I’d had the same WiFi setup running since I moved in, untouched, on the assumption that whatever came configured out of the box was probably fine. Going through it properly turned up a few things worth fixing, and none of them took long.
The admin password was still the factory default. This was the one that actually worried me. Anyone who knows the router’s brand can look up the default login online in seconds — changing this to something unique took two minutes and closed off the most obvious vulnerability I had.
WPS was still enabled. This is the button-press or PIN-based pairing feature meant to make connecting new devices easier, but it’s a known weak point that’s rarely worth the convenience. I turned it off, since I set up new devices manually anyway.
My network was still on WPA2. Fine, but not the strongest available. Switching to WPA3, which my router supported but had never been enabled, added a meaningfully stronger layer of encryption for anyone trying to guess their way in from outside.
The WiFi password itself was old and short. I replaced it with something longer and genuinely random rather than a word with numbers tacked on the end — length matters more than complexity for resisting the kind of automated guessing attempts that actually target home networks.
Guest network wasn’t set up at all. Visitors had been using the main network this whole time, meaning any device they brought along had access to everything else on it. Setting up a separate guest network took a few minutes and means a visitor’s possibly-compromised phone never touches my main devices.
Firmware hadn’t been updated in what looked like over a year. Security patches for known vulnerabilities come through firmware updates, and mine simply hadn’t been checked since setup. This one’s easy to forget entirely since most routers don’t update themselves automatically.
Remote management was switched on, allowing router settings to be changed from outside my home network — a feature I had no use for and hadn’t consciously enabled, which suggested it might have been on by default from the start. I turned it off.
UPnP was enabled, a feature that lets devices and apps automatically open ports on your router without asking. Convenient for some smart home setups, but also something certain kinds of malware can exploit. I left it off for now since nothing I use actually needs it.
Checked the connected devices list for anything unfamiliar. Nothing suspicious turned up in my case, but this is worth doing periodically — an unrecognized device is one of the clearer signs something’s accessing your network without permission.
Considered a router-level VPN, which encrypts traffic for every device on the network at the source rather than requiring a VPN app installed individually — useful specifically for smart home devices that can’t run a VPN client themselves. I didn’t end up using this, but it’s worth knowing it exists if you have a lot of IoT devices.
Set a reminder to actually check all of this periodically, rather than assuming initial setup was a one-time task. Firmware updates and password strength both degrade in relevance over time as new vulnerabilities are discovered.
None of this took more than about twenty minutes total, and most of it was flipping settings that were probably left on default from day one rather than anything requiring real technical skill. If you’ve never gone into your router’s security settings since setup, there’s a good chance a few of these are sitting exactly as they came out of the box.
Tanimur Rahman is the founder of Internet Fix Guide. He writes step-by-step tutorials to help users solve WiFi, router, and internet connectivity problems quickly.