Home Router Security: What to Change and What to Check

How Home Routers Actually Get Taken Over

Attackers rarely need anything clever. The usual ways in:

• Unpatched firmware. The FBI says TheMoon malware “does not require a password to infect routers; it scans for open ports and sends a command to a vulnerable script.” A strong password won’t stop that, but an update can.
• An exposed admin page. Remote management left on, plus a default or weak admin password, puts your router’s controls within reach of the whole internet.
• The WPS PIN. A design flaw lets someone within radio range guess it far faster than its length suggests.
• Forgotten openings. Old port forwards and UPnP mappings keep exposing devices long after anyone needed them.
• Weak Wi-Fi encryption. WEP and TKIP make it easier for nearby people to get onto the network.

The FBI Warning About Worn-Out Routers

On May 7, 2025, the FBI’s Internet Crime Complaint Center published a public service announcement titled Cyber Criminal Proxy Services Exploiting End of Life Routers. It describes criminals infecting end-of-life routers (models the manufacturer no longer updates) with variants of TheMoon malware and installing proxies that hide their activity behind a victim’s connection.

Key points from the notice:

• Routers dated 2010 or earlier likely no longer receive the manufacturer’s software updates.
• Some compromised end-of-life routers had remote administration turned on.
• Signs of infection it lists include overheating, connection problems and settings changes the owner doesn’t recognize.

The FBI recommends replacing end-of-life routers where possible, applying available updates, disabling remote management (then saving and rebooting), and using unique, random passwords of 16 to 64 characters.

Is Your Model Still Getting Updates?

Start with the label. Note the model and any hardware version, because firmware built for version 13 of a router may not suit version 14. Then check:

1. 01
   Step 1: The maker’s official support page for that model. Look at recent firmware release dates and any end-of-life or end-of-support notice.
2. 02
   Step 2: The router’s own update page or app. Run a check and switch on automatic updates if offered. Apple’s router recommendations list automatic firmware updates as enabled.
3. 03
   Step 3: Your ISP, for rented gateways. Providers usually handle gateway firmware themselves, so ask whether your unit is still current.

Get firmware only from the manufacturer’s official site or the router’s built-in updater, never from third-party mirrors or modified files, and keep the power on until an update finishes. If the support page shows no updates for years or lists the model as end of life, plan a replacement.

A Scorecard Ranked by Effort and Payoff

These ratings are our editorial judgment, based on the attack routes above. Work from the top down.

If you host games or media, our port guide explains keeping forwarded ports to a minimum.

Admin Access: Remote Management and Default Logins

Two settings decide who can reach the router’s controls.

Remote management. Also called remote administration or web access from WAN, this lets the settings page be opened from outside your home. Turn it off, as the FBI advises. To manage the router while away, use the maker’s app with a strong account password, or a VPN into your home network.

The admin password. This protects the settings page. It isn’t your Wi-Fi password or your ISP account password. Rules such as California’s SB-327 and the UK’s PSTI regime pushed makers toward unique passwords printed on each label, but anyone who handles the router can read that label. To replace it:

1. 01
   Step 1: Sign in and open the account or password section, often under Administration, System Tools or Management.
2. 02
   Step 2: Enter the current password, then a new one of 16 to 64 random characters.
3. 03
   Step 3: Save, sign out and sign back in with the new password.
4. 04
   Step 4: Store it in a password manager.

Change the admin username too if the router allows it, and sign out when you’re done.

Wireless Encryption and the WPS Question

For Wi-Fi, use WPA3-Personal, or WPA2/WPA3 transitional mode if older devices need it. Fall back to WPA2 with AES only when the router offers nothing newer, and avoid WEP and TKIP entirely. The steps for switching encryption on the wireless page are in our Wi-Fi guide.

WPS (Wi-Fi Protected Setup) adds devices without typing the password, and its PIN method has a known design flaw. CERT/CC’s vulnerability note VU#723755 explains that the PIN is checked in two halves and its last digit is a checksum, so an attacker in radio range needs about 11,000 guesses rather than 10,000,000. The note adds that many routers lack a proper lockout after failed attempts.

What to do:

• Turn WPS off if you don’t use it.
• If your router can disable the PIN method on its own, do at least that.
• Push-button WPS needs someone at the router, which lowers the risk, but switch it off when you’re done.

UPnP: Handy for Games, Risky for Everything Else

Universal Plug and Play (UPnP) lets devices on your network ask the router to open ports for them. Consoles and some voice and media apps use it to connect smoothly, which is why routers often ship with it switched on.

The catch is that the router doesn’t check who is asking. Any program on the network can open a port the same way, including malware on a laptop or a poorly secured camera, and no password is involved.

Sensible choices:

• Nothing on your network needs it: turn UPnP off.
• A console depends on it: leave it on, and check the router’s UPnP or port-mapping table now and then for entries you don’t recognize.
• Only one device needs a fixed opening: turn UPnP off and create a manual forwarding rule for that device.

Guest Networks for Visitors and Smart Gadgets

A guest network is a second Wi-Fi network with its own name and password. With local network access switched off, it keeps a visitor’s phone or an insecure gadget away from your laptops, phones and shared files.

Setting one up well:

• Look for an option such as “allow guests to access the local network” and leave it off.
• Protect it with WPA3 or WPA2 and its own password. Don’t leave it open.
• Move smart plugs, cameras and other gadgets you don’t fully trust onto it, as long as they still work there.
• Change the guest password whenever past visitors’ access should end.

Expect some friction: casting to a TV or controlling a gadget from your phone can fail across the two networks. Some routers offer a dedicated IoT network that handles this better.

Reading the Connected-Devices List Without Panic

Routers list current devices under names like Attached Devices, Client List or DHCP Clients, and apps show the same list. It usually looks stranger than it is:

• Devices appear under a hostname, a manufacturer name or only a MAC address.
• Phones and computers often use private or randomized Wi-Fi addresses, so one phone can reappear as a new device after rejoining.
• Smart bulbs, plugs, printers and doorbells use names nobody would guess.

Count what you own, then match entries against each device’s Wi-Fi details (IP or MAC address), or switch devices off one at a time. Block anything you still can’t place, then change the Wi-Fi password.

Bigger warning signs point at the router itself: settings you didn’t change, unfamiliar DNS servers, new port forwards or an admin password that suddenly fails. The FBI’s advice is to apply updates, change passwords and reboot. If the signs persist, consider wiping a router you suspect is compromised and rebuilding it by hand, not from a backup.

Buying a Replacement: Support Windows and the FCC Covered List

Choose a successor on support as much as speed. Look for a maker that:

• Releases firmware regularly, with visible dates, and offers automatic updates
• Supports WPA3
• Lets you turn off remote management, WPS and UPnP

US buyers will also hear about the FCC Covered List. On March 23, 2026, the FCC added consumer-grade routers produced in foreign countries to that list, except those granted Conditional Approval by the Department of War or the Department of Homeland Security. According to the FCC’s fact sheet, the listing stops new models from receiving FCC equipment authorization. It doesn’t affect routers people already own, and it doesn’t stop the import, sale or use of models the FCC authorized before.

An FCC waiver also lets previously authorized routers keep receiving software and firmware updates that mitigate harm to consumers, and a May 8, 2026 notice (DA 26-454) extended it until at least January 1, 2029.

So there’s no need to replace a working, supported router over the listing. Conditional Approvals can change which new models reach shelves, so check current FCC notices if a specific model matters.

A Quarterly Five-Minute Router Checkup

Set a calendar reminder and run through this list every three months:

1. 01
   Step 1: Check for firmware updates and confirm automatic updates are still on.
2. 02
   Step 2: Confirm remote management and WPS are still off, since any reset returns them to factory defaults.
3. 03
   Step 3: Scan the connected-devices list for anything you can’t match.
4. 04
   Step 4: Review port forwards and UPnP mappings, and delete what you no longer use.
5. 05
   Step 5: Look up whether your model has been listed as end of life.