Your router is the single device that every phone, laptop, smart TV, and IoT gadget in your home passes traffic through. An unsecured router is not just a risk to your data — it can be enrolled in botnets, used to launch attacks on others, and exploited to intercept everything you do online. Most home routers ship with weak defaults. This 2026 checklist covers every step that actually matters, in order of importance.
What changed in 2026
- WPA3 is now standard on routers above the budget tier — enable it if your router supports it; most post-2020 devices can connect.
- Automatic firmware updates are enabled by default on many 2026 routers (Asus, TP-Link, Netgear) — verify yours is on and check it is running the latest version.
- UPnP exploitation remains common — scan tools like Shodan show millions of home routers with UPnP open to the internet.
- IoT device proliferation means the average home now has 15–25 connected devices, many of which ship with hardcoded credentials and receive no security updates.
The security checklist
1. Change admin credentials
Log into your router (usually 192.168.1.1 or 192.168.0.1) and change both:
- Admin username (if changeable) — do not use "admin"
- Admin password — use a unique, 20+ character passphrase
Never use the same password as your Wi-Fi password or any other account.
2. Update firmware
Router → Administration or System → Firmware Update. Enable automatic updates if available. If your router has not received a firmware update in 2+ years from the manufacturer, it is end-of-life — consider replacing it.
3. Set Wi-Fi security to WPA3 or WPA2-AES
Wireless Settings → Security Mode:
- Best: WPA3-Personal
- Good: WPA2-AES (CCMP) — acceptable if some older devices cannot do WPA3
- Never use: WEP, WPA-TKIP, or "Mixed WEP/WPA" — all are cryptographically broken
4. Disable WPS (Wi-Fi Protected Setup)
Wireless Settings → WPS → Disable. The WPS PIN mode is vulnerable to brute force attacks that can recover the network key in a few hours regardless of your Wi-Fi password strength.
5. Disable remote management
Administration → Remote Management → Disable (or ensure it is off). This prevents the router's admin panel from being accessible from the internet (WAN side). There is no good reason to have this on for a home router.
6. Disable UPnP
Advanced → UPnP → Disable. UPnP allows devices on your network to automatically open ports — useful for gaming in the 2000s, now exploited by malware to create backdoors. Manually port-forward only what you need.
7. Create a guest network for IoT devices
Wireless → Guest Network → Enable. Put all smart home devices (thermostats, cameras, bulbs, plugs) on the guest network, which is isolated from your main network where computers and phones live. A compromised smart plug cannot reach your laptop on a different VLAN/guest network.
8. Use strong Wi-Fi passwords
Wi-Fi password should be 16+ characters, random. Change it if you have shared it widely or if the router is second-hand.
9. Check connected devices
Router → Connected Devices or DHCP Clients. Review the list. Any device you do not recognize warrants investigation — it could be a neighbor freeloading or a compromised device.
Settings comparison: safe vs. risky
| Setting |
Safe |
Risky |
| Wi-Fi encryption |
WPA3 or WPA2-AES |
WEP, WPA-TKIP |
| Admin password |
Unique 20+ char passphrase |
"admin", "password", blank |
| WPS |
Disabled |
Enabled |
| Remote management |
Disabled |
Enabled |
| UPnP |
Disabled |
Enabled |
| Firmware |
Auto-update on, current |
2+ years outdated |
| IoT devices |
On isolated guest VLAN |
On main network |
How to pick what to do first
- 5 minutes: Change admin password + disable remote management — biggest bang for time.
- 5 more minutes: Update firmware + disable WPS.
- 10 minutes: Set WPA3 + create guest network for IoT.
- Ongoing: Review connected devices list monthly; check firmware monthly if auto-update is not available.
Common mistakes
Setting the Wi-Fi password as the admin password. These should be completely different. The Wi-Fi password is shared with guests; the admin password should never leave you.
Ignoring the router after initial setup. Router vulnerabilities (like CVEs in popular Netgear and TP-Link models) are actively exploited. Treat firmware updates like OS updates — essential, not optional.
Putting all devices on one network. A flat home network means a hacked smart camera can scan and attack your laptop. Segment IoT devices onto a guest or separate VLAN.
Using a router the ISP provided and never touching it. ISP routers often have outdated firmware, remote access features enabled by default, and the ISP may have administrative access. A personal router in bridge mode after the ISP modem gives you full control.
Keeping the default SSID. SSIDs like "NETGEAR_EXT" or "Linksys00892" reveal the router model, making targeted vulnerability attacks easier. Use a neutral, non-identifying name.
What to skip
- Hiding your SSID — this provides no real security benefit (the SSID is still visible in probe requests) and breaks convenience for legitimate devices.
- MAC address filtering as a security measure — MAC addresses are trivially spoofed and do not prevent a determined attacker. Okay for parental convenience, not for security.
- Over-engineering firewall rules before covering the basics above — the checklist items above matter far more for a home network.
FAQ
How do I know if my router has been compromised?
Signs: unknown devices in the connected list, DNS settings changed from what you set, sluggish speeds, admin password no longer works, or router logs showing outbound connections to unusual IPs. Run a scan with tools like Fing or your router's own logs.
My router is several years old — should I replace it?
If it has not received firmware updates in 18+ months and has known unpatched CVEs (check the vendor's security advisory page), yes. A $70–$100 modern router with WPA3 and active support is a meaningful security upgrade.
Is WPA2 still okay in 2026?
WPA2 with AES (not TKIP) remains unbroken in practice for home users — the main weakness (KRACK) requires attacker proximity and has been patched on all modern OS clients. Upgrade to WPA3 if your router and devices support it, but WPA2-AES is not a crisis.
Do I need to change the Wi-Fi password if my router was set up years ago?
Only if you have shared it with people you no longer trust, if the router was second-hand, or if you suspect a breach. Otherwise, a strong password set initially remains strong.
Where to go next
See how to set up a VPN on a router in 2026, how to block ads network-wide in 2026, and how to set up two-factor authentication in 2026.