How to Secure Your Home Wi-Fi Router: 12 Settings to Change Today (UK and US)

To secure your home Wi-Fi router, log in to its settings page, change the admin password, install firmware updates and switch on automatic updates, set the Wi-Fi security to WPA3 or WPA2 (AES), give the network a new name and a long password, and turn off WPS and remote management. Then put visitors and smart gadgets on a guest network and check which devices are connected.

Your router is the front door for every phone, laptop and smart speaker in the house. Most people plug it in and never open its settings again, which is why weak setups stay weak for years.

Here's each setting in the order I'd change it, and why it matters. It works for ISP routers in the UK and US as well as routers you bought yourself. Menu names differ between brands, so look for the closest match.

In this guide:

• Before you start: two passwords, one router
• Step 1: find your router's address and log in
• Step 2: change the admin password
• Step 3: update the firmware and switch on automatic updates
• Step 4: set Wi-Fi security to WPA3 or WPA2 (AES)
• Step 5: rename the network and set a strong Wi-Fi password
• Step 6: turn off WPS
• Step 7: turn off remote management
• Step 8: decide what to do about UPnP
• Step 9: set up a guest network for visitors and smart devices
• Step 10: make sure the router's firewall is on
• Step 11: check which devices are connected
• Step 12: check whether your router still gets security updates
• Settings that sound useful but add little
• Quick home router security checklist
• Frequently asked questions

Before you start: two passwords, one router

Your router has two separate sets of credentials, and people often mix them up:

• The Wi-Fi password (sometimes called the network key or WPA key) is what you type to join the network.
• The admin password is what you type to open the router's settings page and change how it works.

Anyone with the admin password can undo every other step here. The US Federal Trade Commission makes the same point in its guide to securing your home Wi-Fi network.

Before you start, connect a laptop to the router with a cable if you can, because changing the Wi-Fi name or password disconnects wireless devices. Keep the router's sticker handy: it usually lists the default network name and both passwords.

Step 1: find your router's address and log in

Router settings live on a small web page inside your network, reached by typing the router's local address into a browser. The sticker on the router often shows it. If it doesn't, your computer can tell you, because the router's address is your default gateway.

Common answers are 192.168.1.254 (BT Smart Hub) and 192.168.0.1 (Virgin Media Hub and many others), but use the one your device reports. Type it into the browser, then sign in with the admin password from the sticker. Some providers point you to a phone app instead; the settings are the same.

Step 2: change the admin password

Look for a section called Administration, System, Admin settings or Account. If the router still uses a shared default such as admin/admin or admin/password, change it first. Anyone who looks up your router model can find those defaults in seconds.

1. Open the admin or system settings.
2. Change the username too, if the router allows it.
3. Set a long, unique password that you don't use anywhere else.
4. Save, then log out and back in to confirm it works.
5. Store it in your password manager, not on a note on the router.

A random 16-character password or three to five random words is plenty. You only type it occasionally, so you can afford to make it long. If you need one quickly, our free password generator creates it in your browser without sending it anywhere.

Step 3: update the firmware and switch on automatic updates

Firmware is the router's own software. Updates fix security holes, and an unpatched router can be taken over without anyone needing your password.

1. Find the Firmware, Software update or System update section.
2. Check the current version and run the update check.
3. If an update is available, install it and don't switch the router off while it runs.
4. Turn on automatic updates if the option exists.

Many ISP routers update themselves, so you may not see an update button. On a router you bought yourself, download firmware only from the manufacturer's own support site.

Step 4: set Wi-Fi security to WPA3 or WPA2 (AES)

Open the wireless or Wi-Fi security settings and look at the security mode. This is what encrypts the traffic between your devices and the router. The US Cybersecurity and Infrastructure Security Agency describes WPA3 Personal and WPA2 with AES as the only safe choices in its home Wi-Fi security module.

After saving, reconnect each device. If an old printer or games console refuses to join, try the mixed mode before dropping back to WPA2 only.

Step 5: rename the network and set a strong Wi-Fi password

Default network names such as BTHub-1234 reveal the provider, which tells an attacker which model to research. Pick a name without your surname, house number or router brand.

Then set a new Wi-Fi password: long, because anyone in range can try to guess it, but typeable on a smart TV. Several random words work well. If you want a deeper look at what makes a password strong, read my guide on how to create a strong password.

Every wireless device will need reconnecting afterwards, so allow a few minutes.

Step 6: turn off WPS

Wi-Fi Protected Setup (WPS) lets a device join by pressing a button on the router or typing an eight-digit PIN. It's convenient, but the PIN method has a long history of being brute-forced by someone within range, and several government guides recommend turning WPS off completely.

1. Look in the wireless settings for WPS.
2. Turn it off, or at minimum disable the PIN method.
3. Save, then connect future devices with the Wi-Fi password instead.

Some ISP routers don't let you switch off the WPS button, which makes the router's physical location more important.

Step 7: turn off remote management

Remote management (also called remote administration, remote access or web access from WAN) lets someone reach the router's settings page from the internet. You almost never need it at home, and leaving it on means the login page is exposed to anyone who finds it.

Find it under Administration, Advanced or Security, switch it off and save. If your ISP manages the router, that usually runs over a separate channel and keeps working.

Step 8: decide what to do about UPnP

Universal Plug and Play (UPnP) lets devices on your network open ports in the router's firewall on their own. Games consoles, video calling apps and some smart devices use it to work without manual setup. The downside is that malware on any device can use it the same way.

A sensible approach for most homes:

• Turn UPnP off and see whether anything breaks over the next few days.
• If a console shows a strict NAT type, add a specific port forward for it instead, using the maker's port list.
• If you need UPnP back on, accept the trade-off and keep every device updated.

Step 9: set up a guest network for visitors and smart devices

Most modern routers can broadcast a second, separate network. Devices on the guest network can reach the internet but not your laptops, phones or shared drives.

1. Find Guest network or Guest Wi-Fi in the wireless settings.
2. Give it its own name and a different password.
3. Use WPA3 or WPA2 (AES), exactly as for the main network.
4. Leave options such as "allow guests to see each other" or "access local network" switched off.

Put visitors on it, and consider moving smart plugs, cameras and speakers there too. Cheap smart devices often get fewer updates, so keeping them apart limits the damage if one is compromised. Some control apps need the phone on the same network, so test before you move everything.

Step 10: make sure the router's firewall is on

Home routers include a firewall that blocks unrequested connections from the internet. It's normally on by default, but check it, especially if someone once changed settings for gaming.

• Confirm the firewall is enabled. Leave the default level unless you know you need a different one.
• Check Port forwarding and DMZ settings. Remove any rules you don't recognise or no longer need.
• A DMZ host is exposed to the internet on every port, so it should almost always be empty at home.

Step 11: check which devices are connected

Your router keeps a list of connected devices, usually under Connected devices, Device list, Attached devices or DHCP clients. Go through it and match each entry to something you own. Phones and laptops often appear with random-looking names because of private MAC addresses, so switching devices off one at a time can help you identify them.

If something stays unexplained, change the Wi-Fi password, which kicks everything off, and reconnect only your own devices.

Step 12: check whether your router still gets security updates

A router that no longer gets updates stays vulnerable however carefully you set it up. Check the date of the latest firmware for your model on the maker's support site. If nothing has arrived for years, or it's listed as end of life, replace it.

In the UK, the Product Security and Telecommunications Infrastructure (PSTI) regime has applied since 29 April 2024. It bans universal default passwords on connectable consumer products and requires manufacturers to state the minimum period for which a device will get security updates. The National Cyber Security Centre explains what the smart devices law means for buyers. When you buy a new router, check that support period before the speed figures.

Settings that sound useful but add little

Some guides suggest hiding the network name or using MAC address filtering. Neither should replace the steps above:

• Hiding the SSID doesn't hide much, because connecting devices still reveal the name, and it can make connections flakier.
• MAC filtering is easy to bypass, since MAC addresses can be copied, and modern phones change theirs per network.

Physical security matters more. Anyone who can reach the router can press reset and log in with the sticker details, so keep it out of visitors' reach.

Quick home router security checklist

After a factory reset or a major firmware update, run through this list again.

Frequently asked questions

What is the most important router setting to change?

Change the admin password first, because anyone who can log in to the router can change every other setting. Then update the firmware and make sure Wi-Fi security is set to WPA3 or WPA2 with AES.

Is WPA2 still safe to use at home?

WPA2 with AES is still considered acceptable for home networks when you use a long, unique Wi-Fi password. WPA3 is better, so use it, or a mixed WPA2/WPA3 mode, if your router and devices support it.

How do I log in to my router?

Connect to the router, then type its local address, usually the default gateway shown on your device, into a web browser. Sign in with the admin password printed on the router's sticker or the one you set later. Some providers use a phone app instead.

Should I turn off WPS on my router?

Yes, for most homes. WPS is a convenience feature, and the PIN method in particular can be brute-forced by someone within range. Connect new devices with the Wi-Fi password instead.

Does hiding my Wi-Fi network make it more secure?

Not much. A hidden network name is still revealed when devices connect, and hiding it can make connections less reliable. Strong encryption and a long password protect you far more.

What should I do if I see an unknown device on my Wi-Fi?

First try to identify it by switching your own devices off one at a time. If it's still unexplained, change the Wi-Fi password, reconnect only your devices and check that the admin password and remote management settings haven't been changed.

Do I need a new router to be secure?

Not always. If your router still gets firmware updates and supports WPA2 AES or WPA3, the settings in this guide make it reasonably secure. Replace it if updates have stopped or it only offers WEP or WPA.

Last checked: 21 October 2026. Figures, settings and guidance can change, so confirm anything important with the sources linked above.