How to Tell If Your Router Has Been Hacked
The warning signs to look for, and what to do in the next 30 minutes if you think yours is compromised.
The most common signs of a hacked router are settings you did not change, a connection that keeps dropping, and a router that runs hot. The FBI lists exactly those three as common signs of router malware. If you see them, update the firmware, change the passwords, and reboot. If the router no longer gets security updates, replace it.
Signs your router was hacked
No single sign proves a hack, but each is worth checking.
- Settings you did not change. The FBI names this as a common sign of infection. Check the Wi-Fi name, admin password, port forwarding and DNS.
- Your passwords stop working. The FTC warns that a hacker with admin access can change settings, including the Wi-Fi password.
- Unknown devices. CISA advises watching for unauthorized devices. Your router’s device list shows what is connected.
- Overheating or a flaky connection. The FBI lists both as common signs.
- Odd DNS settings. If the DNS server is an address you do not recognize, read our DNS hijacking guide.
- Remote management is on. Not proof of a hack, but the FBI found a recent variant of TheMoon malware on end-of-life routers with remote administration turned on.
Most router infections show no sign at all. The FBI said VPNFilter’s use of encryption made its activity hard to detect. The FBI notified KV botnet router owners after the fact.
From the team behind this checker
Want a router that takes this seriously by default?
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site and grades its own router by the same method.
How routers get hacked
- Default passwords. CISA says Mirai took over large numbers of devices with a list of just 62 common default logins.
- Unpatched flaws. The FBI says TheMoon needs no password. It scans for open ports and sends a command to a vulnerable script.
- End-of-life hardware. The Justice Department says the vast majority of KV botnet routers were Cisco and NetGear models that no longer got patches.
What to do if it is hacked
Work through these steps in order. They combine FBI, CISA and NSA advice.
- Unplug the internet cable so the router is offline while you work.
- Do a factory reset. In a 2024 case, the FBI and NSA advised a hardware factory reset to flush malicious files.
- Update the firmware. See our firmware update guide.
- Set new admin and Wi-Fi passwords. The FBI recommends unique, random passwords of 16 to 64 characters.
- Turn off remote management and UPnP. The FBI and NSA say to disable remote administration. The NSA adds UPnP.
- Only then reconnect. CISA warns a device reconnected before its password is changed can be reinfected quickly.
- Check it is still supported. If it is end of life, the FBI says to replace it. See our end-of-life guide.
- Secure your accounts and report it. The FBI suggests changing account passwords and filing a complaint at ic3.gov.
Does a reboot remove malware?
Sometimes, but not reliably. CISA says Mirai lives in memory, so a reboot clears it. The NSA recommends rebooting at least weekly.
But a reboot does not close the hole the attacker used, and some malware survives it. That is why the FBI and NSA have called for a factory reset, a firmware update and new passwords.
Check your router’s risk
You can check your router’s grade in a few seconds. It shows support status, known CVEs and an action plan for your model.
Frequently Asked Questions
Yes. A strong password stops password guessing, not attacks on software flaws. The FBI says TheMoon malware infects routers without a password, so keep the firmware updated and remote management off.
Do not count on it. In the 2023 KV botnet case, the FBI notified owners as part of a special operation. Check your router yourself.
It is the right first step. The FBI and NSA advised a factory reset, then a firmware update and new passwords. If the router no longer gets security updates, replace it.
It can. The FBI said VPNFilter could potentially collect information passing through infected routers. A 2024 FBI and NSA advisory said Russian state actors used hacked routers to harvest credentials.
File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The Justice Department also points people to CISA’s online reporting.
Sources
Dates show when each source was published or when we checked it.
- FBI IC3 PSA I-050725-PSA: Cyber Criminal Proxy Services Exploiting End of Life Routers (May 7, 2025)
- FBI IC3 PSA I-052518-PSA: Foreign Cyber Actors Target Home and Office Routers and Networked Devices Worldwide (VPNFilter) (May 25, 2018)
- CISA Alert TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets (October 14, 2016, revised October 17, 2017)
- U.S. Department of Justice: U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure (KV Botnet) (January 31, 2024)
- FBI, NSA, US Cyber Command and partners: Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations (JCSA-20240227-001) (February 27, 2024)
- CISA: Home Network Security (February 1, 2021, last revised March 23, 2023)
- FTC Consumer Advice: How To Secure Your Home Wi-Fi Network (December 2022, checked October 7, 2026)
- NSA Cybersecurity Information Sheet: Best Practices for Securing Your Home Network (February 22, 2023)
CHECK YOUR ROUTER
See how your router scores
Get its FCC status, CVEs, grade and an action plan.
Check a Router → Top 10 Safe Routers