A new router ships with the same factory settings as thousands of others, which makes setup easy and your network easy to attack. Before you connect anything important, log into the admin panel — usually at 192.168.0.1 or 192.168.1.1, and printed on the sticker underneath the unit — and work through the list below. 1. Update the firmware before anything else. Manufacturers patch security holes through firmware, and a router that sat in a warehouse for a year is running old code. Look for an update option in the admin panel, or download the file from the manufacturer's support page and upload it manually. 2. Change the admin password immediately. Default credentials are printed in manuals and collected in online databases; use a long, unique passphrase you don't reuse anywhere else. If the router allows it, disable administration from the WAN side so nobody outside your home can reach the login page.

3. Set wireless encryption to WPA3 if every device supports it, and WPA2 with AES otherwise. WEP and TKIP are broken and should be treated as no protection at all. In the wireless security menu, look for WPA2-PSK (AES) or WPA3-Personal and avoid any mixed mode that still permits TKIP, since a network falls back to its weakest option. 4. Turn off WPS. Wi-Fi Protected Setup was designed to let you join devices without typing a long password, but its PIN method can be attacked in a matter of hours because the code is validated in two halves. Most routers bury the setting under a Wireless or Wi-Fi menu; set it to disabled and use the password instead.

5. Disable remote management and UPnP. Remote administration exposes your router's settings to the internet, and UPnP lets any app or malware on your network open firewall ports without asking you. Both are conveniences with real costs. If a game console or a peer-to-peer app complains, forward the one port it actually needs rather than leaving UPnP running for everything. 6. Put smart devices on a separate guest network. Televisions, cameras, bulbs, and plugs rarely receive security updates and tend to be the most vulnerable things on a home network. Most modern routers let you run a guest SSID with client isolation, which keeps those devices from reaching your laptop, phone, or network storage.

7. Rename your network and stop hiding it. Hiding the SSID adds no real security, because anyone scanning the airwaves can still see the traffic, but it does break roaming between access points and confuse some devices. A distinct name also helps you avoid connecting to a neighbor's look-alike network by mistake. 8. Fix performance with placement before you buy new hardware. Put the router high, central, and out in the open; walls, metal shelving, fish tanks, and microwaves all eat signal. Use the 5 GHz or 6 GHz band for devices in the same room and 2.4 GHz for anything far away, since lower frequencies travel farther but carry less data. Let the router choose channels automatically, or run a Wi-Fi analyzer app and pick the least crowded one manually if your neighborhood is dense.

9. Point the router at an encrypted DNS resolver. Your internet provider can see every domain your devices look up unless you change the default. Public resolvers such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8 support DNS-over-HTTPS or DNS-over-TLS, and many routers now let you enter those directly in the WAN settings. It won't hide everything you do, but it stops casual logging of your browsing. 10. Set a reboot habit and audit the device list monthly. A scheduled weekly restart clears memory leaks and applies queued updates, which matters on budget routers that rarely get restarted. Then open the connected-devices page and confirm you recognize everything listed. An unfamiliar name is the earliest warning sign that someone else is using your network.