Securing Your Home Router: Plain-English Steps

Your home router is the front door to every device in your house, and many are still running on the password printed on the sticker underneath. The router is the box your internet provider gave you, or one you bought, that connects your home to the internet and creates your Wi-Fi. If someone gets control of it, they can see where your devices go online, change settings without you noticing, or use your connection to commit crimes. This guide walks you through the settings that matter, in plain English, and takes about half an hour the first time. It is written for households, older people, families and very small businesses who do not have an IT person to call.

Key takeaways

Change the two passwords. Your router has one password for joining the Wi-Fi and a separate one for its settings page. Change both from the factory defaults, and make them different.
Use WPA3 or WPA2 encryption. Never leave your Wi-Fi "Open", and avoid the old WEP and WPA options.
Keep it updated, and replace it when updates stop. Turn on automatic updates. A router that no longer gets security fixes should be replaced.
Switch off features you do not use. Remote management, WPS and UPnP are common ways in. Most homes do not need them.
Give guests and gadgets their own network. A guest network keeps visitors and smart devices away from the computers and phones that hold your private information.

Why your router matters

Every phone, laptop, smart speaker and TV in your home talks to the internet through the router. That makes it a single point that, if weak, puts everything behind it at risk.

The FBI warned in May 2025 that criminals were taking over old home routers, especially ones with remote administration turned on, using malware called TheMoon. Infected routers were then rented out as hidden relays, so criminals could hide their real location while committing crimes such as cryptocurrency theft. The owners usually had no idea. The FBI said routers made in 2010 or earlier are likely no longer getting updates.

The good news is that most of the protection comes from a handful of settings, and you only need to set them once.

What an attacker can do with your router: change which websites your devices are sent to, watch which sites you visit, attack other devices on your network, or use your connection for crime.
What a router cannot protect: it will not stop you clicking a scam link or giving a password away. You still need good passwords, 2-step verification and updates on each device.

For organisations, see the Wi-Fi Security Guide.

Get into your router's settings

Before you can change anything, you need to reach the router's settings page, sometimes called the admin page or hub manager.

Find the details on the router: most routers have a sticker on the back or base showing the web address to type in (often a set of numbers such as 192.168.1.1, or a name chosen by your provider), plus the admin password. Finland's National Cyber Security Centre points out that the password is printed on the router unless you have already changed it.
Connect to your own Wi-Fi first: use a laptop or phone that is already on your home network. Some providers also offer an app that does the same job.
Type the address into your web browser: enter the admin password from the sticker or the provider's instructions.
Check your provider's help pages if you get stuck: every make of router looks different and menus change after updates, so names in this guide may not match yours exactly. Search your provider's website for "router settings" plus the model name.

Write down what you change and keep it somewhere safe at home, or in a password manager. See the Password Managers Explained for Everyone Guide.

Set it up safely in 30 minutes

The table lists the settings to look for, what to choose, and why. The advice follows the US Federal Trade Commission (FTC), the Northern Ireland Cyber Security Centre and the NCSC.

Setting (names vary)	What to choose	Why
Admin password (router login)	Change it to a long, unique password. Change the admin username too if your router allows it.	Default logins are often printed on the box or easy to look up.
Wi-Fi password (network key)	A strong password your household can type, for example three random words joined together.	Stops neighbours and passers-by joining your network.
Wi-Fi name (SSID)	Something that does not include your name, address, provider or router brand.	The name can reveal which router you have, and that makes known weaknesses easier to try.
Security or encryption mode	WPA3 Personal. If not offered, WPA2 Personal, or a WPA2/WPA3 mixed mode if some older devices need it.	WEP and WPA are outdated. "Open" means no protection at all.
Firmware or automatic updates	On.	Updates fix security holes that criminals know about.
Remote management or remote access	Off, unless you truly need it.	Lets people reach the settings page from the internet.
WPS (Wi-Fi Protected Setup)	Off.	A push-button or PIN shortcut for joining that the FTC recommends turning off.
UPnP (Universal Plug and Play)	Off, then check games consoles and apps still work.	Lets devices open holes in your router's defences without asking you.
Firewall	On.	Most routers include one. It blocks unwanted connections from the internet.
Guest network	On, with its own name and password.	Keeps visitors and gadgets away from your main devices.

When you have finished, log out of the settings page rather than just closing the browser tab, as the FTC advises. Some changes will disconnect your devices for a moment, and if you changed the Wi-Fi name or password you will need to reconnect each device with the new details.

A good Wi-Fi password: the NCSC suggests using three random words, which is long, hard to guess and easy to remember. The FBI suggests 16 to 64 characters for router passwords. A password manager can create and store a long admin password for you, because you will rarely need to type it.
Older devices: if a printer or old tablet cannot join after you switch to WPA3, try the mixed WPA2/WPA3 option rather than turning security down further.
Other network boxes: Wi-Fi extenders, mesh units and powerline adapters have their own logins. The Northern Ireland Cyber Security Centre says to change their default passwords too.

Keep it updated, and know when to replace it

A router is a small computer, and like any computer it needs security updates. Look for a setting called automatic updates or firmware updates and turn it on. If your internet provider gave you the router, the FTC suggests asking them whether they send updates automatically. If you bought the router yourself, register it with the maker and sign up for update notices.

Every router eventually reaches "end of life", when the maker stops sending security fixes. The FBI recommends replacing an end-of-life router with a supported model. Signs it may be time to replace yours:

Age: it is more than about ten years old, or was made in 2010 or earlier.
No updates: the maker's website lists it as discontinued or end of life, or no firmware has appeared for years.
No modern encryption: the FTC says that if your router still cannot offer WPA2 or WPA3 after updating, buy a new one.

When buying, check how long the maker promises to provide security updates. In the UK, the Product Security and Telecommunications Infrastructure (PSTI) rules have applied since 29 April 2024. They require connectable consumer products to have a unique password or one you set yourself, a way to report security problems, and a published minimum period for security updates. Look for that support period on the box or the maker's website before you buy. Many internet providers will also swap an old hub for a newer one if you ask.

Separate guests and smart gadgets

A guest network is a second Wi-Fi network from the same router, with its own name and password. Devices on it can reach the internet but should not be able to see your main computers and phones.

Visitors: give friends, lodgers and tradespeople the guest password, so fewer people know your main one.
Smart devices: the Northern Ireland Cyber Security Centre recommends putting smart speakers, bulbs and plugs on a separate network such as the guest network, so they are kept away from devices holding private data.
Check the isolation setting: some routers have an option such as "allow guests to see each other" or "access local network". Leave it off.
Trade-off: some gadgets, such as casting a phone to a TV, only work when both are on the same network. If something stops working, decide whether the convenience is worth it for that one device.

For more on gadgets, see the Securing Smart TVs and IoT at Home Guide and the Securing Home Cameras Guide.

Signs something is wrong

Router problems are often silent, so check every few months. Most routers show a list called connected devices, attached devices or device list.

Devices you do not recognise: the Northern Ireland Cyber Security Centre suggests reviewing the list and removing anything unknown. Many devices show a manufacturer name, which helps you match them up.
Settings you did not change: a new Wi-Fi name, different web address settings (often labelled DNS), remote management switched back on, or a password that no longer works.
Physical and performance signs: the FBI lists overheating, connection problems and unrecognised setting changes as possible signs of infection.
Odd warnings: websites you use often suddenly showing security certificate warnings on every device at home.

What to do if it happens

Update and restart: the FBI advises installing the latest firmware, changing passwords and rebooting the router.
Reset if you are unsure: a factory reset (usually a small recessed button held for several seconds) wipes all settings. Check your maker's or provider's reset instructions first, then set it up again from the table above with new passwords.
Change important passwords: from a device you trust, change your email and online banking passwords and turn on 2-step verification. See the Two-Factor Authentication for Everyone Guide.
Replace it if it is old: if your router is out of support, resetting will not fix the underlying weakness. Ask your provider for a replacement.
Report it: if you lost money or accounts were taken over, report it (see below) and contact your bank straight away.

Where to get help

UK, your provider first: your internet provider's help line can usually update, reset or replace a router they supplied.
UK, reporting crime: in England, Wales and Northern Ireland, report fraud and cyber crime to Report Fraud at reportfraud.police.uk or 0300 123 2040, as the NCSC explains. In Scotland, call Police Scotland on 101.
UK, guidance: the Northern Ireland Cyber Security Centre has a short home network checklist, and the NCSC covers smart devices.
US: the FTC has step-by-step advice, and the FBI asks victims to report to IC3.

Common failure patterns

Changing the Wi-Fi password but not the admin password: anyone on your network, including guests, can then log in and change settings.
Keeping a router for ten years: it still works, so it never gets replaced, but it stopped getting security fixes long ago. This is exactly the kind of router the FBI warned about.
Turning on remote management "just in case": it opens the settings page to the internet for a convenience most people never use.
Dropping security to "Open" or WEP to get one old device online: one printer is not worth exposing the whole house. Use mixed mode or the guest network instead.
Sharing the main password with everyone: years later, former lodgers and visitors can still join. Use a guest network and change its password now and then.
Forgetting extenders and mesh units: they sit on your network with their own default logins.

Practitioner checklist

Find your router's settings address and admin password on the sticker, and log in from a device at home.
Change the admin password to a long, unique one and store it safely.
Set Wi-Fi security to WPA3 Personal, or WPA2 Personal if WPA3 is not available, and never "Open".
Change the Wi-Fi name so it does not reveal you, your address or your provider, and set a strong Wi-Fi password.
Turn on automatic updates and the firewall.
Turn off remote management, WPS and UPnP, then check everything you rely on still works.
Set up a guest network for visitors and smart gadgets.
Change default passwords on extenders, mesh units and powerline adapters.
Every few months, check the connected devices list and look for unknown changes.
Check whether your router still gets updates, and replace it if it does not.

Securing Your Home Router Guide: Plain-English Steps to Stay Safe