What Is WPS on a Router, and Is It Safe to Use?
The shortcut button on your router comes with a PIN that attackers can guess. Here is why to turn it off.
WPS (Wi-Fi Protected Setup) lets a device join your Wi-Fi with a button press or an 8-digit PIN instead of the password. The PIN method has a known design flaw that makes it far easier to guess. CISA and the FTC both say to turn WPS off.
What is WPS?
WPS is a Wi-Fi Alliance standard. The Wi-Fi Alliance says it was designed to make secured Wi-Fi easier to set up in homes and small offices.
It usually works in one of two ways:
- Push button. The FTC describes pushing a button on the router to connect a device instead of entering the Wi-Fi password.
- PIN. CERT/CC describes a method that only needs the router’s 8-digit PIN.
From the team behind this checker
Want a router that takes this seriously by default?
- SecureRooms. Smart devices live apart from your computers.
- You approve every new device before it joins.
- Rio VPN built in. First year included.
- Set up in about 10 minutes from the app.
$199.99 · 1 year of VPN included, then $7.99/mo · 30-day returns · 1-year warranty. Rio builds this site and grades its own router by the same method.
Why is the WPS PIN unsafe?
The router lets an attacker know when the first half of the PIN is right. CERT/CC says that, plus a last digit that is only a checksum, cuts the guesses needed from 100 million to about 11,000.
CISA and CERT/CC add that many routers have no lockout after failed guesses. That makes a brute-force attack much more likely.
CERT/CC published the flaw in December 2011. Its advisory listed router makers including Belkin and Buffalo as affected.
What an attacker gets: CERT/CC says someone in Wi-Fi range who cracks the PIN may recover your Wi-Fi password, change the router’s settings or knock it offline.
Is the WPS button safer than the PIN?
The flaw CERT/CC described is in the PIN method. But the FTC advises turning off WPS as a whole, along with remote management and UPnP. It says these features are convenient but can make your network less secure.
If your router only lets you disable part of WPS, CERT/CC says to turn off the PIN. Depending on the brand, it may be labeled external registrar, router PIN or Wi-Fi Protected Setup.
Can a firmware update fix WPS?
Not fully. CERT/CC says the flaw is in the WPS specification itself. Its advisory said it knew of no practical solution, and listed disabling WPS as the workaround.
How do you turn off WPS?
- Log in to your router from a device on your home network.
- Open the wireless settings and look for WPS or Wi-Fi Protected Setup.
- Turn it off, or at least turn off the PIN.
- Save, then add new devices with the Wi-Fi password.
What should you use instead?
Type the Wi-Fi password once on each new device. The NSA recommends a passphrase of at least 20 characters.
Some newer devices support Wi-Fi Easy Connect. The Wi-Fi Alliance says it lets you add a device by scanning a QR code and uses public key cryptography to authenticate it.
Pair this with strong encryption from our WPA3 guide and the rest of our router checklist. You can also check your router’s grade.
Frequently Asked Questions
Yes. CISA and the FTC both recommend it. CISA says a design flaw in the WPS PIN method greatly cuts the time needed to guess it.
Much easier than 8 digits suggests. CERT/CC says the flaw cuts the guesses needed from 100 million to about 11,000, and many routers do not lock out repeated attempts.
The known flaw is in the PIN method, not the button. The FTC still advises turning WPS off entirely, and typing the Wi-Fi password once does the same job.
No. Devices that already joined keep their connection, because they use the Wi-Fi password. Only the WPS shortcut for adding new devices goes away.
Check the printer maker’s instructions for joining with the Wi-Fi password. If you must use WPS, turn it on only for setup, then turn it off again.
Sources
Dates show when each source was published or when we checked it.
- CISA: Home Network Security (February 1, 2021, last revised March 23, 2023)
- CERT/CC Vulnerability Note VU#723755: WiFi Protected Setup (WPS) PIN brute force vulnerability (December 27, 2011, revised May 10, 2012)
- FTC Consumer Advice: How To Secure Your Home Wi-Fi Network (December 2022, checked October 7, 2026)
- Wi-Fi Alliance: Access (Wi-Fi Easy Connect and Wi-Fi Protected Setup) (checked October 8, 2026)
- NSA Cybersecurity Information Sheet: Best Practices for Securing Your Home Network (February 22, 2023)
Check your router
See how your router scores
Get its FCC status, CVEs, grade and an action plan.
Check a Router → Top 10 Safe Routers