How to secure your Wi-Fi router: 7 essential settings

Millions of people have never opened their own router's control panel. The box arrived from the ISP, got plugged into the wall and has stayed that way ever since — default password printed on the label, WPS enabled and firmware years out of date. For an attacker within Wi-Fi range, that combination is enough to compromise the entire home network in a matter of hours.

None of the settings below require advanced technical knowledge. Together, they take less than 30 minutes to apply.

Where these settings live

Every router has a web interface you can reach from a browser. The default address is usually 192.168.0.1 or 192.168.1.1 — it's printed on the label stuck to the device. Log in with the administrator username and password (still the default one? See item 1 below).

1. Change the administrator password

Every router model ships with default admin credentials — and those combinations are all publicly catalogued on the internet. Any device on your network, including one that has been compromised, can open the panel and change settings if the default password was never changed.

Use a long password (16 characters minimum), different from your Wi-Fi network password. If you'd rather not memorize it, a password manager like Bitwarden does that work for you.

2. Update the firmware

Manufacturers release updates that fix real vulnerabilities — but home routers rarely update themselves. You have to check manually. In the panel, look for Firmware Update, Software Update or similar.

Routers running firmware that's years out of date are a frequent target for botnets like Mirai and its variants, which swept the internet compromising devices with default credentials and known holes. Updating the firmware closes those doors.

3. Use WPA3 — or at least WPA2-AES

Which Wi-Fi protocol is the most secure?

WPA3 is the current standard with the strongest encryption. If your router supports it, enable WPA3-SAE. If not, use WPA2-AES (also called WPA2-CCMP) — never WEP, WPA1 or the "mixed" mode that includes TKIP.

WEP was being broken in under a minute as far back as 2007. TKIP, from WPA1, has had known weaknesses for more than a decade. If the panel shows "WPA2/WPA Mixed Mode", switch to pure WPA2-AES — "mixed" exists only for compatibility with old devices that, honestly, don't deserve to be on your network.

4. Disable WPS — it has an unfixable flaw

Why is WPS dangerous?

WPS uses an 8-digit PIN with a design flaw that lets it be tested in two 4-digit halves. In practice, an attacker recovers the full PIN in a few hours — and with it, gets onto the network regardless of how strong your Wi-Fi password is.

This vulnerability has existed since 2011 and has never been fixed, because it lives in the protocol specification rather than in any specific implementation. The only real solution is to disable WPS entirely. Look under Wireless → WPS or Wi-Fi → Protected Setup and turn the option off.

5. Create a separate network for guests and IoT

Security cameras, smart TVs, voice assistants and other IoT devices rarely get regular updates and have a well documented history of vulnerabilities. Putting them on the same network as your main computer and phone is an unnecessary risk — one compromised device can become the entry point to all the rest.

Most modern routers let you create a guest network isolated from the main one. Use it for visitors and for every IoT device in the house. The concept is the same one we discussed about Evil Twin attacks on public networks: segment the traffic to limit the blast radius.

6. Disable remote access and UPnP

Remote access over WAN lets you administer the router from outside the house. Most people never need it, but the feature is on by default on many models — exposing the admin panel directly to the internet. Turn it off in the administration settings.

UPnP (Universal Plug and Play) lets devices on the network open ports on the router automatically. It's frequently abused by malware to create backdoors without the user noticing. Disable it in the advanced settings.

If you genuinely need remote access to your network, set up a VPN instead of using the router's native WAN access — and understand exactly what a VPN protects and what it doesn't solve.

7. Configure a secure DNS

Your ISP's default DNS transmits your queries unencrypted, which means every domain you visit can be logged and analyzed. Switching to a DNS server with DoH (DNS-over-HTTPS) or DoT (DNS-over-TLS) fixes that — and services like NextDNS also block trackers and malicious domains before any connection is established.

To configure it on the router, look for DNS in the WAN or LAN network settings and replace the addresses with those of your chosen provider. The complete guide on how to set up and customize NextDNS with blocklists covers that process step by step.

Quick checklist

• Admin password changed (different from the Wi-Fi network password)
• Firmware updated to the latest version
• WPA3-SAE or WPA2-AES protocol active
• WPS disabled
• Separate guest network for IoT and visitors
• Remote access over WAN disabled
• UPnP disabled
• Secure DNS configured

These 7 settings cover the most common attack vectors against home networks — default passwords, old firmware, weak protocols and unnecessary services left exposed. The router is the one piece of equipment every bit of traffic in the house passes through; it's worth the 30 minutes. To keep strengthening your network's privacy, the next step is the guide on encrypted DNS with NextDNS.