Settings 1 and 2: Admin Login and Automatic Firmware Updates
Open a browser and enter 192.168.1.1 or 192.168.0.1, or the address printed on the label under your router. Menu names vary by brand, so the paths below are the usual ones rather than guarantees.
1. Admin credentials. Go to Administration, System or Advanced, then Administration, and change the router password. This is not your Wi-Fi password. It unlocks the settings page. Choose something long and unique, store it in a password manager, and change the username too if allowed. The risk you close: a factory login like admin/admin lets anything on your network, including an infected laptop or cheap smart plug, change your DNS and send you to fake bank pages.
2. Automatic firmware updates. Look under Administration, Firmware Update or Advanced, Firmware. Switch on automatic updates and pick an overnight window, since the router reboots and your connection drops for a few minutes. Updates close security holes that are already published, which is what attackers scan for. If there is no automatic option, check manually each month. If the manufacturer no longer issues updates for your model, plan to replace it.
Settings 3 and 6: Wi-Fi Encryption and a Separate Guest Network
3. WPA3. Open Wireless, then Security. Choose WPA3-Personal. If an older printer or plug then refuses to join, use the WPA2/WPA3 mixed mode, and never choose WPA, TKIP or an open network. The risk you close: someone capturing your Wi-Fi handshake and guessing the passphrase offline. WPA3 makes that much harder, but a short passphrase still undermines it, so use four or five random words.
6. Guest SSID for visitors and IoT. Under Wireless, then Guest Network, enable a second network with its own passphrase and turn on client isolation if offered. Put visitors on it, and also your smart TV, cameras, bulbs and plugs. The risk you close: a gadget that never gets patched can no longer reach your laptop or shared folders. The trade-off is that phone-to-TV casting often fails across networks, so keep a TV on the main network if you cast. Our guide to setting up a guest Wi-Fi network at home shows the screens, and the router checklist for guest Wi-Fi covers prep before visitors arrive.
Settings 4 and 5: Shut Remote Administration and UPnP
4. Remote administration off. Look for Administration, Remote Management, or a line such as Web Access from WAN, and disable it. With it on, your login page is reachable from the internet and gets automated password guesses. If you need to reach home while away, use the router’s built-in VPN server instead.
5. UPnP off. You will usually find it under Advanced, NAT Forwarding, UPnP. UPnP lets any program on your network ask the router to open a port to the internet without asking you. Before switching it off, read the list of active mappings if your router shows one, and investigate entries you do not recognize. Some consoles and video-call apps may then report a stricter connection type. If so, forward the single port that app documents rather than re-enabling UPnP for everything.
Settings 7 and 8: DNS Filtering and Log Review
7. DNS filtering. Open Internet, then DNS, or LAN, then DHCP Server, and replace your provider’s DNS servers with a filtering resolver. Quad9 uses 9.9.9.9 and 149.112.112.112, and Cloudflare’s malware-blocking option uses 1.1.1.2 and 1.0.0.2. The risk you close: devices looking up addresses already known to host malware or phishing pages. The limit is simple: it only blocks reported domains, so it supports your judgment without replacing it. If your router will not let you change DNS, set it on each phone and computer.
8. Log review. Check Administration, System Log, or Advanced, Logs, and the connected-devices list. Look for repeated failed admin logins, devices you cannot name, and new devices at odd hours. Set a monthly calendar reminder. Many home routers keep logs only in memory and wipe them at reboot, so a clean log after a restart proves little.
Verify Your Changes Before You Log Out
Save each change, reboot once, then log back in with the new admin password to prove you recorded it correctly. Join the guest network from a phone and confirm you cannot reach your printer. Reconnect any device that dropped after the WPA3 switch. If you export a configuration backup, keep it private, since it can contain passwords. The UK National Cyber Security Centre’s tips for staying secure online cover updates and passwords for the devices behind the router.