A Wi-Fi router is the gateway to your whole home network, so its settings deserve more attention than most people give them.
Your Wi-Fi router is the single device that connects every phone, laptop, television, and smart gadget in your home to the internet, which makes it one of the most valuable targets for an attacker.
Most people never change a single setting after installation, which means their router keeps running with factory passwords, outdated software, and features switched on that nobody in the house actually uses.
That is a problem because anyone within radio range of your home, or anyone who finds a flaw in your router software, can potentially reach every device on your network through that one box.
The good news is that securing a router does not require technical skill or new hardware, because the ten settings in this guide are already built into almost every modern router.
Working through them takes roughly half an hour, and once they are set, your home network becomes dramatically harder to break into, snoop on, or use without your permission.
Start with the first two steps, because they close the most common ways into a home network, then work through the rest in order and save each change as you go.
How to Log In to Your Router
Before changing anything, you need to open your router admin panel, which is a settings website that runs on the router itself and is separate from your Wi-Fi password.
Connect a phone or computer to your home Wi-Fi network, open a browser, and type the router address into the address bar, which is usually 192.168.1.1 or 192.168.0.1 for most brands.
If neither address works, check the sticker on the bottom or back of your router, because it normally prints the correct address, the default username, and the default password.
On a Windows computer, you can also find the address by opening a command prompt and typing ipconfig, then looking for the Default Gateway number next to your Wi-Fi adapter.
On a Mac, open System Settings, then Network, then Wi-Fi, and click Details to see the router address listed there, which is the same address you type into your browser.
Once the login page appears, enter the admin username and password from the sticker, but remember that changing those credentials is the very first setting on the list below.
Your admin password and your Wi-Fi password are two different passwords, and changing one does not change the other, so you need to secure both.
10 Settings to Change Right Now
Change the default admin password. The admin password controls the router itself, so anyone who knows it can change your Wi-Fi password, turn off your firewall, or lock you out of your own network completely.
Factory admin credentials are published in manuals and leaked online for almost every popular router model, which means an attacker does not need to guess them, they only need to look them up.
Open the Administration, System, or Management section of your router settings, set a long and unique password that you store in a password manager, and change the default username too if your router allows it.
Update the firmware, then turn on automatic updates. Firmware is the software that runs your router, and manufacturers release updates to fix security flaws in the same way phone makers patch phones and computers.
Flaws such as KRACK, FragAttacks, and Dragonblood affected Wi-Fi itself in past years, and the fixes for them arrived only through router firmware updates, not through any setting on your phone.
Look for Firmware Update, System Update, or Maintenance in your router settings, install any available update, and switch on automatic updates if your model offers them, so future fixes arrive without you remembering to check.
Switch to WPA3 encryption, or WPA2 with AES if WPA3 is unavailable. Encryption is what stops a neighbour or passer-by from reading your Wi-Fi traffic, and the standard you choose decides how strong that protection really is.
Choose WPA3-Personal where your devices support it, because it uses stronger authentication and protects each device session individually, even if someone later learns the Wi-Fi password.
If some older devices cannot connect to WPA3, use WPA2/WPA3 transitional mode, or WPA2-Personal with AES encryption, and never use WEP or the original WPA, because both can be cracked with freely available tools.
Set a strong, unique Wi-Fi password. Your Wi-Fi password is the key to your home network, so it should be long, unique, and unrelated to your name, address, phone number, or any password you use elsewhere.
A passphrase of three or four random words, or a password of at least sixteen characters with letters, numbers, and symbols, is far harder to guess than a short word with a year at the end.
Save the new password in a password manager, then reconnect your phones, laptops, and smart devices, because changing it will disconnect every device until you enter the new one.
Turn off WPS completely. Wi-Fi Protected Setup, or WPS, was designed to make connecting devices easier, but its PIN method has a serious design flaw that lets an attacker guess the PIN in hours on vulnerable routers.
Security agencies have warned about WPS PIN attacks since 2012, and turning the feature off is still the standard advice, because the flaw cannot be fixed by choosing a stronger Wi-Fi password.
Find WPS under Wireless, Advanced, or WPS settings, switch it off entirely, and add new devices by typing the Wi-Fi password instead, which is only slightly less convenient and far safer.
Disable remote management and remote administration. Remote management lets someone open your router login page from anywhere on the internet, which turns a local risk into a global one, because attackers can scan for exposed routers automatically.
Unless you specifically manage your home network while travelling, there is no reason for that door to be open, and most homes never need it at all.
Look under Administration, Management, or Remote Access, make sure remote management and WAN-side administration are switched off, and check that only devices on your home network can reach the login page.
Set up a guest network for visitors and smart devices. A guest network is a second Wi-Fi network with its own name and password, and on most routers it is isolated from your main network by default.
That isolation matters, because visitors only need internet access, not access to your shared files, printers, or smart home controls, and a cheap smart gadget with weak security should never sit on the same network as your laptop.
Enable the guest network under Wireless or Guest Network settings, give it a different password from your main network, and put visitors, smart plugs, cameras, and other less-trusted devices on it.
Change the default network name, and do not identify your household. The network name, or SSID, is what your neighbours see when they scan for Wi-Fi, and the factory name often reveals your router brand or internet provider.
A name that includes your surname, house number, or street address tells strangers exactly whose network they are looking at, which is information they do not need.
Pick a neutral name that says nothing about you, use the same name for both the 2.4 GHz and 5 GHz bands if your router merges them, and avoid hiding the SSID as your only defence, because hidden networks are still easy to discover.
Turn on the built-in firewall and check for UPnP. A router firewall blocks unsolicited traffic from the internet from reaching your devices, and on most routers it is already switched on, but it is worth confirming rather than assuming.
Universal Plug and Play, or UPnP, is a different feature that lets devices on your network open inbound ports automatically, which is convenient for games but can also be abused by malware to open doors without asking you.
Check the firewall setting under Security or Firewall, switch off UPnP unless a specific game or app genuinely needs it, and create a single manual port forward for that app instead of leaving UPnP open for everything.
Review connected devices regularly and remove anything unknown. Even a perfectly configured router can be undermined by a device you no longer recognise, whether it is an old phone, a visitor who kept the password, or a stranger who guessed it.
Open the Devices, Clients, or Attached Devices page in your router settings and read the whole list slowly, renaming the devices you recognise so future checks are faster.
Investigate anything unfamiliar, change your Wi-Fi password if you cannot identify it, and repeat this check every month, because a quick review costs minutes and catches problems early.
What to Do After Changing the Settings
Once you have saved the ten changes, restart your router so every setting takes effect cleanly, then reconnect your devices one by one with the new Wi-Fi password.
Reconnecting everything is also a useful test, because any device that fails to connect may need its saved network forgotten and re-added, which is normal after a password or encryption change.
If an older device, such as a printer or a smart plug, refuses to connect to WPA3, move it to the guest network or switch the main network to WPA2/WPA3 transitional mode rather than dropping the whole network back to an outdated standard.
Write down what you changed, or at least store the new admin and Wi-Fi passwords in a password manager, because a factory reset wipes every setting and you will want to restore them quickly.
A factory reset is also the right response if you ever suspect your router has been compromised, since it clears any changes an attacker made, after which you can work through this checklist again from scratch.
Finally, set a reminder to check for firmware updates and review connected devices every few months, because router security is not a one-time job, it is a habit that stays effective only while it is maintained.
Frequently Asked Questions
What is the difference between the admin password and the Wi-Fi password?
The admin password unlocks the router settings page, while the Wi-Fi password lets a device join your wireless network, and the two passwords serve completely different purposes in your home.
An attacker with your Wi-Fi password can use your internet connection, but an attacker with your admin password can change every setting on the router, including the Wi-Fi password itself.
That is why both passwords must be strong and different from each other, and why the admin password should never be left at its factory default.
Should I hide my Wi-Fi network name?
Hiding your SSID stops the name from appearing in the normal Wi-Fi list, but it does not hide the network from anyone using a basic scanning tool, so it should never be your main defence.
A hidden network can also cause connection problems for some devices, which may keep broadcasting the name while searching for it, potentially revealing it in more places than a visible network would.
Focus on strong encryption and a strong password first, and treat hiding the SSID as an optional extra rather than a security measure you rely on.
Will changing these settings slow down my internet?
Switching to WPA3 or WPA2 with AES encryption has no noticeable effect on internet speed for a normal home connection, because modern routers handle encryption in hardware without breaking a sweat.
A guest network may share your total bandwidth with visitors, but that only matters while guests are actively using it, and many routers let you limit guest bandwidth if you want to.
If your connection feels slower after the changes, restart the router and check for a firmware update, because a genuine slowdown is far more likely to come from an outdated router or a congested channel than from encryption.
When should I replace my router instead of updating it?
Replace your router when the manufacturer no longer releases firmware updates for it, because an unpatched router cannot be secured by settings alone, no matter how carefully you configure them.
Most reputable brands support a router for several years, but internet provider routers and very cheap models sometimes stop receiving updates much sooner, so check the support page for your model.
If your router cannot use WPA2 with AES at minimum, or if it has known flaws with no fix available, replacing it is cheaper than dealing with a compromised home network later.
Is MAC address filtering a good extra layer?
MAC address filtering lets only approved devices join your network, but device addresses are easy to copy, so it adds inconvenience for you without stopping a determined attacker.
It can still be useful as a housekeeping tool, because it forces you to list your devices, but it should never replace strong encryption, a strong password, and regular device reviews.
Think of it as a guest list at a door with no lock, helpful for knowing who should be there, but useless on its own against someone who simply copies a name from the list.
Securing your router is one of the highest-value jobs in home technology, because a single hour of settings changes protects every device that connects through it for months afterwards.
Work through the ten settings, save your new passwords safely, and check your firmware and connected devices from time to time, and your home network will be far harder to break into than the vast majority of routers around it.