iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with the settings that control access: replace the router administrator username and password and the Wi-Fi password, then select WPA3 Personal or WPA2 Personal, install every available firmware update, and turn on the firewall. After that, disable remote management, WPS, and UPnP unless you actively need them, and create a guest network with separate credentials. If an old router cannot provide WPA2 or WPA3 after updating, replace it.
Why this order matters
A router has two separate control points. The administrator account governs configuration of the router itself; the wireless password governs which devices can join the network. Leaving either default credential in place leaves a separate path open, even if the other password is strong. Encryption protects traffic over the wireless link, while firmware updates repair defects in the router software. Optional features such as remote management, WPS, and UPnP trade some security for convenience, so they belong after the fundamentals.
The Federal Trade Commission (FTC) recommends WPA3 where available, WPA2 when WPA3 is not offered, current router software, a firewall, and a guest network. The Cybersecurity and Infrastructure Security Agency (CISA) likewise advises WPA2 or WPA3 at minimum, avoiding legacy WEP and WPA modes, changing default credentials, and using a non-identifying wireless network name.
1. Change both default credentials
Administrator account
Sign in to the router’s local administration page or mobile app and replace the factory administrator password with a long, unique password that you do not use anywhere else. If the interface allows it, change the default administrator username as well. Do not use your name, street address, telephone number, the router manufacturer’s name, or a password that appears on the router label.
#1 Best Overall
Store the new administrator credential in a password manager. It is needed less often than the Wi-Fi password, so relying on memory can lead to writing it on the router or reusing a weak password. After saving, sign out and sign back in to confirm that the new credential works before closing the old session.
Wi-Fi password and network name
Set a separate wireless password. It should be unique to this network and long enough to resist guessing; a series of several unrelated words is easier to manage than a short, complicated phrase. Do not use a family name, apartment number, address, phone number, or router brand.
Change the default SSID (network name) to a neutral name that does not identify your household, address, or equipment. The SSID is not a secret, but removing identifying information limits what a passer-by can learn. Changing it disconnects existing devices, so have the new password ready when reconnecting phones, computers, televisions, cameras, and smart-home equipment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why changing only one password is insufficient
The two credentials protect different functions. A person who knows the Wi-Fi password can join the network but normally cannot change router settings. A person who obtains the administrator credential can change wireless settings, create accounts, or redirect traffic even without knowing the previous Wi-Fi password. Secure both during the same setup session.
2. Select WPA3 Personal, or WPA2 Personal
Open the wireless security or encryption setting and choose WPA3-Personal when every important device supports it. If WPA3 is unavailable or causes compatibility problems, choose WPA2-Personal (sometimes labeled WPA2-PSK or WPA2-Personal AES). The FTC describes WPA3 as the newer and best option, while WPA2 remains acceptable: “WPA3 is the newer — and best — encryption available, but both will work to scramble your information.”
Rank #2
Do not leave a network set to WEP or legacy WPA. CISA guidance calls for WPA2 or WPA3 at minimum and avoiding those older protocols. They are obsolete and provide materially weaker protection.
When older devices will not connect
First update the device’s operating system or wireless driver, then check whether the router offers a compatibility mode. A mixed WPA2/WPA3 mode can help some networks, but the exact behavior and security level depend on the router and client. If a critical device supports only WEP or WPA, treat that as a replacement warning rather than weakening the entire primary network. A separate, isolated network may be possible on some routers, but the manufacturer’s instructions must confirm how it is protected.
Recommended Free Tools
What the labels mean
- WPA3 Personal: preferred current home-network option when supported.
- WPA2 Personal: acceptable fallback for equipment that cannot use WPA3.
- WPA or WEP: legacy modes that should not be used for the primary network.
3. Install router software updates
Check the router’s administration page for a firmware or software-update section, and check the manufacturer’s support page for your exact model and hardware revision. Read the release notes when available, back up the configuration if the interface offers that option, and install the update during a period when a brief internet outage is acceptable. Do not unplug the router while an update is being written.
After the router restarts, sign in again and verify that the administrator password, SSID, wireless security mode, firewall, and guest-network settings remain as intended. Some updates restore defaults or expose newly named controls. Recheck them rather than assuming the previous configuration survived.
ISP-supplied equipment
For a router supplied by your internet provider, ask whether firmware updates are automatic and how to confirm the installed version. The provider may control the update process or restrict which settings are exposed. If support cannot provide WPA2 or WPA3 on an otherwise obsolete unit, request a replacement or use your own supported router according to the provider’s compatibility requirements.
4. Turn off remote management unless you need it
Remote management allows the administrator interface to be reached from outside the home network. It can be useful for a managed household or a support technician, but it increases the number of places an administrator login can be attacked. In the administration, advanced, or management section, disable “Remote Management,” “Remote Administration,” or similarly named internet-side access unless you have a specific, ongoing reason to use it.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteIf you must keep it enabled, restrict it to the narrowest source range the router permits, require HTTPS, use a unique administrator password, and disable it again when the task is complete. Menu names and controls differ by model; follow the exact instructions for your firmware rather than enabling a broad “allow from anywhere” option.
5. Disable WPS when device setup no longer requires it
Wi-Fi Protected Setup (WPS) can connect a device with a button press or PIN instead of entering the wireless password. That convenience is unnecessary once your devices are configured, and the FTC lists WPS among the features that can make a network less secure. Disable WPS in the wireless or Wi-Fi settings, including both push-button and PIN methods if they are listed separately.
Before switching it off, make sure every household device has joined using the normal WPA3 or WPA2 password. If a device depends on WPS and cannot use standard enrollment, consult its manual for an alternative; do not leave WPS permanently enabled merely to avoid entering the password once.
6. Disable UPnP unless an application genuinely needs it
Universal Plug and Play (UPnP) lets applications and devices request automatic port mappings. It can simplify game consoles, media servers, and some smart-home products, but it also gives software on the local network more ability to change how the router exposes services. Turn off UPnP in the advanced-network or NAT section when you do not need automatic port forwarding.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
If a particular application stops working, identify the exact port or service it requires and decide whether a manual, narrowly scoped rule is safer than restoring UPnP for every device. Remove obsolete port-forwarding rules and review the list after installing new software.
7. Confirm that the router firewall is enabled
Find the firewall, SPI (stateful packet inspection), or security section and ensure the default inbound firewall is on. The firewall helps block unsolicited connections arriving from the internet while allowing normal outbound use. Do not confuse it with a computer’s software firewall; both layers can be useful.
Avoid turning the router firewall off to solve a single connectivity problem. Instead, identify the affected service, check whether a required port-forwarding rule is correct, and remove the rule when it is no longer needed. If the interface offers separate IPv4 and IPv6 firewall controls, verify both are enabled unless the manufacturer documents a different design.
8. Create a guest network with separate credentials
Enable the guest Wi-Fi feature and give it a different SSID and password from the primary network. The guest network lets visitors get online without sharing the main password. The FTC also notes that it can help keep a guest device carrying malware away from devices on the primary network.
Use the guest-isolation, “allow guests to access local network,” or similarly named option to prevent guests from reaching printers, storage, cameras, and router administration. The secure choice is to block local-network access unless you have a specific reason to permit it. Change the guest password when it has been widely shared, and do not publish the administrator credential to guests.
Devices that belong on guest Wi-Fi
Guest Wi-Fi can also suit untrusted or infrequently managed equipment, such as a visitor’s laptop or a temporary smart device, provided the router’s guest implementation actually isolates clients. Read the model-specific documentation: some inexpensive routers label a second SSID “guest” without fully separating it from the primary LAN.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Apply the changes safely: a model-neutral procedure
- Identify the exact model and hardware revision. Record the label information and the current firmware version. Router menus vary, and an update for a similar-looking model may be incompatible.
- Connect locally. Use a wired computer where practical, or the existing trusted Wi-Fi, and open the address or app documented by the manufacturer. Avoid changing security settings from an unknown public network.
- Back up the current configuration. Export a configuration file only if the router provides that function and store it securely; it may contain passwords.
- Change the administrator username and password. Save, sign out, and verify the new login.
- Rename the SSID and set a unique Wi-Fi password. Select WPA3 Personal or WPA2 Personal before saving. Expect all wireless clients to disconnect.
- Install the latest firmware. Allow the router to reboot fully, then confirm the version and security settings.
- Review the feature controls. Disable remote management, WPS, and UPnP unless a documented need remains.
- Verify protection and separation. Confirm the firewall is enabled, create the guest network, set a separate password, and block guest access to the local network when that option exists.
- Reconnect and test. Join a phone or computer to the primary network, join a separate device to guest Wi-Fi, and confirm that guest devices cannot open the router’s administration page or reach a primary-network device.
What to do when a setting is missing or breaks something
The router offers only WEP or WPA
Install the newest firmware available for the exact model and ask the ISP whether it controls updates. If WPA2 or WPA3 still cannot be selected, the router has a support gap. Replace it with a router that supports WPA2 or WPA3 rather than operating the primary network on legacy encryption.
You cannot find a setting
Search the manufacturer’s model-specific manual for terms such as “wireless security,” “administration,” “remote access,” “WPS,” “UPnP,” “SPI firewall,” and “guest network.” Some ISP firmware hides controls or renames them. Do not assume a feature is disabled merely because it is absent from a simplified mobile-app view; check the full web interface or ask the provider.
Free tools Windows power users keep installed
One-click scans. No signup required.
Devices lose access after the change
Reconnect each device using the new SSID and password. For stubborn clients, forget the saved network and join again, then update the device’s operating system or wireless driver. If only an old device fails under WPA3, use WPA2 Personal or a documented compatibility mode rather than reverting to WEP or WPA.
A game, camera, or application stops working
Test whether UPnP or a port-forwarding rule was responsible, then consult the application’s documentation. Prefer a narrowly scoped manual rule over globally re-enabling UPnP when feasible, and delete temporary rules after use. Never disable the firewall as a first troubleshooting step.
When replacing the router is justified
| Condition | Recommended action | Reason |
|---|---|---|
| WPA3 is available and supported by your devices | Use WPA3 Personal | It is the preferred current option in FTC guidance. |
| WPA3 is unavailable, but WPA2 Personal is available | Use WPA2 Personal | WPA2 is an acceptable fallback for compatibility. |
| Only WEP or legacy WPA remains after updating | Replace the router | The unit cannot meet the WPA2/WPA3 minimum cited by FTC and CISA guidance. |
| Firmware updates are no longer supplied | Plan replacement, especially if security controls are outdated | Unpatched router software cannot receive fixes for newly discovered defects. |
| An ISP unit hides essential controls | Ask the ISP about updates or a supported replacement | Provider-managed firmware may determine which protections are available. |
There is no need to replace a router solely because a newer model exists if the current unit receives updates and supports WPA2 or WPA3 with the controls described above. Replacement becomes the practical security step when software support or modern encryption cannot be obtained.
Quick Recap
Quick verification checklist
- Administrator username and password are no longer factory defaults and are unique.
- Wi-Fi SSID does not identify your household, address, or equipment.
- Wireless security is WPA3 Personal or WPA2 Personal, not WEP or legacy WPA.
- Firmware is current for the exact model, or the ISP has confirmed automatic updates.
- Remote management is off unless specifically required and restricted.
- WPS is off after normal device enrollment.
- UPnP is off unless a known application needs it and its behavior is understood.
- The router firewall is enabled.
- Guest Wi-Fi uses a different password and blocks local-network access when possible.
- You have tested both primary and guest connections after saving the configuration.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
