Secure administrative access
Every router ships with a default username and password that is often printed on the device label or published online. Leaving these credentials unchanged allows anyone on the local network to log in and alter settings. Begin by logging into the router’s administration page, usually reached at an address such as 192.168.1.1 or 192.168.0.1. Replace the default username if the interface permits it, and create a new password that is at least 12 characters long and contains a mix of letters, numbers, and symbols. After saving the change, immediately log out and test the new credentials. The FTC notes that a strong administrative password prevents attackers from modifying the Wi-Fi password or other settings even if they gain local network access.
- Use a password manager to generate and store the new credentials.
- Avoid reusing passwords from other accounts.
- If the router supports it, enable multi-factor authentication for the admin interface.
Apply firmware and software updates
Manufacturers release firmware updates to correct security vulnerabilities and improve stability. An unpatched router remains exposed to known exploits long after patches become available. Visit the manufacturer’s support site or check the router’s administration page for an update section. Download the latest firmware that matches your exact model number, then follow the on-screen instructions to install it. Some routers from ISPs receive automatic updates; confirm this behavior with your provider. After installation, reboot the router and verify that the version number has changed. CISA recommends enabling automatic updates when the option exists, because manual checks are easy to forget over time.
- Record the current firmware version before updating.
- Do not interrupt the update process once it begins.
- If the router is leased from an ISP, ask whether the provider pushes updates centrally.
Configure Wi-Fi network settings
The Wi-Fi network name and password control who can join your local network. Default network names often reveal the router model, giving attackers a head start on guessing credentials. Change the SSID to a neutral name that does not identify the device or your location. Replace the default Wi-Fi password with a long, random passphrase. Set the encryption method to WPA3 Personal when available; otherwise use WPA2 AES. Older protocols such as WEP or WPA TKIP are considered insecure and should be disabled. CISA explicitly lists WPA3 Personal and WPA2 AES as the only encryption options regarded as safe against current threats.
- Create a separate guest network for visitors and IoT devices.
- Disable WPS, which can be exploited to bypass the passphrase.
- Disable UPnP after initial device setup to limit malware spread.
Disable remote management
Remote management features allow configuration changes from outside the local network. While convenient, they expose the router’s login page to the public internet and are a frequent vector for compromise. Locate the remote management, WAN access, or remote administration setting and turn it off. Also disable any listed remote protocols such as Telnet or HTTP access from the WAN side. After disabling these options, confirm that the router remains reachable only from devices connected to your local network. The Australian Cyber Security Centre and CISA both identify remote management as one of the most common ways routers are taken over.
- Test connectivity from a mobile device on cellular data to verify remote access is truly closed.
- If remote access is required for legitimate reasons, restrict it to specific IP addresses and enable strong authentication.
Back up configuration and plan recovery
Router settings can be lost after a firmware update, power failure, or reset. Most administration interfaces include an option to export the current configuration to a file. Save this backup to an encrypted external drive or secure cloud folder after completing the security changes. Store the file alongside the router’s model number and firmware version so you can restore matching settings later. Test the restore procedure on a non-production device if possible. A documented backup reduces the time needed to return the network to a known secure state. NIST guidance on consumer routers emphasizes that configuration backups support both recovery and forensic review after an incident.
- Name the backup file with the date and router model for easy identification.
- Store at least one copy offline in case the primary storage becomes unavailable.
- Re-export the configuration after any future setting changes.
Final verification and ongoing habits
After completing the changes, reboot the router and confirm that all devices reconnect using the new Wi-Fi credentials. Review the connected-devices list to ensure no unknown entries appear. Schedule a calendar reminder to repeat the firmware check every three to six months or whenever the manufacturer issues a security advisory. Keep physical access to the router limited by placing it in a location where visitors cannot reach the reset button or Ethernet ports. These habits maintain the protections established during the initial review and reduce the likelihood of gradual configuration drift.
- Document the new administrative password location and backup file path.
- If issues arise after changes, use the saved configuration file to restore previous settings quickly.