The Security Appliance Running 24/7 That Nobody Configured
The router sitting in your home is one of the most security-consequential devices you own. Every piece of internet traffic entering or leaving your home passes through it. Every device on your home network — phones, laptops, smart TVs, IoT devices — is connected to it. A compromised router can redirect your traffic, intercept your communications, expose your devices, and serve as an entry point into your home network for attackers. Most residential routers leave their factory packaging with default credentials, default settings optimized for ease of setup rather than security, and rarely receive the firmware updates that fix known vulnerabilities.
The router security audit that most households have never done takes about 30 minutes and addresses the most significant vulnerabilities in most home network setups. None of the steps require technical expertise — they require logging into your router’s admin interface (the IP address, usually 192.168.1.1 or 192.168.0.1, is on a sticker on the router itself) and making a few configuration changes.
Default Credentials: The First Thing to Change
Many routers still ship with default admin credentials — ‘admin/admin’, ‘admin/password’, or similar — that are documented in publicly available manufacturer manuals. An attacker on your network (or in some cases, from the internet if remote management is enabled) can access your router’s admin interface using these credentials. Changing the admin username and password to something unique and strong is the first and most important configuration step.
While you’re in the admin interface, also check whether remote management is enabled — the ability to access the router’s admin interface from the internet. This feature is off by default on most modern routers but should be explicitly verified. Remote management enabled with default credentials is one of the ways home routers get compromised and enrolled into botnets.
Wi-Fi Security: WPA3, Hidden SSIDs, and Guest Networks
Wi-Fi encryption protects the traffic on your wireless network from eavesdropping by anyone within radio range. WPA2 remains acceptable; WPA3 (available on routers from approximately 2019 onward) is better. Check your router’s wireless settings and confirm WPA3 or at minimum WPA2 (not WEP, which is trivially broken, and not ‘open’ with no encryption). The password for your Wi-Fi network should be strong — at least 12 characters, not based on your address or other predictable information.
Guest network isolation is one of the most useful security features most routers offer: a separate Wi-Fi network for guests and IoT devices that can access the internet but can’t communicate with devices on your main network. IoT devices (smart lights, cameras, thermostats, appliances) have notoriously poor security track records. Putting them on an isolated guest network limits the damage a compromised IoT device can do — it can’t access your laptop or NAS, even if it’s been taken over.
Firmware Updates: The Maintenance Task Nobody Does
Router firmware updates patch known security vulnerabilities — the same way that phone and computer software updates do. Unlike phones and computers, most routers don’t automatically update their firmware, and most users never manually update it. A router running two-year-old firmware may have dozens of known unpatched vulnerabilities that are publicly documented and actively exploited.
Check your router’s firmware version against the manufacturer’s latest release. Most router admin interfaces have a firmware update section, or you can download firmware directly from the manufacturer’s support page for your specific model. Enable automatic updates if your router supports it. If your router is more than four to five years old and the manufacturer has stopped releasing firmware updates, replacing it is a reasonable security decision — you’re running hardware with no path to fixing future vulnerabilities.
DNS Settings and Network Monitoring
Your router’s DNS settings determine which server translates domain names (like ‘google.com’) into IP addresses for your devices. Your ISP’s default DNS server is functional but may log your browsing history and provides no filtering or security features. Changing to a privacy-focused DNS provider (Cloudflare’s 1.1.1.1, Quad9’s 9.9.9.9 which includes malware blocking, or NextDNS which is configurable) takes five minutes in the router’s network settings and provides both better privacy and, with providers like Quad9, some protection against known malicious domains.
Many modern routers include a connected devices list and basic network monitoring. Reviewing the devices connected to your network regularly — comparing against devices you actually own — is a simple way to catch unauthorized connections. A device you don’t recognize on your network is worth investigating. Some routers surface this in a mobile app; others require logging into the admin interface to see the device list.
