iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure the router first, then reduce what every connected device can reach. Change the router’s administrator and Wi‑Fi credentials, install all available updates, use WPA3 Personal (or WPA2 Personal), disable unnecessary exposure such as remote management, WPS and UPnP, and place smart-home equipment on an isolated guest or IoT network. Then harden each device and prepare an offline recovery plan.
A router is the security gatekeeper for the home: if an attacker controls it, they may redirect traffic, expose sensitive information, reach other devices or recruit vulnerable equipment into a broader attack. The steps below prioritize changes that reduce both the chance of compromise and the damage if one device is breached.
What a large-scale attack could mean for a home network
A large-scale cyberattack might target internet service providers, cloud services, consumer routers, or a particular class of cameras and appliances. You cannot predict which campaign will occur, but you can limit the paths an attacker would use inside your home.
NIST describes routers as “the gatekeepers of our networks,” because they manage data moving between household devices and the internet (NISTIR 8425A, 2024). A compromised router can alter DNS responses, expose administrative interfaces, observe unencrypted traffic, or provide a bridge to laptops, phones, storage systems and work equipment. A vulnerable camera or plug may also become an entry point for lateral movement if it shares the same unrestricted network.
#1 Best Overall
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝐖𝐢-𝐅𝐢 𝟕 - Optimize performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, Samsung Galaxy S24 Ultra, and PS5 Pro with the latest WiFi 7 technology with Multi-Link Operation, Multi-RUs, 4K-QAM, and up to 320 MHz channels.◇△
- 𝟕-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐁𝐄𝟗𝟕𝟎𝟎 𝐓𝐫𝐢-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐒𝐩𝐞𝐞𝐝𝐬 - Delivers smooth 4K/8K streaming, immersive AR/VR gaming, and blazing-fast downloads with speeds up to 5,765 Mbps on the 6 GHz band, 2,882 Mbps on the 5 GHz band, and 1,032 Mbps on the 2.4 GHz band.⌂
- 𝐌𝐚𝐱𝐢𝐦𝐢𝐳𝐞𝐝 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 - Up to 2,600 sq. ft. coverage for up to 120 devices at a time. 6 optimally positioned antennas and Beamforming technology focus Wi-Fi signals toward hard-to-cover areas for stronger coverage-—ideal for those seeking the best WiFi router for large homes.
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭 𝐟𝐨𝐫 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐯𝐢𝐭𝐲 - Features 1x 10 Gbps WAN/LAN port, 1x 2.5 Gbps WAN/LAN port, and 3x 2.5 Gbps LAN ports. Integrate with a multi-gig modem for fast, wired gig+ internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
There is no authoritative probability figure for a future, large-scale attack on home routers. Preparation therefore means reducing unnecessary exposure, separating trust zones, keeping software support current and ensuring that you can rebuild the network without relying on an online account.
Start with a complete inventory
You cannot secure devices you have forgotten. Build the inventory from the router’s connected-device, DHCP-client or network-map view, then verify it room by room.
Record these details for every device
- Device type and location: router, camera, doorbell, television, speaker, printer, thermostat, appliance, hub or game console.
- Manufacturer, exact model and hardware revision.
- Current firmware or operating-system version.
- The owner account, email address and sign-in method used to control it.
- How updates are delivered: automatic, mobile app, web console, manual file or no longer supported.
- Vendor security-support end date, if published.
- Whether it stores recordings, credentials, personal data or access to a physical door.
Label unknown entries before deleting them. A device with a generic hostname may be a printer, streaming box or an old phone. Check MAC addresses and temporarily disconnect suspected equipment to identify it. CISA’s 2025 Internet Exposure Reduction Guidance recommends routinely assessing internet-accessible assets and replacing products that no longer receive security support.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesClassify devices by trust
- High trust: work computers, personal phones, password managers, network-attached storage and backup systems.
- Medium trust: printers, game consoles and household devices that receive regular updates but need local-network access.
- Low trust: inexpensive plugs, cameras, speakers and appliances with limited update history or broad cloud access.
This classification determines which devices may share a network. Unsupported equipment should be scheduled for replacement rather than treated as permanently safe.
Harden the router before changing individual gadgets
Use the router’s local administration page or official mobile app. Menu names differ, so look for sections called Administration, Advanced, Security, Wireless, Internet or System.
Rank #2
- 𝐁𝐄𝟗𝟕𝟎𝟎 𝐓𝐫𝐢-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐒𝐩𝐞𝐞𝐝𝐬: Features up to 320 MHz channels on the 6 GHz band, enabling seamless 8K streaming and high-speed downloads. Optimize performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra. ⌂◇
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭 𝐟𝐨𝐫 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠𝐚𝐛𝐢𝐭 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐯𝐢𝐭𝐲 : Features one 10 Gbps WAN port, four 2.5 Gbps LAN ports and one USB 3.0 port for super-fast connections and data transfers, maximizing device performance.§ Integrate with a multi-gig modem for gigplus internet.
- 𝐄𝐱𝐩𝐚𝐧𝐝 𝐖𝐢𝐅𝐢 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐄𝐚𝐬𝐲𝐌𝐞𝐬𝐡: Extend network range even more by adding EasyMesh-compatible routers, extenders, or wireless powerline adapters for a seamless, whole-home connection. Eliminate dead zones, drops, and lag as you move across your home.
- 𝐄𝐚𝐬𝐲 𝐒𝐞𝐭𝐮𝐩 𝐰𝐢𝐭𝐡 𝐓𝐞𝐭𝐡𝐞𝐫 𝐀𝐩𝐩: Set up your Archer BE550 Pro in minutes with the Tether app or web interface. Manage network settings from any Android or iOS device with the Tether app.
- 𝐅𝐚𝐫-𝐑𝐞𝐚𝐜𝐡𝐢𝐧𝐠 𝐖𝐢-𝐅𝐢 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞: 6 optimally positioned antennas and Beamforming technology boost and direct Wi-Fi signals to reach every corner of your home, even hard-to-reach areas. Ensures stable connection for remote workers, gamers, students, and more.
1. Change both sets of credentials
- Sign in with the router’s current administrator account.
- Change the administrative username if the firmware permits it, and set a long, unique password. Do not reuse this password on Wi‑Fi, email or any other service.
- Change the Wi‑Fi network name (SSID) and Wi‑Fi password. Avoid names that reveal your address, surname or router model.
- Save the changes, reconnect your devices and record the new credentials in an offline password manager or other protected backup.
Changing only the Wi‑Fi password leaves the management account exposed; changing only the administrator password leaves previously shared wireless credentials active.
2. Install firmware and enable safe updates
Check the router’s firmware page for the newest release, read its security notes, and apply it from a wired connection when practical. If the router offers automatic security updates, enable them. Confirm the installed version afterward and keep a note of the date.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Do not install firmware from an unverified download or interrupt power during an update. If the vendor has ended security support, plan a replacement even if the router still works.
3. Use modern Wi‑Fi encryption
Enable WPA3 Personal where all important clients support it. If WPA3 is unavailable, use WPA2 Personal with AES. The Federal Trade Commission describes WPA3 as the newer and best available home Wi‑Fi encryption and identifies WPA and WEP as outdated. A router limited to WEP or obsolete WPA should be replaced after checking whether a firmware update adds WPA2 or WPA3.
Mixed WPA2/WPA3 mode can help older devices connect, but it provides a weaker fallback for those clients. Move incompatible equipment to a separate network or replace it instead of lowering protection for the main network.
Rank #3
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
4. Turn off convenience features that increase exposure
Follow the FTC’s consumer guidance and disable these settings unless you have a documented need:
- Remote management: prevents administration from the public internet. Manage the router locally instead.
- Wi‑Fi Protected Setup (WPS): removes a shortcut that is unnecessary once devices are configured.
- Universal Plug and Play (UPnP): stops devices from automatically opening inbound rules.
After disabling them, test the services you actually use. If a game, camera or other application requires one, enable the narrowest supported alternative and document why it is needed.
5. Remove unintended internet paths
- Open Port Forwarding, Virtual Server and DMZ pages.
- Delete entries you do not recognize or no longer need.
- Never place a laptop, storage system or whole home network in the DMZ as a shortcut for troubleshooting.
- Review firewall and access-control rules for broad “allow any” entries.
- Check the router’s status and event pages for unexpected administrative logins or configuration changes.
Keep the router firewall enabled. Where the firmware supports it, restrict management to a trusted local device and block inbound connections by default.
Separate smart-home devices from computers
The goal of segmentation is containment: a compromised plug or camera should not be able to browse your laptop, work files, printer or network storage.
Create an IoT or guest SSID
- Open Wireless or Network settings and create a dedicated IoT SSID. If the router has no IoT option, use its guest network.
- Give the SSID a distinct name and a unique WPA2 or WPA3 password.
- Enable the setting usually called Guest isolation, Allow guests to access the local network (turn it off), or AP isolation.
- Connect cameras, plugs, speakers, televisions and appliances to this SSID.
- Keep laptops, phones used for banking, NAS systems and work equipment on the primary network.
Isolation must be tested, not assumed. From a laptop on the primary network, verify that you cannot open the IoT device’s administration page. From an IoT device, verify that it cannot reach shared folders, printers or other clients on the primary network. Some devices need local discovery or casting; if isolation breaks that function, keep the device segregated and use a controlled exception only if the router supports one.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- 𝐅𝐚𝐬𝐭, 𝐫𝐞𝐥𝐢𝐚𝐛𝐥𝐞, 𝐟𝐮𝐭𝐮𝐫𝐞-𝐫𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 - Enjoy strong connections throughout your home with 6 high-gain antennas and a 10G WAN/LAN port that stays ahead as your network grows, delivering premium Wi-Fi 7 performance for everyday homes.△§
- 𝐁𝐄𝟏𝟐𝟎𝟎𝟎 𝐭𝐫𝐢-𝐛𝐚𝐧𝐝 𝟖-𝐬𝐭𝐫𝐞𝐚𝐦 𝐖𝐢-𝐅𝐢 𝟕 𝐫𝐨𝐮𝐭𝐞𝐫 - Delivers up to 5,765 Mbps (6 GHz), 5,765 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming and more. Performance varies by conditions, distance to devices, & obstacles such as walls.△◇
- 𝟏𝟎 𝐆𝐛𝐩𝐬 𝐬𝐭𝐚𝐲𝐬 𝐚𝐡𝐞𝐚𝐝 𝐚𝐬 𝐲𝐨𝐮𝐫 𝐢𝐧𝐭𝐞𝐫𝐧𝐞𝐭 𝐠𝐫𝐨𝐰𝐬 - Features a 10 Gbps WAN/LAN port to maximize multi-gig internet plans. A 2.5 Gbps WAN/LAN port, three 1 Gbps LAN ports, and a USB 3.0 port add even more connectivity options.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐞𝐯𝐞𝐫𝐲 𝐜𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,600 sq. ft. for up to 128 devices. 6 optimally positioned antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, gaming consoles, and IoT devices without slowdown.
- 𝐒𝐢𝐦𝐩𝐥𝐞 𝐬𝐞𝐭𝐮𝐩 & 𝐞𝐚𝐬𝐲 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 - Quickly setup and manage your Archer BE670 with the free Tether App. Keep your WiFi performing at its best by keeping the firmware updated through the App. All Wi-Fi routers require a separate modem.
Apply least-privilege traffic rules when available
Advanced routers may let you create device-specific rules or schedules. Permit only the traffic a device needs for its intended function and block access to trusted subnets. NIST SP 1800-15 (2021) describes Manufacturer Usage Description (MUD) practices that can automate such policies, allowing a device to contact only required services and reducing botnet and lateral-movement risk.
Do not assume that a separate SSID alone creates full security. Confirm that the router’s guest firewall blocks access to the primary LAN and that wired ports assigned to the IoT network are also isolated.
Harden every smart device and its account
Replace defaults and enforce strong authentication
- Change the device’s factory password before enabling cloud access.
- Use a unique password for each device account; never copy the router password.
- Enable multi-factor authentication (MFA) on the vendor account, preferably with an authenticator app or security key where offered.
- Turn on account lockout, failed-login throttling and security notifications.
- Remove former household members, installers and unused administrator accounts.
For devices controlled through a cloud dashboard, review active sessions, API tokens and third-party integrations. Revoke tokens and integrations you no longer recognize or use.
Update firmware and protect stored data
Install vendor firmware updates promptly and confirm that automatic updates are enabled when the vendor provides them. Enable encryption for stored recordings or other sensitive data, and set a passcode lockout on phones and control panels. If a product cannot be updated, has no meaningful authentication, or is past its published security-support period, remove it from the network and replace it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Reduce unnecessary capabilities
Disable microphones, cameras, remote viewing, voice assistants, location sharing and integrations that are not required. Limit notifications to useful security events so that a flood of low-value alerts does not hide a real compromise. For cameras and doorbells, review who can view recordings and how long footage is retained.
Best Value
- BE9300 Tri-Band Wi-Fi 7 Speeds: Archer BE550 features Multi-Link Operation, Multi-RUs, 4K-QAM, and 320 MHz channels, providing blazing-fast speeds of 5760 Mbps (6 GHz band), 2880 Mbps (5 GHz band), and 574 Mbps (2.4 GHz band).
- Unmatched Performance for Streaming and Gaming: Ensures seamless 4K/8K streaming, engaging AR/VR gaming, and ultra-fast downloads for an optimal user experience.
- Extend Your Coverage with EasyMesh: Add EasyMesh-compatible routers, range extenders, and wireless powerline adapters to form a seamless whole-home network that eliminates dead zones while reducing signal drops and lag when moving throughout your home.
- Full 2.5G WAN & LAN Ports for Future-Proof Networking: Archer BE550 is equipped with one 2.5G WAN port and four 2.5G LAN ports, enabling peak device performance and offering an ideal solution for future-proofing your home network.
- Enhanced Experience with Premium Components: Our proprietary Wi-Fi optimization technology, combined with six strategically positioned antennas and Beamforming, ensures higher capacity, stronger and more reliable connections, and reduced interference.
Choose replacement hardware by security capability
Replace a router when it cannot provide WPA2 or WPA3, no longer receives security updates, or cannot isolate guest or IoT devices. Compare support and administration features before comparing speed ratings.
| Criterion | What to verify | Why it matters |
|---|---|---|
| Wireless security | WPA3 Personal, with a controlled WPA2 fallback for necessary legacy clients | Protects credentials and wireless traffic without relying on obsolete WPA or WEP |
| Segmentation | Separate IoT and guest networks with local-network isolation | Limits movement from an untrusted appliance to computers and storage |
| Updates | Automatic update mechanism, published support lifetime and clear recovery process | Reduces the period in which known vulnerabilities remain exploitable |
| Administration | MFA for management, local-only administration and an option to disable remote management | Protects the control plane from stolen credentials and internet scanning |
| Network controls | Stateful firewall, access controls, intrusion or DDoS protections and useful logs | Provides visibility and lets you restrict unnecessary traffic |
| Ownership cost | Required subscriptions, replacement policy and support terms | A low purchase price is not low cost if essential security controls expire |
| Vendor transparency | Vulnerability-reporting process and timely security advisories | Shows how the manufacturer handles newly discovered flaws |
Examples of documented features
These examples illustrate what to look for; availability, firmware and features can vary by region and revision.
| Router example | Features documented by the manufacturer | Information not established in the cited specifications |
|---|---|---|
| TP-Link Archer BE9700 | WPA3, separate IoT and guest networks, SPI firewall, access control, intrusion prevention, DDoS prevention and HomeShield | Support lifetime, subscription cost and regional firmware policy |
| ASUS RT-BE9700 | Guest networks that restrict local-network access, WPA3, firewall, security scan and automatic firmware updates | Support lifetime, subscription cost and regional firmware policy |
| eero systems | WPA3 and over-the-air updates are documented in the technology information | Exact model capabilities, support lifetime and subscription cost |
Before buying, confirm that the exact hardware revision supports the controls you need and that automatic updates can be enabled without a paid service. Check the vendor’s replacement and vulnerability-notification policies as well as current availability in your country.
Recommended Free Tools
Prepare for a compromised device or outage
Keep an offline recovery pack
- Printed router-reset and setup instructions.
- ISP support number and account details.
- Router and device serial numbers, model numbers and purchase dates.
- Backup codes for MFA, stored offline.
- A current inventory and the credentials needed to rebuild the network.
- A copy of the router configuration export, if supported.
Configuration exports may contain Wi‑Fi keys, administrator secrets or network details. Store them offline in encrypted storage and destroy old exports after a password change.
Define the isolation decision in advance
If a camera, plug or hub behaves oddly, loses its settings, contacts unfamiliar services or generates repeated login alerts, disconnect its power or Ethernet cable and remove it from the Wi‑Fi network. Do not reset every device immediately; preserve useful logs and identify the affected account first.
Restore from a clean state
- Disconnect or power down suspicious devices.
- Use a trusted, updated computer to change router and cloud-account credentials.
- Update or factory-reset the router according to the vendor’s instructions.
- Install current firmware before reconnecting clients.
- Recreate the primary and IoT networks with new names and passwords.
- Reconnect devices one at a time, beginning with supported equipment, and monitor for abnormal traffic or login alerts.
- Retire any product that cannot be updated or securely reset.
Contact your internet provider if the router repeatedly reverts settings, loses management access or shows signs of upstream service disruption. For work devices or regulated data, follow your employer’s incident-response process before wiping evidence.
Maintain the defenses after setup
- Monthly: review connected clients, administrator logs, port-forwarding rules and MFA alerts.
- Quarterly: check firmware versions, remove unused accounts and integrations, and test that guest or IoT isolation still works.
- When buying a device: verify its update policy, authentication options and end-of-support commitment before connecting it.
- After an ISP or router change: repeat the inventory, disable newly enabled convenience features and confirm that WPA3 or WPA2 Personal remains selected.
- At replacement time: securely erase old routers and smart devices, revoke their cloud access and remove them from household inventories.
Quick pre-attack checklist
- Router administrator username and password are unique and changed from defaults.
- Wi‑Fi SSID and password are unique and not reused elsewhere.
- WPA3 Personal is enabled, or WPA2 Personal is used when WPA3 is unavailable.
- WEP-only and obsolete WPA equipment has been replaced.
- Router firmware and supported device firmware are current.
- Remote management, WPS and UPnP are disabled unless a documented exception exists.
- Unknown port forwards and DMZ rules are removed.
- Cameras, plugs, speakers, TVs and appliances use an isolated IoT or guest network.
- Guest isolation has been tested from both network directions.
- Every device has a unique password, MFA where offered and lockout protection.
- Unsupported products, unused accounts, tokens and integrations are retired.
- Recovery instructions, backup codes, serial numbers and a protected configuration backup are offline.
The Bottom Line
Prepare in this order: inventory everything, harden and update the router, isolate smart devices, secure each account, and rehearse a clean reset. Those controls do not make a household immune to a large-scale attack, but they sharply reduce the number of exposed services and the damage a single compromised device can cause.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
