Your Router Still Uses Its Default Password?

Your router came with a login set at the factory. If you never changed it, that login is still in place — and it is not a secret. Routers ship with default login information, and that information may be publicly available for anyone to find. The router may even carry a sticker with the default setting information on it.

That matters because the router login controls the router's settings. Anyone who can reach the admin page and sign in can change the settings. A default left in place hands that control to anyone who looks it up.

Four steps fix it. Open your router settings and work through them in order.

Step 1: Change the admin password

Change the admin password — the password for signing in to the router's settings — and make the new one long, random, and unique. CISA puts the rule in those three words. The NSA's matching principle: passwords should be strong, unique for each account, and difficult to guess.

Keep it different from your Wi-Fi password. The two are not the same login. They are distinct credentials: CISA lists changing your router login and changing your Wi-Fi password as separate steps, and lists using the same username and password for both among the things not to do.

If keeping track of separate, unique passwords is the hard part, see our briefing on password managers.

Step 2: Update the firmware, and replace an end-of-life router

Update the router's firmware — the software the router itself runs. Keep it updated, and turn on automatic updates if offered. Routine updates protect against known vulnerabilities. The NSA gives the same direction: routing devices should be updated to the latest patches, preferably through automatic updates.

Then check whether your router still receives updates. A router that no longer receives updates or support has reached end of life, and the NSA says these devices should be replaced at end-of-life for support, so they can continue to be updated and patched as vulnerabilities are discovered. A router that cannot be updated cannot be fixed by changing settings. Replace it.

See also our briefing on software updates.

Step 3: Use WPA3, or WPA2, with its own Wi-Fi password

Check your Wi-Fi encryption. Use WPA3 if your router offers it; if not, use WPA2. CISA's check is specific: the router should use WPA3 Personal or WPA2 AES, the only two forms of encryption it considers safe and secure. The NSA likewise directs owners to make sure their access point is capable of WPA3, with WPA2/3 as the fallback where some devices do not support WPA3, and a strong passphrase either way.

Give the Wi-Fi password the same treatment, but as its own password: long, unique, and not used for other accounts. That is CISA's rule for the Wi-Fi passphrase — the same unique-per-account principle from Step 1, applied to the second credential.

Step 4: Turn off remote management, and use the guest network

Turn off remote management. That setting allows you to log in to your router over the internet to make changes. CISA directs owners to disable it, because disabling it can prevent threat actors from making changes to your router without connecting to your network first. The NSA states the same rule as a limit: only make network configuration changes from within your internal network. The FTC's version is practical — if you will not use remote management, it is best to disable it.

Then use the guest network, if your router offers one. CISA directs owners who have a guest Wi-Fi option to enable it — for anyone who does not routinely connect to your home Wi-Fi, and for smart home and other internet-connected devices where internet access is the only thing they require. That prevents those devices from discovering other devices on your home network, accessing your router settings, and potentially introducing vulnerabilities. The NSA calls the same setup network separation: less secure devices kept from directly communicating with more secure ones.

For networks away from home, see public Wi-Fi.

How to stay safe

Run the four steps as a set: a new admin password — long, random, unique, and different from the Wi-Fi password; firmware updated, with automatic updates on if offered, and the router replaced if it no longer receives updates; WPA3 if offered, otherwise WPA2, with a long, unique Wi-Fi password used nowhere else; and remote management off, with visitors and smart-home devices on the guest network if one is offered.

These are settings you can open, check, and set today on the router you have — unless it has reached end of life, in which case replacing it is the step.

If yours is still the default

If you opened your settings while reading this and the admin password is still the default one, change it now. That is Step 1, and it comes first for a reason: the default information may be publicly available for anyone to find, and anyone who reaches the admin page and signs in can change your settings.

Make the replacement long, random, and unique, and different from your Wi-Fi password. Then finish the remaining steps in order — firmware, encryption, remote management and the guest network. This block covers only that case, and only those sourced steps.

Sources: NSA — Best Practices for Securing Your Home Network ↗ · CISA — Securing Your Home Wi-Fi (Project Upskill, Module 5) ↗ · FTC — Securing Your Internet-Connected Devices at Home ↗