Your home Wi-Fi and router: 10 minutes to lock it down

You can lock down most home routers in about 10 minutes. Change the router’s admin login and your Wi-Fi password, install updates, check that the Wi-Fi uses WPA3 or WPA2 with AES, and turn off three risky features. If your router no longer gets updates, replace it. The steps below follow checklists from CISA, the federal cybersecurity agency, and the FBI.

Why your router matters

A router is the box that connects your devices to the internet and creates your Wi-Fi network. It has two passwords. One lets devices join your Wi-Fi. The other lets you log in to the router and change its settings. Both need care.

An unprotected router is not only a risk to your own data. In May 2025, the FBI warned that criminals were taking over old routers and using them as proxies. A proxy is a system that passes internet traffic along while hiding who is behind it. The criminals used the hijacked routers to commit crimes anonymously. The FBI said some of the compromised routers were at end of life and had remote administration turned on. The steps below address both problems.

Before you start

You need a device on your home network, ideally a computer. You also need your router’s manual, or your internet provider’s instructions, to find how to log in. CISA says the router may have a sticker with its default settings. Keep a pen and paper or a password manager ready for the new passwords. A password manager is an app that stores passwords for you.

The 10-minute checklist

1. Log in to the router. Use the instructions in the manual. If you never changed the login, the sticker on the router may show it.
2. Change the admin login. Pick a new username and password for the router itself. CISA says the password should be long, random and unique. The FBI suggests 16 to 64 characters, no reuse, and turning off password hints. Don’t use your Wi-Fi password here.
3. Update the firmware. Firmware is the router’s built-in software. Updates fix known flaws. Check for one now, and turn on automatic updates if your router offers them. CISA notes that some routers do.
4. Rename your Wi-Fi network. The network name is called the SSID. CISA says a default name can point a criminal to known flaws in that model. Choose a name that doesn’t include your name, address or other personal details.
5. Set a strong Wi-Fi password. CISA suggests a passphrase of five to seven unrelated words, at least 16 characters in all. Never reuse it for another account. Our password generator has a passphrase mode that makes one.
6. Check the encryption. Encryption scrambles your Wi-Fi traffic so others can’t read it. CISA says only two settings are considered safe: WPA3 Personal, or WPA2 with AES. WPA3 is the newer standard. The Wi-Fi Alliance, which certifies Wi-Fi products, says WPA3-Personal gives better protection against password guessing. It also says WPA3 is mandatory for the products it certifies. If your router is open, or uses WEP, WPA, or WPA2 with TKIP, CISA says to ask your internet provider for an upgrade or buy a new router. If an old device can’t join a WPA3 network, WPA2 with AES is the other safe choice.
7. Turn off remote management. This feature lets someone log in to the router over the internet. CISA says turning it off keeps a criminal from changing your settings without first joining your network. The FBI gives the same advice. After you change it, save and restart the router.
8. Turn off WPS. Wi-Fi Protected Setup is a shortcut for adding devices to your Wi-Fi. CISA says it raises the chance that someone could get into your network without permission.
9. Turn off UPnP. Universal Plug and Play lets devices, such as a smart speaker, connect themselves to your network. CISA says criminals can use it to spread malware to devices on your network and control them remotely. You may need it briefly to add a device. Turn it off afterward.
10. Create a guest network. If your router has a “Guest” Wi-Fi option, CISA says to turn it on and give it its own long, random, unique password. Use it for visitors. Also put smart-home devices on it if they only need the internet. That keeps them from discovering other devices on your home network.

One more tip: keep the router somewhere visitors can’t reach. CISA notes that anyone with physical access could reset it.

WPA3 or WPA2: which do you need?

WPA stands for Wi-Fi Protected Access. It is the security standard behind your Wi-Fi password, and WPA3 is the newest version. The Wi-Fi Alliance says WPA3 networks disallow outdated legacy protocols. It also says WPA3-Personal, the home version with one shared password, gives better protection against password guessing.

CISA still counts WPA2 with AES as safe. So you don’t need to replace a working router just to get WPA3. The Wi-Fi Alliance says WPA3 is mandatory for the products it certifies, so a new router you buy should support it. A router that no longer gets updates is a better reason to replace it.

If your router is too old

A router reaches its end of life when the maker stops selling and supporting it, and stops releasing updates and security patches, the FBI explains. In May 2025, the FBI said routers dated 2010 or earlier likely no longer receive updates. Newer routers reach the end of support too.

To check yours, look up your model on the maker’s support website, or ask your internet provider if it supplied the router. If the model is end of life, the FBI says to replace it with a current one if possible. Until you do, install any update that is available, and turn off remote management. If your internet provider owns the router, you may not be able to swap it yourself. CISA says to ask the provider for an upgrade when a router uses weak or no encryption. It makes sense to ask the same about a router that no longer gets updates.

Is my router hacked?

The FBI lists three signs that can point to malware on a router: overheating, connection problems, and settings that changed without you knowing. These signs can have ordinary causes too, so don’t panic. Check your settings against the list above.

If you think something is wrong, the FBI advises you to:

1. Install any available security and firmware updates.
2. Change the router’s password.
3. Restart the router.
4. Replace the router if it’s end of life.

If you believe criminals used your router, the FBI says to file a complaint at ic3.gov. If your personal information was exposed, it says to contact your account providers right away. They can help you regain control of your accounts, change passwords and set alerts. See also our guide to telling whether you’ve been hacked.

What can go wrong

• You lock yourself out. If you lose the new admin login, check the manual for how to reset the router. A reset erases your changes, so you would start over with this list. Write the new login down in a safe place.
• An old device can’t connect. After you change the encryption, some old devices may fail to join. Use WPA2 with AES rather than a weaker setting.
• Something stops working after you turn off UPnP. CISA says you may need it briefly to add a device. Turn it back on only for that, then off again.
• Smart devices need more than the internet. CISA says to move them to the guest network if the internet is all they require. Others may need the main network.

What to do now

1. Log in to your router. Change the admin login and your Wi-Fi password, using long, random and unique ones.
2. Install the latest firmware. Turn on automatic updates if you can.
3. Check that the encryption is WPA3 Personal or WPA2 with AES. Turn off remote management, WPS and UPnP.
4. Set up a guest network. Move visitors and smart-home devices to it.
5. Look up your router model on the maker’s support site. If it’s end of life, plan to replace it.