How to Secure Your Home Router: 10-Minute Checklist
Ten settings that close the most common gaps, in order. Each comes from US government guidance.
To secure your home router, change the admin password, turn on WPA3 or WPA2, install firmware updates, and turn off remote management, WPS and UPnP. Those steps come straight from FTC, CISA and NSA guidance. Most take about a minute each in your router’s settings.
Why secure your router?
The NSA calls the router the gateway into your home network. A compromised router can lead to the compromise of other devices on it.
From the team behind this checker
Want a router that takes this seriously by default?
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site and grades its own router by the same method.
The 10-minute checklist
- Log in to your router. The address and login are usually on the label. CISA notes your internet provider can help.
- Change the admin password. The FTC says to change the default username and password. The FBI recommends a unique, random password of 16 to 64 characters.
- Change the Wi-Fi name and password. The NSA says to use a passphrase of at least 20 characters. The FTC says to avoid your name, address or router brand.
- Turn on WPA3, or WPA2 if needed. The FTC calls WPA3 the newer and best option. The NSA says to use WPA2/WPA3 mixed mode for devices that cannot do WPA3. See our WPA3 guide.
- Update the firmware. The NSA says to run the latest patches, preferably through automatic updates. See our firmware guide.
- Turn off remote management. CISA, the FTC, the FBI and the NSA all recommend it.
- Turn off WPS. CISA says a design flaw in the WPS PIN method makes it much faster to guess.
- Turn off UPnP. CISA warns malware can use it to get around the router’s firewall.
- Separate guests and smart devices. The NSA says to split home Wi-Fi into at least primary, guest and IoT networks.
- Check the firewall, then log out. CISA notes some firewall features may be off by default.
Bonus: reboot weekly. The NSA recommends it, because some router implants do not survive a restart.
Which steps matter most?
If you only have two minutes, change the admin password and update the firmware.
Those close the two routes that show up most in government botnet warnings. CISA says Mirai used just 62 common default logins. The FBI says TheMoon needs no password at all.
If your router lacks these settings
If it only offers WEP or WPA, the FTC says to try a software update first. If WPA2 or WPA3 still does not appear, get a new router.
If it no longer gets updates at all, the NSA says to replace it. Our end-of-life guide shows how to check.
Did the checklist work?
Settings are half the picture. The other half is whether your model still gets patches and how many known flaws it has. You can check your router’s grade to see both.
Frequently Asked Questions
No. The NSA says hiding the network name (SSID) adds no security and may cause compatibility problems. Change it from the default instead.
The NSA recommends a Wi-Fi passphrase of at least 20 characters. For the admin password, the FBI recommends 16 to 64 random characters.
Yes. CISA says the WPS PIN method has a design flaw that lets attackers guess it much faster, and many routers do not lock out repeated guesses.
It can be. CISA says malware inside your network can use UPnP to bypass the router firewall. Turn it off unless a device or game needs it.
Turn on automatic updates if your router has them, as the NSA recommends. If not, the NSA says to check at least monthly.
Sources
Dates show when each source was published or when we checked it.
- NSA Cybersecurity Information Sheet: Best Practices for Securing Your Home Network (February 22, 2023)
- CISA: Home Network Security (February 1, 2021, last revised March 23, 2023)
- FTC Consumer Advice: How To Secure Your Home Wi-Fi Network (December 2022, checked October 7, 2026)
- FBI IC3 PSA I-050725-PSA: Cyber Criminal Proxy Services Exploiting End of Life Routers (May 7, 2025)
- CISA Alert TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets (October 14, 2016, revised October 17, 2017)
CHECK YOUR ROUTER
See how your router scores
Get its FCC status, CVEs, grade and an action plan.
Check a Router → Top 10 Safe Routers