WiFi Router Security Checklist: 10 Settings to Change Right Now

Your router is the single gateway between every device in your home and the entire internet. A laptop, a phone, a smart TV, a security camera — they all trust it completely. Yet most routers sit for years running the same insecure factory defaults they shipped with, and most users never open the admin panel after setup.

This checklist covers the 10 settings that matter most. Each one takes under 15 minutes to change, and together they eliminate the most commonly exploited home network vulnerabilities.

How to Access Your Router Admin Panel

Before starting, you need to log into your router's configuration interface:

1. Open a browser and navigate to your router's IP address — usually 192.168.1.1 or 192.168.0.1
2. If those don't work, find the correct address:

- Windows: run ipconfig in Command Prompt → look for "Default Gateway"

- macOS: System Settings → Network → [connection] → Details → TCP/IP → "Router"

1. Log in with the admin credentials printed on the label attached to your router
2. If the label credentials don't work, try admin / admin or admin / password — common factory defaults

If you can log in with admin/admin, that's already a serious problem. Fix 1 below is your most urgent priority.

The 10-Step Security Checklist

1. Change the Default Admin Password

Risk: Critical

Default admin credentials are published in public databases indexed by Google. Anyone who can reach your router's admin panel — whether on your network or, if remote access is enabled, from the internet — can log in within seconds using a lookup table.

• Use a unique password of at least 16 characters combining uppercase, lowercase, numbers, and symbols
• Store it in a password manager (1Password, Bitwarden, etc.) — you rarely need it
• Change the admin username too if your router allows it (many do)

After changing this, log out and log back in to confirm the new credentials work before closing the tab.

2. Update Your Router's Firmware

Risk: Critical

Router firmware vulnerabilities are actively targeted by automated botnets. The Mirai botnet — which took down major internet infrastructure in 2016 — spread by exploiting default credentials and unpatched firmware on home routers. Similar campaigns run constantly.

1. In your admin panel, find Administration → Firmware Update (location varies by manufacturer)
2. Check for available updates and install any found
3. Enable automatic updates if the option exists
4. Mark a reminder to check manually every 3 months for routers without auto-update

Many router manufacturers stop releasing firmware updates for older models. If your router is more than 5–6 years old and no longer receives updates, replacing it is a legitimate security consideration.

3. Use WPA3 or WPA2-AES Encryption

Risk: High

The encryption protocol your WiFi uses determines how easy it is for a nearby attacker to intercept or crack your network traffic.

Enable WPA3 if your router supports it. If not, use WPA2 with AES (also shown as CCMP) — never TKIP. For a detailed explanation of what changed with WPA3 and why it matters, see our WiFi Security and WPA3 guide.

Find the setting under: Wireless → Security → Encryption or similar.

4. Disable WPS

Risk: High

WiFi Protected Setup (WPS) was designed to make it easy to connect devices by pressing a button or entering an 8-digit PIN. The PIN method has a fundamental design flaw: the PIN is validated in two halves, meaning an attacker only needs to brute-force 11,000 combinations instead of 100,000,000. Tools like Reaver can crack WPS PINs in hours.

Even if you disable PIN-based WPS, many routers have a "push button" WPS mode that remains vulnerable to attacks triggered during the 2-minute enrollment window.

Disable WPS entirely. The convenience of not typing a password once does not justify the attack surface it creates.

Find it under: Wireless → WPS or Advanced → WPS. Set to Disabled.

5. Change Your WiFi Network Name (SSID)

Risk: Medium

Default SSIDs like NETGEAR47, TP-Link_9823, or XFINITY-1A2B reveal your router manufacturer and sometimes your ISP. Attackers can use this to identify your exact router model and target known vulnerabilities for that specific hardware.

• Choose a name that doesn't identify you (avoid your address, name, or apartment number)
• Don't use something provocative that invites curious neighbors
• Create separate SSIDs for your main devices and IoT devices (see Fix 7)

Changing the SSID has no effect on encryption strength, but it removes a useful reconnaissance data point.

6. Disable Remote Management

Risk: High

Remote management allows access to your router's admin panel from outside your home network — useful for IT professionals managing client routers, but a significant attack surface for everyone else.

How to find it: Look for Remote Management, WAN Access, or Remote Administration in your admin panel's advanced settings.

Set it to Disabled unless you have a specific reason to need it. If you do need remote access to your home network, the correct approach is setting up a VPN rather than exposing the router admin panel directly to the internet.

7. Create a Separate Guest Network for IoT Devices

Risk: Medium-High

Smart TVs, thermostats, doorbells, security cameras, and other IoT devices are notoriously insecure. Many run outdated embedded Linux with years of unpatched vulnerabilities. Manufacturers frequently stop providing updates after 2–3 years. If one of these devices gets compromised, you want it isolated from your laptops and phones.

Create a guest network and move all IoT devices to it:

1. Enable Guest Network in your router settings
2. Give it a different SSID and strong password
3. Enable AP Isolation or Client Isolation — this prevents devices on the guest network from communicating with each other or with devices on the main network
4. Connect all smart home devices, streaming sticks, and cameras to this isolated network

This doesn't prevent a compromised IoT device from phoning home to an attacker-controlled server (it still has internet access), but it prevents lateral movement — an attacker who compromises your smart TV cannot directly reach your laptop.

8. Enable the Router Firewall

Risk: High

Most consumer routers include a built-in SPI (Stateful Packet Inspection) firewall that filters incoming traffic. Some ship with it disabled or in a partial configuration.

Find it under: Security → Firewall or Advanced → Firewall

Enable:

• SPI Firewall — inspects packets for signs of attack patterns
• DoS Protection — rate-limits connection attempts to prevent denial of service
• Block WAN Requests / Stealth Mode — prevents external scanners from seeing your router is present (your IP doesn't respond to pings from the internet)

These settings won't stop sophisticated targeted attacks, but they significantly reduce automated scanning and opportunistic intrusion attempts.

9. Configure Secure DNS on the Router

Risk: Medium

By default, your router uses your ISP's DNS servers, which may be slow, unreliable, or subject to government-mandated content filtering. More importantly, unencrypted DNS queries expose every domain your household visits to your ISP and any network observer.

Configure your router to use a privacy-respecting DNS provider:

Find the DNS settings under: WAN → DNS Settings or Internet → DNS. Replace your ISP's DNS with your chosen provider's addresses.

For encrypted DNS (DNS over HTTPS), some routers support this natively (Asus with Merlin firmware, Synology, pfSense, Firewalla). If yours does, enabling DoH prevents even your ISP from seeing which domains you're resolving. See our DNS over HTTPS guide for setup details.

10. Review Connected Devices Regularly

Risk: Medium (ongoing)

Once your router is secured, make it a habit to check who's connected. Most routers list connected devices under: DHCP Client List, Connected Devices, Device Manager, or Network Map.

Look for:

• Unfamiliar device names — could be a neighbor who guessed your password or a device you forgot about
• Devices connected at unexpected hours — activity at 3am from a device you thought was off
• Unusually high traffic from a single device — potential sign of malware or unauthorized use

If you find an unauthorized device, change your WiFi password immediately. All legitimate devices will need to reconnect, but the unauthorized device will be removed.

Full Checklist Summary

After Completing the Checklist

• Use our Public WiFi Security guide to protect yourself on networks you don't control
• Run a DNS Leak Test to confirm your DNS traffic is going to the provider you configured
• Check what an attacker can do with IP information in our guide on what someone can do with your IP address

Related Articles

• WiFi Security and WPA3: What Changed and Why It Matters
• Public WiFi Security Risks: What You're Really Exposed To
• Network Security Basics: How to Protect Your Home Network