A network printer is a small computer with a web server, a file share and a firmware update channel, and most of them are installed in ninety seconds and never opened again. That convenience cuts both ways: anything left at defaults is available to every phone, laptop and smart plug on the same network. The work below takes about half an hour, and most of it happens on one page of the printer’s own interface.
Find the admin page and replace the password
Print a configuration page from the front panel. On an HP LaserJet, press the gear, then Reports > Network Configuration; on a Brother, Menu > Print Reports > Network Config; on an Epson, hold the information button for five seconds. The sheet lists the IP address, usually something like 192.168.1.42, which you type into a browser on the same network.
The first login is where most homes are exposed. Smaller HP OfficeJet and DeskJet units often ship with no admin password until somebody sets one; Epson uses “admin” with the serial number from the label; Brother’s web admin is “initpass” on many models; Canon imageCLASS machines use “7654321” or the serial. None of that is a secret — it is in the manual and on a dozen forums. Set a twelve-character password kept in your password manager, and set it on the device rather than accepting whatever the vendor’s cloud account uses.
Switch off the services nothing in the house uses
Behind the status page, the network or security tab lists protocols. A home setup needs far fewer than the factory enables.
- Raw printing, port 9100. Accepts jobs from anyone who can reach the address, with no authentication. Keep it only if a specific desktop app depends on it.
- IPP, port 631. The standard AirPrint and most phone printing rely on, specified in RFC 8011. Keep this one; it is the protocol you actually use.
- WSD and SLP discovery. Helpful on a Windows workgroup, noisy otherwise. Turn off unless Windows cannot find the printer without them.
- Cloud print. HP ePrint, Epson Connect, Brother WebConnect and Canon PRINT Business each hold an inbound path through the vendor. Print only from home and these can go.
- Scan-to-email and FTP. Left at defaults, they act as an open relay on your LAN. Disable, or point them at a mailbox with its own password.
Firmware, and the vendor account behind it
Printers run embedded Linux and have shipped with serious remote-code flaws. Check the installed version under Firmware or Device Information, compare it against the support page for the exact model number, and enable automatic updates where offered. A unit whose newest firmware is dated 2018 and has no update path belongs on an isolated network, not on the one holding your laptop.
Then look at the account. HP Smart, Epson Smart Panel and Brother Mobile Connect all want an email login, and that login can usually queue jobs to the printer from anywhere in the world. If you enabled remote printing once for a holiday and forgot, revoke the sessions and disable the feature now.
Put the printer on its own network segment
The clean fix is a second SSID or VLAN holding the printer and nothing else, with a firewall rule that permits only IPP and raw printing from the main network. On a consumer router the guest network does this in one click, but leave client isolation off or your phone will not see the printer either, and AirPrint discovery depends on multicast that most guest networks drop.
If the printer is only reachable half the time, fix that before segmenting anything — the wireless printer offline checks cover the usual causes, most of which are DHCP leases or a 2.4 GHz-only radio. Printing from a phone is also the main reason people leave cloud services switched on; phone printing over IPP works without the vendor cloud, and it keeps working when the vendor changes its terms.
A simpler compromise that runs on almost any router: reserve a fixed address for the printer in DHCP, then add a firewall rule blocking that address from reaching the internet while leaving local printing untouched. You lose cloud print and automatic firmware updates, so schedule those by hand twice a year.
Signs the printer is already in use by someone else
Open the job log and read it. Unknown jobs, pages printed overnight, a scan-to-email entry you did not create, or toner ordered to an address that is not yours all suggest somebody else has the admin password. Check the DNS setting too: a swapped DNS server is how a compromised printer receives instructions. Factory reset, new admin password, current firmware, cloud services off — in that order.
While you are in the settings, look at the ink or toner profile: the same page that shows usage often holds a “shop for supplies” link that quietly sends you to a reseller. Cutting printer ink costs is easier once you know the driver is not overriding your draft settings.
A printer that accepts jobs only from the three devices you actually print from, on a segment with no route to your laptop’s files, is dull in exactly the way a networked appliance should be.