How to Secure Your Home Wi-Fi Router

Why This Matters

Your router is the front door to every device in the house — phones, laptops, cameras, TVs, and anything with "smart" in the name. Most are installed once and never touched again, which leaves them running default admin passwords, outdated firmware, and WPS, a feature with a known brute-force weakness.

An attacker on your Wi-Fi can see which devices you own, attack them directly, and redirect your browsing by changing DNS settings. The whole hardening job below takes about an evening and does not need any special equipment.

Already seeing redirects or fake warnings? Do remove viruses and malware first, then come back — a compromised PC will just re-attack the network.

Step 1: Sign In to the Router

1. Open Terminal and run:

   ipconfig
   

2. Read the Default Gateway address — usually 192.168.0.1, 192.168.1.1, or 192.168.1.254.
3. Type that address into your browser.
4. The login is usually printed on a sticker on the router. If it was changed and forgotten, hold the recessed reset button for 30 seconds to restore factory settings — this wipes all configuration, so note your broadband settings first.

Step 2: Change the Admin Password

This is the single most important change, and the one most often skipped.

1. Find Administration, System, or Management in the router menu.
2. Change the admin password to something long and unique — this is not the Wi-Fi password.
3. Change the admin username too if the router allows it.
4. Store it in a password manager, not on a sticky note: use a password manager safely and create strong, memorable passwords.

Step 3: Update the Firmware

1. Look for Firmware Update, Router Update, or System Tools.
2. Apply any available update and let the router reboot — it takes a few minutes and drops your connection.
3. Turn on automatic firmware updates if the option exists.
4. If your router is more than about six years old and the manufacturer has stopped publishing updates, replace it. Unpatched routers are actively targeted.

Step 4: Switch to WPA3 (or WPA2-AES)

1. Open Wireless → Security or Wi-Fi Settings.
2. Choose WPA3-Personal if every device supports it, or WPA2/WPA3 Transition mode for mixed households.
3. If WPA3 is not offered, choose WPA2-Personal (AES).
4. Never use WEP, WPA (TKIP), or an open network. WEP can be broken in minutes.
5. Set a Wi-Fi passphrase of at least 16 characters. A short phrase of unrelated words beats a short scramble of symbols.

Step 5: Turn Off WPS

1. Find WPS under Wireless or Advanced.
2. Disable it, including any WPS PIN option.
3. The eight-digit PIN can be brute-forced in hours regardless of how strong your Wi-Fi password is. Pairing devices by typing the passphrase is barely slower.

Step 6: Disable Remote Management and UPnP

1. Find Remote Management, Remote Access, or WAN Access and switch it off — this stops the admin page being reachable from the internet.
2. Turn off Telnet and SSH unless you actively use them.
3. Disable UPnP unless a specific game or console needs it. UPnP lets any device on your network open ports to the internet without asking you.
4. If a game stops working afterwards, forward that single port manually rather than re-enabling UPnP.

Step 7: Set Up a Guest Network

1. Enable the Guest Network feature with its own password.
2. Make sure Allow guests to access local network or Client isolation is set so guests cannot see your PCs and NAS.
3. Put visitors on it — and put smart bulbs, cameras, and other IoT devices there too. They are the least-patched things in the house.
4. Related: stay safe on public Wi-Fi.

Step 8: Review Connected Devices

1. Open Attached Devices, Device List, or DHCP Clients.
2. Identify each entry. Phones and laptops usually show a recognisable name; unknown MAC addresses are worth investigating.
3. If you find something you cannot account for, change the Wi-Fi password immediately — that disconnects everything, and you reconnect your own devices with the new passphrase.
4. MAC filtering is often suggested here. It is trivially bypassed by spoofing and mostly creates work for you — a strong WPA3 passphrase does far more.

Step 9: Harden DNS and Check It Has Not Been Changed

Router DNS hijacking is a common attack: your browsing is silently redirected to fake sites.

1. In Internet or WAN settings, check the DNS entries.
2. If they are unfamiliar addresses, set them deliberately — for example Cloudflare (1.1.1.1 / 1.0.0.1) or Quad9 (9.9.9.9), which also blocks known malicious domains.
3. Recheck this after any router problem. An unexpected DNS change is a strong sign of compromise.
4. If browsing is already misbehaving: fix DNS server not responding.

Step 10: Rename the Network and Turn Off Extras You Don't Use

1. Change the SSID from the factory default — default names advertise the exact model, which tells an attacker which vulnerabilities to try.
2. Do not put your name, flat number, or address in the SSID.
3. Hiding the SSID is not security; it is easily discovered and makes your devices noisier. Leave it visible.
4. Disable any unused features: FTP servers, media servers, printer sharing, and cloud-access services.

What Not to Do

• Don't rely on MAC filtering or a hidden SSID as your security. Both are cosmetic.
• Don't reuse your Wi-Fi password as the admin password. Anyone you give Wi-Fi to should not gain admin access.
• Don't enable port forwarding "to fix" a game without understanding what it exposes. Forward one specific port, never DMZ the whole PC.
• Don't use an ISP router that no longer receives firmware updates. Ask for a replacement or buy your own.

Still Not Working?

If devices drop off after switching to WPA3, use WPA2/WPA3 Transition mode — older printers and smart plugs frequently cannot handle WPA3. If Wi-Fi is unreliable rather than insecure, see fix Wi-Fi that keeps disconnecting and fix slow Wi-Fi speeds.

Related: set up two-factor authentication, set up a VPN in Windows 11, and recover a hacked email account.

Three follow-ups turn a secured router into a segmented network: put smart home devices on an isolated guest network, close port forwarding and turn off UPnP, and lock down any cameras you run.