Quick answer: To secure your home router, change both the admin password and the Wi-Fi password, choose WPA3 (or WPA2 with AES), install the latest firmware, and switch off remote management, WPS and UPnP. Put guests and smart-home gadgets on a guest network. Replace the router if it no longer gets security updates.
Your router sits between every device at home and the internet, yet many people never open its settings after setup. Default credentials and outdated firmware are common weak points, which is why the US cyber agency CISA lists them first in its home Wi-Fi guidance.
The steps below apply to routers in the US, UK, Canada, Australia and Europe. Menu names differ by brand and internet provider, so use your manufacturer’s or provider’s support pages for exact screens.
How do I prepare before changing router settings?
Start with a short inventory. iTechGuides suggests noting the manufacturer, model, hardware revision, firmware version and provider variant, and backing up the configuration if the router allows it. Menu names vary by manufacturer, model and region.
If your provider supplied the router, check whether it manages settings remotely. In that case, some options may be locked or handled through the provider’s app.
How do I lock down the router step by step?
- Change the admin username and password. CISA warns that default credentials may be public. Use a long, random, unique password, and do not reuse your Wi-Fi password.
- Update the firmware. Install updates from the official manufacturer or provider source, and turn on automatic updates if offered. iTechGuides advises not interrupting an update in progress.
- Rename the network (SSID). A default name can reveal the router model and its known weaknesses. Avoid personal details.
- Set a new Wi-Fi passphrase. CISA suggests 5 to 7 unrelated words, at least 16 characters, not used for any other account.
- Check the encryption type. Pick WPA3 Personal or WPA2 AES. Open networks, WEP, WPA and WPA2 with TKIP are not secure, according to CISA.
- Disable remote management. This stops anyone on the internet from logging in to change your settings.
- Disable WPS. CISA says Wi-Fi Protected Setup makes unauthorized access easier.
- Disable UPnP. If a smart device needs it during setup, turn it on only then and off afterward.
- Keep the firewall on and delete port-forwarding rules you do not need.
How do I open the router settings?
Most routers are managed through a web page or a phone app from the manufacturer or provider. The login details are usually printed on a label on the router, which is exactly why changing them matters. If you cannot find the steps, search your router model on the maker’s support site rather than a third-party forum.
Make changes one at a time and reconnect your devices afterward. Renaming the network or changing the passphrase will disconnect everything, so expect to re-enter the new Wi-Fi password on phones, TVs and smart speakers. Write the new details down somewhere safe, or store them in a password manager.
Should I set up a guest network?
Yes. CISA recommends a guest Wi-Fi network with its own long, random, unique password. Visitors and smart-home devices that only need internet access should join it, so they cannot reach your main network or router settings.
If your router supports a separate IoT network, iTechGuides suggests using it too, and confirming that guest and IoT networks cannot reach your private network unless you intend that. SecureIoT.house makes the same point: keep smart gadgets apart from banking, email and work devices.
When should I replace my router?
Updates and settings only help if the hardware is still supported. According to iTechGuides, replace the router if it:
- supports only WEP or legacy WPA;
- lacks WPA2-Personal with AES or WPA3 even after a firmware check;
- no longer receives security updates from the vendor or provider;
- has an unresolved critical vulnerability;
- cannot turn off or restrict internet-facing administration;
- cannot create a guest or IoT network when you need one.
The same source notes that a supported WPA2-AES router does not need replacing just because it lacks WPA3. If you do shop for a new one, our explainer on Wi-Fi 7 covers what newer standards add.
How do I keep it secure over time?
- Check for firmware updates at least quarterly if automatic updates are not available, as SecureIoT.house suggests.
- Review connected devices, admin accounts and DNS settings now and then. Unexpected DNS or port-forwarding changes deserve a closer look.
- Keep the router in a place where visitors cannot reach it, since physical access allows a factory reset and a return to default credentials, per CISA.
- Protect the accounts behind it too. See how to set up passkeys and our list of free password managers.
- If something looks wrong, read where to report a scam, and find more in our more security guides.
Frequently asked questions
Is changing the Wi-Fi password enough?
No. The admin login is separate. iTechGuides calls changing only the Wi-Fi password a common mistake. Change both.
Is WPA2 still safe?
WPA2 with AES is acceptable according to CISA, but WPA2 with TKIP, WPA and WEP are not. Use WPA3 Personal where your devices support it.
Do I need a guest network if I live alone?
It is still useful for smart-home devices that only need internet access, because it keeps them away from your computers and router settings.
What if my internet provider controls the router?
Ask the provider which settings you can change and how it delivers updates. If the device is out of support, ask for a replacement.