A step-by-step guide to locking down your home router: admin password, Wi-Fi encryption, firmware updates, WPS, remote management, guest networks and what to do when it's out of support.
Your router is the front door to everything connected in your home: phones, laptops, smart TVs, cameras and speakers. If it is poorly secured, attackers could intercept traffic, use your connection for crime, or reach your devices. Most of the protection comes from a handful of settings you can change in 20 minutes.
How do you get into your router's settings?
Most routers have a web page you reach by typing an address such as 192.168.1.1 or 192.168.0.1 into a browser on a device connected to it, or through the provider's app. The address and login details are often on a sticker on the router or in its manual.
Step 1: Change the admin password
The admin password controls the router's settings and is different from your Wi-Fi password. Many newer routers come with a unique password printed on the label rather than a shared default (UK law has banned universal default passwords on new connectable products since April 2024), but change it to a strong, unique password of your own and store it in a password manager.
Step 2: Use strong Wi-Fi encryption and password
- Choose WPA3 if all your devices support it, or WPA2/WPA3 mixed mode. Avoid WEP and WPA, which are outdated.
- Set a long Wi-Fi password: three random words together is a good, memorable approach recommended by the NCSC.
- Change the network name (SSID) if it reveals your name, address or router model.
Step 3: Keep the firmware updated
Firmware updates fix security holes. Many provider routers update automatically; check the settings for an automatic update option, or check for updates manually every few months.
Step 4: Turn off features you don't need
- WPS (Wi-Fi Protected Setup): the push-button or PIN feature for connecting devices. The PIN method has known weaknesses; turn WPS off if you don't use it.
- Remote management: lets the router be managed from the internet. Turn it off unless you need it.
- UPnP (Universal Plug and Play): lets devices open ports automatically, which some games and apps use. It is convenient but can be abused by malware. Consider turning it off and see whether anything breaks.
Step 5: Use a guest network
A guest network keeps visitors' devices, and ideally your smart home gadgets, separate from your main computers and phones. If a smart plug or camera is compromised, it is then harder for an attacker to reach your other devices.
Step 6: Check connected devices
Look at the list of connected devices in the router's settings. If you see devices you don't recognise, change the Wi-Fi password, which disconnects everything, and reconnect your own devices.
Step 7: Know when to replace it
If the manufacturer or provider no longer issues firmware updates, the router may have unfixed vulnerabilities. Check the support period, and ask your provider for a replacement if theirs is old. Under the UK product security regime, manufacturers must state how long security updates will be provided for new connectable products.
A quick checklist
- Strong, unique admin password.
- WPA2 or WPA3 with a long Wi-Fi password.
- Automatic firmware updates on.
- WPS and remote management off.
- Guest network for visitors and smart devices.
- Review connected devices every few months.
Frequently asked questions
Does hiding my network name make it more secure?
Not really. Hidden networks can still be found, and hiding them can cause connection problems. Strong encryption and passwords matter more.
What about my smart TV and other devices?
Keep their software updated, remove apps you don't use, and put them on a guest network if your router supports it.
Should I use my provider's router or buy my own?
Provider routers are often updated automatically. If you buy your own, choose a model with a clear update policy and set it up carefully.
Sources and further reading
- NCSC: Using passwords to protect your data (three random words)
- NCSC: Smart devices in the home
- GOV.UK: The UK PSTI product security regime
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.