You need the home router you want to secure, a device connected to it, and a web
browser. One step also uses a terminal command to find the router’s address;
that command is on Linux and macOS (ip route), with the Windows equivalent given
in the step. Nothing here costs anything or requires new software.
Have the router’s current login handy — usually on a sticker on the underside of the router — because step 2 is where you change it. The panel screens below differ in wording between brands (TP-Link, Asus, Netgear, your ISP’s box), so those steps describe what to look for rather than an exact button; only the terminal command’s output was captured on a real machine.
Why Router Security Matters
Your router is the gateway between your home network and the internet. If an attacker compromises your router, they can intercept all traffic, redirect you to malicious websites, or access devices on your network.
Most routers ship with weak default settings. A few minutes of configuration can dramatically improve your network security.
Accessing Your Router's Admin Panel
Most routers use one of these default addresses:
192.168.1.1192.168.0.110.0.0.1
Open a browser and type the address. You will be prompted for login credentials. Check the sticker on your router for the default username and password (commonly admin/admin or admin/password).
Default router credentials are publicly known. Anyone on your network (or who gains access) can take full control if you leave the defaults.
Essential Security Settings
Change the Admin Password
This is the single most important step. Navigate to Administration or System settings and set a strong, unique password for the router admin panel.
Update the Firmware
Router firmware updates fix security vulnerabilities. Check for updates in the Administration section. Many modern routers support automatic updates. Enable this if available.
Disable WPS (WiFi Protected Setup)
WPS allows connecting devices with a button press or PIN. The PIN method has a known vulnerability that allows attackers to brute-force the WiFi password in hours. Disable WPS entirely.
Disable Remote Management
Remote management allows accessing the admin panel from the internet. Unless you specifically need this (most people do not), disable it. It is a major attack surface.
WiFi Configuration
Change the Default SSID
The default network name (SSID) often reveals the router model, making it easier for attackers to find known vulnerabilities. Change it to something that does not identify you personally.
Use WPA3 or WPA2
Under wireless security settings:
Guest Network
Set up a guest network for visitors and IoT devices. This keeps them isolated from your main network where your personal computers and files live.
- Enable the guest network in your router's wireless settings
- Set a different password from your main network
- Disable "Allow guests to access local network" if the option exists
- Connect smart home devices (cameras, speakers, smart plugs) to the guest network
Now Do It Yourself: Lock Down Your Router in Five Steps
Your router is the front door to every device in your home, and it usually ships with that door unlocked. In five steps you will find its address, replace the password anyone can look up online, close the two settings attackers scan for, update its software, and confirm you did not lock yourself out. The one terminal command below was run on a real machine; the router-panel steps describe what every brand offers, under whatever name it uses.
Go: open a terminal (Linux/macOS) or Command Prompt (Windows) on a device connected to the router.
Do: run ip route on Linux/macOS, or
ipconfig on Windows and read the Default Gateway line.
ip route | grep defaultYou should see: a line naming the gateway — that address is your router:
default via 192.168.1.1 dev eth0 ...Here the router is 192.168.1.1. Common alternatives are
192.168.0.1 and 10.0.0.1; your interface name
(eth0, wlan0…) will differ and does not matter.
If not: if ip is missing on macOS, use
route -n get default and read gateway:. On Windows,
ipconfig lists Default Gateway under your active adapter. If the gateway
is blank, you are not connected to the router — join its network first.
Go: type the router address from step 1 into your browser’s
address bar (http://192.168.1.1) and log in with the current admin credentials
from the sticker.
Do: find Administration, System, or Management, and change the admin password to something long and unique — store it in your password manager. This is the router’s admin login, not the WiFi password; they are two different things.
You should see: the router confirm the change and usually log you out, forcing you to sign back in with the new password. That log-out is proof it took.
If not: if the sticker password is rejected, someone already changed it; a factory reset (hold the recessed Reset button ~10 seconds) restores the sticker login but wipes all settings, so only do that as a last resort. Default logins for most models are searchable online — which is exactly why leaving the default in place is dangerous.
Go: still in the admin panel, look under Administration, Advanced, or Security.
Do: switch off two things: Remote Management (or “Remote Access”/“WAN access”), which exposes the admin panel to the internet; and WPS, the push-button pairing whose PIN can be brute-forced.
You should see: both toggles now disabled. With remote management off, the login page you just secured can only be reached from inside your own network.
If not: if you cannot find Remote Management, it is often off by default on consumer routers — confirm rather than assume. If disabling WPS drops a device that paired through it, reconnect that device with the WiFi password instead; WPS is a convenience you are deliberately trading away for safety.
Go: find Firmware, Router Update, or System Update, usually under Administration or Advanced.
Do: click Check for updates and install any that are offered. Turn on automatic updates if the router supports it.
You should see: either “firmware is up to date” or a download → install → reboot cycle. The router will drop your connection for a minute or two while it restarts — that is normal; do not unplug it mid-update.
If not: if no update appears but the router is years old, check the manufacturer’s site for your exact model — a router no longer receiving security updates should be replaced, because unpatched router flaws are actively exploited.
Go: back to your terminal after the router finishes rebooting.
Do: reconnect to the network if needed, then re-run the step-1 command to confirm the router still answers at the same address.
ip route | grep defaultYou should see: the same default via 192.168.1.1 line, and
loading http://192.168.1.1 in the browser now demands your new admin
password. Both together mean the router is locked down and you still hold the key.
If not: if you cannot reach the panel at all, you may have disabled the wrong interface; a power-cycle of the router restores access without wiping settings. If the old password still works, the change in step 2 did not save — do it again and wait for the log-out.
Without scrolling up: a friend says their router is safe because the WiFi password is long. Name two things that are still wide open if that is all they changed. Answer: the admin panel may still use the default sticker password (anyone who guesses it can rewrite every setting), and remote management or WPS may still be on — remote management exposes that admin login to the whole internet, and WPS can be brute-forced regardless of how strong the WiFi password is. The WiFi password and the admin password are different locks.
Now do it without the page: on a phone or laptop, open your router’s admin panel and find its connected devices or DHCP client list. Identify every device on it by name. Anything you cannot account for is worth investigating — and is the subject of the WiFi tutorial’s device-monitoring step.
Summary
In this tutorial, you learned:
- Why router security is critical for your entire network
- How to access and secure the admin panel
- Essential settings: firmware updates, disable WPS and remote management
- WiFi security: WPA3/WPA2, SSID changes
- Using a guest network for isolation
Check back periodically for firmware updates and review connected devices to ensure nothing unauthorized has joined your network.