Should You Turn Off Remote Management on Your Router?
One setting decides whether strangers on the internet can reach your router’s login page. Here is how to check it.
Yes. Turn off remote management unless you truly need it. It lets people on the internet reach your router’s login page, not just people in your home. The FBI, CISA, the NSA and the FTC all advise turning it off.
What is remote management?
CISA says most routers offer the option to view and change their settings over the internet. The FBI calls it remote management or remote administration.
NETGEAR says the Remote Management feature in its router web interface opens an external port. That port is the door outsiders can knock on.
CISA’s directive on management interfaces names web (HTTP and HTTPS), SSH and Telnet among the remote management protocols it covers.
From the team behind this checker
Want a router that takes this seriously by default?
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site and grades its own router by the same method.
Why is remote management risky?
- Login pages were not built for the open internet. CISA says most device management interfaces are not meant to be reached directly from the public internet.
- Attackers look for it. In 2025, the FBI said end-of-life routers with remote administration turned on were compromised by a new variant of TheMoon malware.
- Some attacks need no password. The FBI says TheMoon scans for open ports and sends a command to a vulnerable script.
- State hackers use it too. After Russian state actors hijacked routers, the FBI and NSA advised firewall rules to stop exposing remote management services.
What do the agencies advise?
- CISA: turn it off to guard against unauthorized people changing your router’s configuration.
- FBI: disable remote management or remote administration.
- NSA: disable remote administration and make changes only from inside your network.
- FTC: turn off remote management, along with WPS and UPnP.
- NIST: configure home routers so they cannot be administered from outside the home network.
Federal agencies have to do this too. Since June 2023, CISA’s BOD 23-02 has required agencies to take router management interfaces off the public internet, or put separate access controls in front of them, within 14 days of finding one.
How do you check and turn it off?
- Log in from home, on a device connected to your router.
- Find the setting. Look in the advanced or administration settings for remote management, remote administration or remote access.
- Turn it off and save.
- Turn off UPnP too, as the NSA advises. See what UPnP is.
- Update the firmware and set a unique, random admin password of 16 to 64 characters, as the FBI recommends.
What if you need to manage it while away?
Some makers now offer app-based access instead. NETGEAR says its apps connect through an authenticated cloud service and do not open any ports. It is removing the older Remote Management feature from most of its routers.
If you use any remote option, keep the router updated and the admin password strong. A VPN server on your router is a different feature with its own risks, covered in our router VPN guide.
Is your router still supported?
TheMoon targeted end-of-life routers, which never get fixes. Read our end-of-life guide, or check your router’s grade to see your model’s support status.
Frequently Asked Questions
It depends on the router. NETGEAR says its Remote Management feature is off by default. Check your own settings anyway, since someone may have turned it on.
Yes. You can still change settings from any device connected to your home network. The NSA advises making changes only from inside your network.
It avoids opening a port on your router. NETGEAR says its app access uses an authenticated connection through its cloud and opens no ports. Use a strong account password and keep the app updated.
Often you would not. The FBI lists overheating, connection problems and settings changes you do not recognize as common signs of router compromise.
Ask your provider before changing settings on a gateway it manages. The FTC suggests asking whether your provider sends automatic updates to its router.
Sources
Dates show when each source was published or when we checked it.
- CISA: Home Network Security (February 1, 2021, last revised March 23, 2023)
- FBI IC3 PSA I-050725-PSA: Cyber Criminal Proxy Services Exploiting End of Life Routers (May 7, 2025)
- NSA Cybersecurity Information Sheet: Best Practices for Securing Your Home Network (February 22, 2023)
- FTC Consumer Advice: How To Secure Your Home Wi-Fi Network (December 2022, checked October 7, 2026)
- CISA Binding Operational Directive 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces (June 13, 2023)
- FBI, NSA, US Cyber Command and partners: Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations (JCSA-20240227-001) (February 27, 2024)
- NETGEAR Support: Why is the Remote Management feature being removed from NETGEAR routers? (last updated July 7, 2025)
- NIST SP 800-114 Rev. 1: User’s Guide to Telework and Bring Your Own Device (BYOD) Security (July 2016)
Check your router
See how your router scores
Get its FCC status, CVEs, grade and an action plan.
Check a Router → Top 10 Safe Routers