ages the same way phone software does: patches close holes that researchers and attackers both eventually find. Consumer Reports' guidance suggests checking at least every three months if your router doesn't handle updates automatically, and treating an unpatched router at end of life as a sign it's time to replace rather than keep nursing along. That three-month cadence is a floor, not a ceiling. If a manufacturer flags something as a security update specifically, install it right away instead of waiting for your next quarterly check.

How often should you update router firmware in practice depends on your hardware. Many mesh systems and newer routers install updates automatically in the background, which removes the guesswork entirely, worth confirming in the settings app the first week you own the router. Older standalone routers usually require you to log into the admin page and check manually, and it's the kind of task that's easy to keep meaning to get to.

A firmware check takes a few minutes: log into the admin interface, usually reached at an address like 192.168.0.1 or 192.168.1.1 printed on the router itself, and look for a system or update tab. If the manufacturer's app or site shows the model as discontinued or unsupported, that's the practical end of the update road, and no amount of manual checking closes new vulnerabilities that surface after that point.

Turn off the Wi-Fi router features you don't actually need

Remote management, WPS, and UPnP all trade a small amount of convenience for a meaningfully larger attack surface, and turning off all three is a low-cost way to shrink what an outside attacker can reach.

Routers ship with several features turned on that most households never use on purpose. Remote management lets someone log into the router's settings from outside your home network, which is useful for a tech-savvy relative helping you troubleshoot remotely and useless for everyone else, including attackers scanning the internet for routers that left it open. Disabling it removes one more way in for anyone who isn't already on your home network.

Wi-Fi Protected Setup, the WPS button that lets a new device join with one push instead of typing a password, has a similar problem: it increases the chance an attacker nearby can join without ever knowing your actual password, because the PIN-based version of WPS has documented weaknesses. Universal Plug and Play, or UPnP, automatically opens ports for apps and smart devices that request it, which is convenient until malware on any one device uses that same open door to reach the rest of the network. Security researchers have repeatedly flagged UPnP as a mechanism malware can use to open ports without asking, letting infected devices reach further than they should.

None of these three features are required for normal browsing, streaming, or gaming once initial setup is done. Turning them off in the admin panel closes three doors that see disproportionate attack traffic compared to how often typical households actually use them.

Separate guests and smart devices from your main network

A guest network keeps visiting devices and IoT gadgets off the same segment as your personal laptops and phones, which contains the damage if any single device on it gets compromised.

Most Wi-Fi routers sold in the last several years include a guest network option, and it's frequently left disabled because setting it up feels like an extra step for a rare situation. The better default is the opposite: enable it and give it its own long, unique password, then treat it as the default network for anyone who doesn't live in the house, plus any smart plug, camera, or speaker that only needs internet access and nothing else on your home network.

The reasoning is about containment rather than convenience. Compromised IoT devices have been a recurring source of home botnet activity, and a guest network limits what a compromised device can reach. It can still get to the internet, but it can't quietly probe your laptop or network-attached storage sitting on the main network. That's a meaningfully different outcome than a single flat network where every device can see every other device.

Setting it up is usually a toggle in the same admin panel as everything else here, often under a wireless or guest access tab. Give it a name and password that are different from your main network's, not a close variant of the same phrase.

Physical placement and account hygiene round out the routine

Where the router physically sits and who can reach its reset button matter alongside the software settings, and keeping it somewhere only trusted household members can access closes a gap none of the earlier steps cover.

Everything above assumes an attacker is working remotely, over the internet or from nearby Wi-Fi range. Physical access is a separate risk that's easy to overlook. Anyone who can physically reach the router can factory-reset it and then use the manufacturer's default credentials, printed right on the device, to reconfigure it from scratch. A closet or a high shelf beats a hallway table that guests and repair technicians pass by unsupervised.

Beyond placement, a periodic check of connected devices closes a gap that changing passwords alone doesn't. Most router apps list every device currently connected; scrolling through that list occasionally and removing anything unrecognized is a quick habit that catches a squatter on the network faster than waiting for something to feel slow. It won't replace the password and firmware work above, but it's a useful second check that costs almost nothing.

Worth being honest about the limits here too: none of these steps protect against a vulnerability in the router's firmware that hasn't been patched yet, and no home router setting substitutes for keeping the devices connected to it updated as well. Router security and device security are two different jobs that happen to share the same network.