Your Router Is the Weakest Link: 5 Settings to Change Today
Your router is the one device that sits between the internet and everything you own: the laptops, the phones, the cameras, the kids’ tablets. It’s also, in most homes, the device nobody has looked at since the day the internet started working. That combination makes it the weakest link in your home’s security. The good news is that fixing it costs nothing and takes one evening. Here are the five settings we’d change tonight, in order.
1. Change the admin password (not the Wi-Fi one)
Your router has two passwords, and most people only know about one of them. The Wi-Fi password gets devices onto your network. The admin password opens the router’s settings page, where every other control in this article lives. On a lot of home routers it’s still whatever shipped in the box: printed on a sticker, or worse, something like “admin” that’s published in a manual anyone can download. Open your router’s app, or type its address into a browser (often 192.168.1.1), log in, and find the admin or system password setting. Make the new one long and unique, and store it in your password manager, because you’ll need it for the rest of this list.
2. Turn on automatic firmware updates
Firmware is the software the router itself runs, and like all software it has security bugs that get fixed over time. The catch is that a router won’t nag you the way your phone does; it will happily run five-year-old software forever unless you tell it otherwise. Somewhere in the settings there’s an option for automatic updates. Turn it on and you’re done. The honest caveat: manufacturers eventually stop updating older models entirely. If your router hasn’t received an update in a couple of years, or the maker has declared it end of life, no setting can fix that. That’s the one case where spending money on a new router is genuinely the right call, because a router that can’t be patched stays vulnerable no matter what you do.
Nobody is sitting outside your house targeting you personally. Automated scanners knock on every router on the internet, all day, every day, and they only need one unlocked door.
3. Check your encryption: WPA2 at minimum, WPA3 if offered
In the wireless settings you’ll find a security mode, usually a dropdown with names like WPA2, WPA3, or a combined mode. Pick WPA3 if your router offers it, or WPA2 (sometimes labeled WPA2-PSK or WPA2-AES) if not. The combined WPA2/WPA3 mode is a fine middle ground, since older devices can’t always speak WPA3. What you never want to see selected is WEP or an open network; both are effectively no lock at all by modern standards. While you’re in there, look at the Wi-Fi password itself. If it’s short, shared with half the neighborhood, or the same one you use elsewhere, change it to something long and unique. A passphrase of several random words is easy to type into a TV and hard to crack.
4. Turn off the conveniences you don’t use
Routers ship with a few features designed to make life easier that mostly make attacks easier. The first is WPS, the push-button pairing feature; it has a long history of weaknesses, and almost nobody actually uses it, so switch it off. The second is remote management (sometimes called remote access or web access from WAN), which lets someone log into your router’s settings from the internet. Unless you specifically set that up on purpose, it should be off. The third, if you want extra credit, is UPnP, which lets devices open holes in your firewall on their own. Turning UPnP off can occasionally affect game consoles and a few apps, so treat it as optional: try it, and turn it back on if something you rely on breaks.
5. Turn on the guest network, and actually use it
Almost every modern router can run a second Wi-Fi network that’s walled off from your main one. It’s made for visitors, and it’s also the perfect place for the devices you trust least: the smart plugs, the cameras, the doorbell, the TV. If one of those gadgets is ever compromised, it can’t reach the laptops and phones that hold your real life. We’ve written a whole guide to this idea, network segmentation, and the ten-minute version is simply: enable the guest network, give it a strong password, and move your smart-home devices onto it. Of the five settings here, this one pays off the most over time.
The short version
Change the admin password so the settings page isn’t open to anyone with the default. Turn on automatic firmware updates, and replace the router only if it no longer gets them. Set encryption to WPA2 at minimum, WPA3 where offered, with a long Wi-Fi passphrase. Switch off WPS and remote management. And turn on the guest network for your smart devices. Five free changes, one evening, and your home network goes from the weakest link to a door that automated attacks simply pass by.
Frequently asked questions
What's the most important router setting to change?
The router's admin password, which is separate from your Wi-Fi password. It often ships as a default that's printed in public manuals, so changing it locks the control panel of your whole network.
Is it safe to leave WPS turned on?
It's best to turn WPS off. The push-button pairing feature can let attackers guess their way onto your network, and you rarely need it once your devices are connected.
Should I put smart devices on a separate network?
Yes. A guest network keeps cameras, plugs, and speakers walled off from your laptop and files, so if one cheap device is ever compromised it can't reach the things that matter. Most routers have this built in.