The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For a home router, make five changes first: replace the factory administrator credentials, disable administration from the public internet, install supported firmware, use WPA3 or WPA2 instead of WEP or legacy WPA, and choose an SSID that does not reveal your location or router model. Protective DNS is an additional option. If the router no longer receives security updates, replacing it is safer than trying to compensate with individual settings.
The exact menu names depend on the router and internet provider. Use this guide for the security decisions, then verify the clicks and available options in the current documentation for your exact model.
Before changing anything: identify the router and its support status
Find the model number, hardware revision, and the company responsible for updates. An internet-provider gateway may receive firmware from the ISP rather than directly from the equipment manufacturer. Record this information before signing in, because two devices with similar names can have different update policies and security options.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Open the vendor or ISP support page for that exact model and check whether security updates are still supplied. CISA’s exposure-reduction guidance treats unsupported devices as candidates for replacement, not as equipment that can be made permanently safe through configuration alone: CISA Internet Exposure Reduction Guidance.
#1 Best Overall
Router menus often apply changes immediately and may restart the network. Make changes when you can reconnect every household device, and keep the ISP’s support contact available if the router is provider-managed.
1. Replace the factory administrator credentials
The administrator account controls the router’s configuration. Factory usernames and passwords are widely published, so leaving them unchanged gives an attacker who reaches the management interface a known starting point. The US-CERT/CISA home-router guidance recommends changing manufacturer defaults during initial setup: Small Office/Home Office Router Security.
What to change
- Change the administrator password to a long, unique password that is not reused on email, shopping, work, or other accounts.
- If the router allows it, change the default administrator username as well.
- Store the new credential in a password manager or another secure location. Do not put it on a label visible near the router.
- Keep the administrator password separate from the Wi-Fi password. The former protects the configuration interface; the latter authenticates devices joining the wireless network.
Some routers force a password change at first login; others hide the option under sections such as Administration, System, or Account. Use the exact label shown by your firmware rather than assuming every model has the same controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Disable administration from the public internet
Turn off any feature that permits the router’s configuration page to be reached from the internet unless you have a specific, ongoing need for it. Common labels include Remote Management, Web Access from WAN, Remote Administration, or Internet Administration. A password does not make an unnecessarily exposed management service equivalent to a private one.
For household equipment, the practical default is to manage the router only from the local network. CISA’s home-router material recommends disabling remote administration when it is not needed, while its communications-infrastructure guidance states the broader principle of limiting management traffic exposed to the internet: US-CERT/CISA home-router guidance and CISA Enhanced Visibility and Hardening Guidance for Communications Infrastructure.
Rank #2
If remote access is genuinely required
Do not enable a setting simply because it is convenient. First determine whether the need can be met by connecting to the home network through a secure access method supported by the router or ISP. Follow the current, device-specific instructions; consumer implementations differ, and enterprise hardening steps are not automatically appropriate for a home gateway.
After changing the setting, check the router’s status page for a confirmation that internet-side administration is disabled. A separate feature for remote troubleshooting by the ISP may remain enabled, so ask the provider what it controls and whether it can be restricted.
Recommended Free Tools
3. Keep firmware current while the device is supported
Firmware contains the router’s operating code, including fixes for vulnerabilities. Check for updates in the router’s administration page and on the official support page for the exact model and hardware revision. If the device offers automatic security updates, enable them unless the ISP instructs otherwise. CISA recommends applying available security updates and replacing equipment that no longer receives security support: Exposure Reduction Guidance and Small Office/Home Office Router Security.
Do not assume there is a universal update schedule
Vendors release fixes at different times, and provider-supplied gateways may be updated centrally. The absence of a new update today does not prove that a model is unsupported. Instead, look for a published support status, a current firmware version, or an update check that reports the device is up to date.
When replacement is the safer option
Replace the router when the manufacturer or ISP no longer supplies security updates, when the exact model cannot use WPA2 or WPA3, or when internet-facing management cannot be disabled and there is no supported mitigation. Choose a device whose support lifetime and update process are clearly documented rather than selecting solely on wireless speed.
4. Use WPA3 or WPA2 for Wi-Fi encryption
Set the wireless security mode to WPA3 where every important client supports it. If WPA3 is unavailable or incompatible with required devices, use WPA2. CISA’s telework guidance specifies WPA2 or WPA3 at minimum and directs users to disable WEP and legacy WPA: CISA Telework Essentials.
Choosing between the modes
- WPA3: Select it when the router and the phones, computers, printers, cameras, and other clients that must connect support it.
- WPA2: Use it when older but still necessary clients cannot join WPA3. Confirm that the router is using a modern WPA2 configuration rather than a mixed mode that also permits obsolete protocols.
- WEP or legacy WPA: Do not use these modes. They are specifically below the minimum described by CISA’s guidance.
After changing encryption, reconnect each device with the new Wi-Fi password. A client that repeatedly fails to connect may not support the selected mode; check its current documentation before weakening security for the entire network.
5. Choose an SSID that reveals as little as possible
The SSID is the network name broadcast to nearby devices. Use a neutral name that does not disclose your street, apartment, household name, or the router’s manufacturer and model. CISA includes avoiding location and equipment-identifying details among its home wireless recommendations: CISA Telework Essentials.
Changing the SSID does not replace encryption or hide the network from someone actively scanning for wireless signals. Its purpose is to avoid volunteering useful identifying information. Once renamed, reconnect trusted devices and remove the old network profile where appropriate so they do not automatically seek the previous network.
6. Consider protective DNS as an additional layer
CISA lists protective DNS as a home-network measure. A protective resolver can be configured in the router or, depending on the setup, on individual devices. The cited guidance does not evaluate providers or establish that one service is best, so select a service only after checking its current privacy, availability, and configuration terms with your ISP or router manufacturer.
Rank #4
DNS protection is supplementary. It does not secure the administrator account, patch firmware, encrypt Wi-Fi, or remove an exposed management interface. Keep the core settings above in place even if you use a protective resolver.
Put the changes in a safe order
- Identify the exact router model, hardware revision, and whether the ISP controls its firmware.
- Sign in from a device connected to the home network and change the administrator username and password.
- Disable remote management or web access from the WAN. Save the setting and confirm that local administration still works.
- Check for firmware updates, install supported security updates, and enable automatic updating when offered.
- Set Wi-Fi security to WPA3, or WPA2 when required clients are not compatible. Disable WEP and legacy WPA.
- Change the SSID to a neutral name and reconnect household devices.
- Evaluate protective DNS as an optional, separately researched control.
- Record the new administrator credential and the router’s support page in a secure location, not in the SSID or Wi-Fi password.
Verification and common failure cases
The remote-management switch is missing
Look for equivalent wording such as WAN access, remote web access, or administration from internet. If the ISP-managed interface does not expose the control, ask the provider whether it is enabled and what restriction is available. Do not infer that a hidden setting is disabled.
A firmware update fails
Confirm the hardware revision and use only the update intended for that exact device. Provider-issued equipment may reject files downloaded from a general manufacturer page; use the ISP’s process in that case. Do not interrupt power during an update, and contact support if the router does not return to normal operation.
An older device cannot connect after WPA3 is enabled
Check whether that client supports WPA3 and whether its own firmware is current. If the device is essential and cannot be updated, select WPA2 rather than enabling WEP or legacy WPA. Consider replacing the incompatible client or the router when secure compatibility cannot be achieved.
You cannot log in after changing the administrator password
Verify that you are using the administrator credential, not the Wi-Fi password, and connect locally rather than through a disabled remote-management path. If recovery is necessary, follow the exact reset procedure for the model; a factory reset erases configuration and requires the security changes to be applied again.
How to assess a replacement router
If the current device is unsupported or lacks essential controls, compare prospective models on security support rather than on throughput alone.
| Question | Why it matters |
|---|---|
| Does the exact model still receive security updates, and is the expected support period documented? | An unsupported router cannot receive fixes for newly discovered flaws. |
| Does it offer WPA3 and WPA2, with compatibility information for required clients? | You need a modern mode without stranding essential devices. |
| Can administration from the internet be disabled? | Local-only management reduces unnecessary exposure. |
| How are updates delivered, and can automatic updating be enabled? | A clear process makes timely patching practical. |
| Will the ISP or manufacturer support the device in your network? | Support determines how firmware, resets, and failures are handled. |
No universal router model, price, or update interval follows from these criteria. Verify the current specifications and support policy before buying.
What these settings can—and cannot—do
They reduce the router’s remotely reachable attack surface and prevent common configuration weaknesses: known factory credentials, unnecessary internet-facing administration, unpatched firmware, obsolete wireless encryption, and identifying network names. They do not make every device on the network trustworthy, remove malware from an endpoint, or guarantee that a vendor will fix a newly discovered flaw immediately. Continue updating computers, phones, and smart-home devices and review the router’s support status over time.
Frequently Asked Questions
Should I disable remote management if I sometimes need help from my ISP?
Ask the ISP whether its support feature is separate from the router’s public web-administration setting and whether it can be restricted. Keep general internet-based administration disabled unless there is a documented need and a supported secure method.
Is WPA3 always better than WPA2 for a home network?
Use WPA3 when the router and required clients support it. WPA2 is the appropriate fallback for necessary devices that cannot connect to WPA3; do not fall back to WEP or legacy WPA.
What should I do with a router that no longer gets updates?
Replace it with a model whose security-support status, update process, WPA2/WPA3 support, and ability to disable internet-based administration are documented.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
