The neighbour who “must be stealing the Wi-Fi” usually turns out to be channel congestion. But the settings that let somebody actually get in are real, and most home routers ship with two or three of them switched on. Twenty minutes in the admin page closes them.
Get into the router and change the password that matters
Type the gateway address into a browser: 192.168.1.1 for most TP-Link, Netgear, and D-Link units; 192.168.0.1 for many older models; 192.168.3.1 for Huawei; 10.0.0.1 for some ISP-supplied gear. The sticker on the back prints the address, the SSID, and the factory login. Brand shortcuts also work — tplinkwifi.net, routerlogin.net, router.asus.com.
Change the admin password first, before anything else. It is separate from the Wi-Fi password and it is what stops somebody already on your network from reconfiguring the router. Use sixteen characters you have not used elsewhere and write them on a sticker under the unit rather than in a browser note.
While you are in there, check firmware: Administration > Firmware Upgrade on TP-Link, Advanced > Administration > Firmware Update on Netgear, Administration > Firmware Upgrade on Asus. Router updates are how known remote-access flaws get patched, and almost nobody opens that page.
Confirm WPA2 or WPA3, then switch WPS off
Under Wireless > Wireless Security you can see the encryption mode. Choose WPA3-Personal if every device in the house was made after roughly 2019; choose WPA2/WPA3 mixed if an older printer, camera, or smart plug may not support it. Never leave it on WEP, and avoid “WPA2-PSK with TKIP”, which some routers still offer — TKIP is deprecated and drags the whole network down to 54 Mbps.
WPS is the bigger hole. Its PIN method validates an eight-digit code in two halves, shrinking the search space to about 11,000 attempts, which somebody in range can walk through in a few hours. Find Wireless > WPS and set it to Disable. The push-button convenience is not worth a permanent back door.
Close the remote doors
Three administration settings are worth re-checking every time you log in:
- Remote management / web access from WAN — off. It exposes the admin page to the public internet.
- UPnP — off unless a games console or torrent client genuinely needs it. UPnP lets any device on the LAN open a port to the outside without asking you.
- Cloud and app remote access — TP-Link ID, Netgear “Anywhere Access” and similar keep a tunnel open to the manufacturer. Disable it if you never use the phone app.
Then set up the guest network even with no guests in the house. Move every smart plug, camera, and TV onto it, enable “AP isolation” or “client isolation” so guest devices cannot talk to each other or to your laptop, and give it a different password. A cheap camera with stale firmware then cannot reach your NAS or your shared folders.
Hiding the SSID and MAC filtering do not work
Both are popular advice and both fail. A hidden network still appears in probe requests and association frames, so any scanning phone reveals it, and a hidden SSID mainly makes your own devices burn battery hunting for it. MAC filtering blocks by hardware address, which anyone can clone in about a minute on a rooted phone or a laptop with a supported adapter.
What does work is the combination above: WPA3 where possible, a long passphrase, patched firmware, and isolation for cheap devices. On WPA2, a captured four-way handshake can be attacked offline, so length beats symbols — four random words are stronger than “P@ssw0rd!”. The Wi-Fi Alliance security overview covers the current standards in more detail.
Tell theft from interference before accusing anyone
Open the router’s DHCP client list — labelled Attached Devices, Device List, or Network Map depending on brand — and count. Two phones, a laptop, a TV, a printer, and four bulbs is nine. A tenth entry with a vendor name you do not recognise, or a device called “android-8f2c”, deserves a look.
Then separate the two problems. If speeds collapse between 7 and 11 pm while the client list is clean, you are sharing spectrum rather than bandwidth: a dozen neighbouring networks on 2.4 GHz do more damage than any freeloader. Fix it by moving phones, laptops, and the TV to 5 GHz and setting 2.4 GHz to channel 1, 6, or 11 at 20 MHz width.
If a neighbour did have the password, changing the Wi-Fi passphrase disconnects every device at once, yours included, so re-add them one at a time and check the router log for unfamiliar logins. If the unit supports it, disable new-device access until you have finished reconnecting. Pair this with a proper guest network, and if coverage is the real complaint, router placement or turning an old router into an access point will help more than any security tweak.