Secure your home Wi-Fi router in 20 minutes

Why this matters to you

Your 2-minute quick win

Flip your router over and look for any sticker that shows an admin password, setup password, or login details. If you still use that printed password to sign in to the router settings, put a note on your phone now to change it the next time you open the router admin page. Success looks simple: the password printed on the router no longer lets you into the settings.

Your router is the front door of your home network. Phones, laptops, TVs, speakers, cameras, thermostats, and game consoles all pass through it.

The UK National Cyber Security Centre says smart devices connect to the internet or to your home network, usually by Wi-Fi. That means a weak router can affect many devices at once.

The same guidance warns that a device is not secure if a criminal can guess the password used to access it. That principle applies directly to router admin passwords.

Many people protect their laptop and phone, then forget the box that connects everything. That gap matters because a router often stays in place for years.

The NCSC also says manufacturers need to release updates that fix bugs or security issues. If those fixes are ignored, a device becomes easier to hack.

Routers are no different. If the router software is old, it may keep known weaknesses for far too long.

This guide focuses on quick, safe changes. You do not need to be technical, and you do not need to buy a new router first.

What you are protecting

First, you are protecting access to the router itself. The admin page controls the network name, Wi-Fi password, encryption mode, updates, and features such as remote access.

Second, you are protecting the devices that rely on that router. The NCSC notes that criminals who can log into a smart device may use it to access your network or conduct cyber attacks.

That same risk grows if a criminal reaches the router settings. A changed router setting can affect every device that joins your network.

You are also protecting privacy. Smart devices can include security cameras, speakers, baby monitors, thermostats, kettles, and washing machines, according to the NCSC.

Some of those devices collect personal data or show live activity inside your home. A safer router reduces one common route to that data.

You are protecting reliability too. Updates often add features and keep devices working as they should, the NCSC says.

Finally, you are protecting future decisions. If you later sell or give away a smart device, the NCSC advises a factory reset first so personal data is removed.

That habit starts with knowing where your network settings live and how to reach them safely.

What it costs you if you skip this

If you keep the factory admin password, someone who knows or guesses it may be able to log into the router settings. The NCSC is clear that easy-to-guess passwords put devices at risk.

If you skip updates, the router may miss fixes for bugs or security issues. The result can be a device that is easier to hack.

If remote access stays on when you do not need it, you keep an extra way into the device. The NCSC says to switch off remote access if you do not need to reach the device away from home Wi-Fi.

If you use old or mixed wireless settings for convenience, you may keep weaker options active for longer than needed. At minimum, use the strongest security mode your router and devices both support.

If you never check what devices are connected, you may miss an old device, a guest device, or something you no longer recognise. Even if you cannot identify every item, the device list is still worth a quick look after changes.

The cost is not only a dramatic hack. It can also be small, annoying problems such as mystery disconnects, forgotten passwords, and no clear way to recover because the router was never set up properly.

Step by step

1. Connect to your home Wi-Fi, then open the router admin page in a browser or the manufacturer app if your router uses one. Done correctly, you see a sign-in screen for router settings rather than a normal website.

2. Sign in with the current admin details. If the password is still the factory one from the sticker or quick-start sheet, go straight to the admin password setting after login. Done correctly, you can reach a page for account, administration, or password settings.

3. Change the router admin password to a new strong password that is not easy to guess. The NCSC recommends creating a secure password by combining three random words. Done correctly, the router asks you to sign in again with the new password, and the old one stops working.

4. Find the Wi-Fi security setting for your wireless network. Look for a section named Wi-Fi, Wireless, Security, or similar. Done correctly, you can see the current security mode for your home network.

5. Set the Wi-Fi security mode to the strongest option supported by your router and devices, ideally WPA3, or WPA2 if WPA3 is not available. Done correctly, the security line shows one clear modern mode instead of an older or mixed option.

6. Change the Wi-Fi password if it is short, reused, or printed on a card that too many people have seen. Done correctly, the router saves the new password and your devices will need to reconnect with it.

7. Check whether the router offers 2-step verification for the admin account or companion app. The NCSC says to turn on 2-step verification if offered. Done correctly, the account settings show 2-step verification, multi-factor authentication, or MFA as on.

8. Turn off remote access unless you truly need to manage the router when away from your home Wi-Fi. The NCSC advises switching off remote access when it is not needed. Done correctly, the remote access toggle shows off, disabled, or not allowed.

9. Check for software or firmware updates and install them promptly. The NCSC says updates fix bugs or security issues and help devices work as they should. Done correctly, you see a message that the router is up to date or that the update has completed.

10. Enable automatic updates if your router offers that option. The NCSC specifically recommends switching on the option to install automatic updates when available. Done correctly, the update setting shows automatic updates as on.

11. Open the connected device list and look for names you recognise, such as your phone, laptop, TV, or speaker. Done correctly, the list mostly matches devices in your home, and nothing surprising remains connected after a few minutes.

12. Save the new admin password and Wi-Fi password in a password manager or another secure place you control. Done correctly, you can sign out, sign back in, and reconnect at least one device without guessing.

If a setting name does not match

Router menus vary a lot between brands. If you cannot find a setting, use the manufacturer app, the printed guide, or the support page for your exact model.

The NCSC says the manufacturer guidance may be a printed sheet, a getting started guide, within the app itself, or on the manufacturer website. Use that exact source for your model rather than random forum advice.

Illustrative example

Leila lives in a flat and works from home two days a week. Her broadband router is three years old, and she has never opened the settings page since installation day.

One evening, she notices that her smart speaker app asks for attention after a recent power cut. That prompts her to spend a short session checking the router as well.

She connects her phone to home Wi-Fi and opens the router app from her provider. The app lets her into a settings screen after the old admin password from the router sticker.

That is her first warning sign. A password printed on the device is convenient, but it is also a default she never changed.

She goes to the administration area and changes the admin password to three random words. The app signs her out, then accepts only the new password when she signs in again.

Next, she opens the wireless security page. The router offers WPA3, so she selects it and saves the change.

Her older tablet drops off the network for a moment, then reconnects after she enters the Wi-Fi password again. Her newer devices reconnect without drama.

Leila then checks for updates. The router installs one pending update and shows that automatic updates can be turned on, so she enables that option.

After that, she opens the remote access setting. She does not manage her router away from home, so she switches remote access off.

Finally, she checks the connected device list. She recognises her phone, laptop, TV, speaker, and tablet, and nothing else remains online after a short refresh.

By the end, she has changed the weakest default, turned on a safer update path, and removed a feature she did not need. Her network is not perfect forever, but it is clearly harder to misuse than it was an hour earlier.

The near-miss

Now replay the same evening with one step skipped. Leila changes the Wi-Fi password but leaves the router admin password at its factory value because she thinks the Wi-Fi password is the only one that matters.

A month later, she wants to check a device problem and opens the router app again. She notices that remote access is on, even though she does not remember enabling it.

She can still sign in with the printed password from the sticker. That tells her the admin side of the router was never really secured.

She has no proof that anyone abused it, but the risk is obvious: if a password is easy to guess or still a default, the NCSC says the device is not secure. She changes the admin password at once, turns remote access off, and checks for updates before doing anything else.

How to check it worked

Start with the simplest test. Sign out of the router admin page, then try the old admin password once. It should fail.

Next, sign in with the new admin password. You should reach the settings page without needing the old one at any point.

Open the wireless security page again and confirm the selected mode still shows WPA3 or WPA2, depending on what your devices support. If it slipped back to an older setting, save it again and wait for the router to restart.

Check the updates page. You want to see either that the router is up to date or that the most recent update completed successfully.

Confirm that automatic updates remain on if your router supports them. Some routers hide this inside advanced settings or maintenance menus.

Open the remote access setting and make sure it still shows off if you do not use it. A disabled state should be clearly visible on the screen.

Finally, reconnect two or three normal devices, such as your phone, laptop, and TV. If they join the network and work normally, your main changes have held.

Test yourself

Question: What is the first password you should change on a home router?

Answer: Change the router admin password first, especially if it is still the factory or sticker password.

Question: What should you do if the router offers 2-step verification?

Answer: Turn it on, because it makes access harder even if someone knows your password.

Question: When should remote access stay enabled?

Answer: Keep it enabled only if you truly need to manage the router away from your home Wi-Fi.

Common mistakes

Changing only the Wi-Fi password. This helps, but it does not protect the admin side of the router if that login still uses the factory password.

Ignoring updates. The NCSC says updates fix bugs or security issues, and ignored devices become easier to hack.

Leaving remote access on by default. If you never use it, it only increases exposure.

Forgetting to turn on automatic updates. A manual check today is useful, but automatic updates help after you forget.

Keeping unsupported hardware for too long. The NCSC says devices that are out of support are easier to hack and may stop working altogether. Think of the support date as a use by date.

Using easy-to-guess passwords. A short, reused, or obvious password can be discovered by criminals. Three random words is a practical starting point.

Skipping the manufacturer guidance. Your exact model may store key settings in a different menu, and the safest instructions are the ones written for that model.

Level up

Once your router is locked down, apply the same habits to the devices that use it. The NCSC recommends changing any default password on a smart device, turning on 2-step verification if the device or app offers it, switching off remote access if you do not need it, and enabling automatic updates where available.

That one extra step matters because home security is shared. A safer router protects the network edge, and safer smart devices reduce risk inside the network as well.