Why the router matters

The router or modem your provider installed sits between every phone, laptop, camera and smart TV in the house and the internet. If someone takes control of it, they can change DNS to redirect you to fake websites, watch traffic, or use your connection for attacks.

Automated scanners constantly probe home internet addresses for admin pages, old firmware and default passwords. Most compromises are not targeted; they hit whichever device answers with a known weakness.

The good news is that a handful of settings, done once, remove most of that risk.

Change the admin and Wi-Fi passwords

Log in to the router, usually at 192.168.1.1 or 192.168.0.1, using the details on the label. Change the administrator password first. This is separate from the Wi-Fi password and protects the settings page itself.

Then set Wi-Fi security to WPA2-AES or WPA3, or the mixed WPA2/WPA3 mode if older devices must connect. Choose a long passphrase of several unrelated words rather than a phone number or birthday, which are easy to guess.

If your provider manages the modem remotely, ask them to confirm you can change the admin password without breaking their support access.

A typical secure configuration
Admin password:   changed from default (long, unique)
Wi-Fi security:   WPA2/WPA3 (AES)
Wi-Fi password:   four or more random words
WPS:              Off
Remote admin:     Off
UPnP:             Off unless a specific device needs it

Keep firmware up to date

Firmware is the router operating system. Vulnerabilities are found regularly, and only updates fix them. Look for Firmware upgrade or System in the settings, and turn on automatic updates if available.

Provider-supplied modems are often updated remotely, but not always. If your router is very old and no longer receives updates, replacing it is a real security improvement, not just a speed upgrade.

Restart the router after updating and check that your settings survived.

Turn off features you do not use

WPS lets devices join with a button press or PIN; the PIN method in particular has known weaknesses. Remote management exposes the admin page to the internet. UPnP allows any device inside your home, including infected ones, to open ports automatically.

Disabling these rarely affects normal browsing or streaming. Some games and cameras rely on UPnP; if something breaks, forward only the specific port it needs instead of switching UPnP back on for everything.

  1. Disable WPS, especially the PIN method.
  2. Disable remote administration from the WAN side.
  3. Disable UPnP or limit it to trusted devices.
  4. Disable Telnet or SSH services you never use.
  5. Create a guest network for visitors and smart devices.
  6. Remove old port forwarding rules.

Check what the internet can see

After changing settings, use a port checker from outside your network to test common ports such as 80, 443, 8080, 22, 23 and the port of any camera or recorder. Ideally they should all show as closed unless you deliberately host something.

Also look at the router device list for unknown devices, and confirm that the DNS servers shown in the router status are the ones you chose or your provider default. Unexpected DNS servers can be a sign of tampering.

If you use IPv6, make sure the router firewall blocks unsolicited incoming connections on IPv6 too.

Limits and common questions

A secure router does not protect devices that are already infected, or accounts that use weak passwords elsewhere. Keep phones and computers updated and use two-factor authentication on important accounts.

Should I hide my Wi-Fi name? It adds little security because the name is still visible to scanning tools, and it can cause connection problems.

Is MAC filtering worth it? It is easy to bypass and tedious to maintain; a strong password and WPA2 or WPA3 matter much more.