Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure a home router by replacing its factory administrator and Wi-Fi credentials, selecting WPA3 Personal (or WPA2 Personal), installing available firmware updates, disabling remote management and unused convenience features, and separating visitors on a guest network. Then check connected devices and keep every phone, computer, camera, and smart-home device updated. These controls reduce unauthorized administration and unwanted access, but they do not replace security software and updates on devices connected to the network.
The exact menu names and update process depend on the router manufacturer, model, firmware, and internet provider. Use the router’s official manual or your ISP’s support instructions for the screens you see.
Why the router is a security boundary
Your router controls who can administer the network, which devices can join Wi-Fi, and how traffic moves between your home and the internet. A stolen administrator password can let someone change wireless settings or redirect traffic; a weak Wi-Fi password can allow an unknown device onto the network. A vulnerable router can also expose management services that were never intended for the public internet.
The Federal Trade Commission (FTC) describes the router as a key point for protecting a connected home. Its guidance covers credentials, encryption, software updates, management features, guest access, and firewalls in How To Secure Your Home Wi-Fi Network. The companion FTC guide, Securing Your Internet-Connected Devices at Home, recommends keeping connected devices updated and reviewing which devices are on the network.
#1 Best Overall
Router hardening is one layer. It cannot clean malware from a laptop, phone, camera, or smart appliance, and it cannot make an unsupported router receive security fixes. Pair these settings with current operating systems, applications, and endpoint protection.
Prepare before changing settings
Identify the exact equipment
Record the manufacturer, model number, hardware revision, and whether the unit belongs to you or your ISP. Two routers from the same brand can have different menus and update procedures. ISP-supplied equipment may be updated remotely or may hide settings that a retail model exposes.
Use the official access method
Follow the manufacturer’s manual or your ISP’s support material to open the local administration page or mobile app. Do not install firmware from an unofficial download site. If you lose the administrator password, the vendor’s documented recovery process may require a factory reset; a reset erases customized settings, so save ISP connection details and a configuration backup if the interface offers one.
Plan a short maintenance window
Changing the Wi-Fi name or password disconnects household devices. Have the new credentials ready and make a list of important devices, including streaming boxes, printers, cameras, thermostats, and appliances that may need to be reconnected.
Follow this hardening sequence
-
Replace factory administrator credentials
Change the administrator username if the router permits it, and set a long, unique administrator password. This credential controls router settings; it is not the same as the password used to join Wi-Fi. Do not use a name, street address, phone number, router brand, model number, or a password reused on another service. CISA lists changing factory-set router credentials as a basic home-network protection step in its 5 Steps to Protecting Your Digital Home tip sheet.
Store the administrator credential in a password manager or another secure place. If the interface offers separate local and cloud accounts, secure both and enable multifactor authentication for the cloud account when available.
-
Set a separate, strong Wi-Fi password
Change the network name (SSID) if it reveals your surname, address, apartment number, or router model. Create a Wi-Fi passphrase that is different from the administrator password and not used anywhere else. A unique passphrase prevents a guest or former device user from also knowing the credential that changes router settings.
DriversCrashes, No Sound, or Screen Glitches?PerformancePC Slower Than It Used to Be?DriversOutdated Drivers Are Slowing You DownSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.After saving, reconnect household devices using the new passphrase. Remove old saved network profiles from devices you no longer control, especially phones or laptops given away.
-
Choose WPA3 Personal or WPA2 Personal
Open the wireless security or encryption setting and choose WPA3 Personal when the router and the devices that need to connect support it. If WPA3 is unavailable or older household devices cannot use it, choose WPA2 Personal (often displayed as WPA2-PSK or WPA2-Personal with AES). Avoid mixed modes that retain obsolete protocols unless the router documentation says they are required for a specific legacy device.
The FTC summarizes the choice this way: “WPA3 is the newer — and best — encryption available, but both will work to scramble your information.” Its guidance also states that WPA and WEP are outdated and not secure. If a current firmware update still leaves the router without WPA2 Personal or WPA3 Personal, plan to replace the router rather than relying on an obsolete encryption method.
Wireless option Use it? Reason WPA3 Personal Yes, when supported by the router and required devices Newest option identified by the FTC and the preferred choice when compatibility permits WPA2 Personal Yes, when WPA3 is unavailable or incompatible Acceptable current alternative for household equipment that supports it WPA or WEP No FTC guidance identifies these as outdated and not secure -
Install router firmware or software updates
Look for a Firmware Update, Software Update, Administration, or Maintenance page. Check the manufacturer’s support page for the exact model and hardware revision, and follow its instructions. Register for security-update notices if the vendor offers registration. Do not interrupt power during an update unless the vendor explicitly instructs you to do so.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.There is no universal update timetable: vendors publish fixes differently, and some ISP routers are maintained by the provider. Ask your ISP whether its supplied equipment receives automatic updates, how you are notified, and whether you must approve a reboot. If the vendor no longer provides security updates, treat that as a replacement factor even if the router still works.
-
Turn off remote management unless you genuinely need it
Find a setting named Remote Management, Remote Administration, WAN Administration, or a similar term. Disable it when you do not have a specific, documented reason to administer the router from outside your home. If remote administration is required for work or support, restrict it to the narrowest method the vendor supports, use a unique account password, and enable multifactor authentication where offered.
Remote management is different from the local administration page you open while connected to your home network. Disabling the former should not prevent normal in-home configuration.
-
Disable WPS and unnecessary UPnP
Wi-Fi Protected Setup (WPS) can make joining easier, while Universal Plug and Play (UPnP) lets applications request automatic port mappings. Those conveniences may increase exposure when they are not needed. The FTC specifically advises: “Turn off ‘remote management,’ Wi-Fi Protected Setup (WPS), and Universal Plug and Play (UPnP) features.”
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Disable WPS if every device can join by entering the Wi-Fi passphrase. Disable UPnP if the household does not rely on applications that require automatic port forwarding. If a game console, media system, or other service stops working after UPnP is disabled, consult that product’s documentation and create only the narrowly required manual rule rather than restoring every convenience feature by default.
-
Enable the router firewall
In Security, Firewall, or Advanced settings, confirm that the router’s built-in firewall is enabled. Leave default inbound-blocking behavior in place unless the vendor or ISP documents a specific requirement. Do not confuse the router firewall with protection on a computer or phone; both layers have different jobs.
-
Log out of the administrator session
After saving changes, use the interface’s Log Out or Sign Out control. Close the browser or app and disconnect from the administration page. Logging out matters on shared computers and prevents the next person using the same device from inheriting an authenticated session.
Rank #4
Use a guest network to contain visitors and risky devices
Create a Guest Wi-Fi network if the router supports it. Give visitors the guest password instead of the primary Wi-Fi passphrase, and use a different SSID and password. Enable the option that blocks guest clients from reaching devices on the main network when the router provides that control.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Guest isolation reduces the chance that a compromised visitor device can directly reach printers, file shares, cameras, or other systems on the primary network. It is not a guarantee: internet access and any services deliberately exposed to guests still require their own security. Recheck the guest-network setting after major firmware updates because menu names and defaults can change.
Audit connected devices
Open the router’s Connected Devices, Client List, Attached Devices, or DHCP Clients page. Identify each entry by matching its name, manufacturer, IP address, or MAC address with equipment in the home. Some devices appear with generic names or randomized Wi-Fi addresses, so compare them while temporarily disconnecting a device if necessary.
- Investigate entries nobody recognizes instead of assuming they are harmless.
- Change the Wi-Fi passphrase if you suspect an unknown person has joined; reconnect only devices you trust.
- Remove or block stale entries when the router offers that function, while recognizing that a disconnected device may reappear when it reconnects.
- Retire devices that no longer receive updates, especially cameras, televisions, and smart-home hubs that remain connected continuously.
The device list is an inventory aid, not a malware diagnosis. A familiar device can still be infected, and a legitimate device can display an unfamiliar name.
Router settings at a glance
| Control | Secure baseline | Exception or follow-up |
|---|---|---|
| Administrator account | Unique username where possible and a unique strong password | Use the vendor’s recovery process if the credential is lost; a reset may erase settings |
| Wi-Fi credentials | SSID that does not reveal personal details; unique passphrase | Reconnect every trusted device after changing it |
| Encryption | WPA3 Personal, otherwise WPA2 Personal | Replace the router if updated firmware still offers only WPA or WEP |
| Firmware | Current vendor or ISP-supported release; update notices enabled | Ask the ISP about automatic updates on supplied equipment |
| Remote management | Off unless specifically required | Restrict and protect it if a documented need remains |
| WPS | Off when passphrase joining is practical | Re-enable only for a particular compatibility need, then turn it off again |
| UPnP | Off when no application requires automatic port mapping | Investigate a narrow alternative for a service that stops working |
| Firewall | Enabled | Follow documented ISP requirements before changing advanced rules |
| Guest network | Separate SSID and password with guest-to-primary isolation | Availability and isolation controls vary by router |
When should you replace the router?
Consider replacement when an update does not add WPA2 Personal or WPA3 Personal to an older model, when the manufacturer no longer supplies security updates, or when the device cannot provide basic controls such as an administrator password, firewall, and a way to disable unneeded exposure. The FTC’s guidance specifically points to a new router when an older one offers neither WPA2 nor WPA3 after a software update.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Choose replacement hardware by checking the facts that affect security and fit:
- WPA3 Personal and WPA2 Personal support for the devices you own.
- A published vendor process for ongoing security updates and a way to receive notices.
- Compatibility with your ISP’s connection type, authentication, and equipment policy.
- Coverage appropriate for the home, without relying on an insecure extender or abandoned device.
- Accessible controls for credentials, firmware, firewall, guest access, and disabling remote management, WPS, and UPnP.
A newer router improves the available security baseline; it does not guarantee that malware cannot reach a connected device. Verify support and update status before buying, and follow the ISP’s requirements if the provider must approve or supply the equipment.
Troubleshoot common problems
The administration page or app will not open
Confirm that the phone or computer is connected to the home network rather than cellular data or a neighbor’s Wi-Fi. Use the address or app documented for the exact model, and check whether the ISP requires its own management app. If credentials fail, do not keep guessing; use the documented reset and recovery procedure, understanding that a factory reset removes saved settings.
WPA3 disconnects an older device
Update the device’s operating system and Wi-Fi driver first. If it still cannot connect, use WPA2 Personal if the router supports it, or place the legacy device on a separately isolated network when the router provides that capability. Do not downgrade the entire network to WPA or WEP merely to keep one obsolete device online; replace the device or router when practical.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A device stopped working after UPnP was disabled
Identify the exact function that failed and consult the device or application documentation for required ports. Prefer a documented, limited manual configuration over enabling UPnP for every device. If you cannot maintain a narrow rule safely, reconsider whether that service is necessary on the network.
An ISP router hides security settings
Ask the ISP which controls it manages, whether firmware updates are automatic, and whether remote administration is enabled for support. Request a supported configuration that provides WPA2 or WPA3, current updates, a firewall, and a guest network. If the provider permits customer-owned equipment, verify compatibility and update support before replacing the unit.
An unknown device keeps appearing
Match the entry against phones using private or randomized Wi-Fi addresses, smart speakers, televisions, and other equipment that may use generic host names. Disconnect suspected devices one at a time and refresh the list. If the entry remains unexplained, change the Wi-Fi passphrase, reconnect trusted equipment, and review the list again. A persistent unknown client after that process is a reason to contact the router vendor or ISP.
Maintain the protection
Security settings are not a one-time task. Register the router for update alerts when possible, read vendor or ISP notices, and apply supported firmware updates. Review the connected-device list periodically and whenever someone moves out, a device is sold, or you suspect the Wi-Fi password was shared. Revisit remote management, WPS, UPnP, firewall, and guest-network settings after a factory reset or major configuration change because resets can restore defaults.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep computers, phones, tablets, cameras, televisions, and smart-home devices current and protected. If one device shows signs of compromise, isolate it from the network while you follow that manufacturer’s malware-removal or recovery guidance, then change credentials that may have been exposed. The router can limit access, but endpoint maintenance is what addresses infections on the endpoints themselves.
Quick Recap
Quick completion checklist
- Model, hardware revision, ownership, and ISP support path recorded.
- Administrator username and password changed from factory values and stored securely.
- Wi-Fi SSID reviewed and Wi-Fi passphrase made unique.
- WPA3 Personal selected, or WPA2 Personal when necessary.
- Firmware checked and update notifications or ISP automatic-update status confirmed.
- Remote management, WPS, and unnecessary UPnP disabled.
- Firewall enabled and administrator session logged out.
- Guest network created with primary-network isolation when available.
- Connected-device list reviewed and unknown entries investigated.
- All connected devices kept updated and protected.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
