Router Security Setup Checklist for 2026

You just unboxed a new router, or you read another headline about a botnet built entirely out of home routers, and it hit you: you have never once opened your router's admin panel since the day your ISP technician left. Neither had I, for the first two years I had mine.

Why your router is the one device nobody audits

Every other device on your network gets some attention. You patch your laptop, you update your phone, you might even run antivirus. The router sits in the corner, blinking, doing the one job that matters most — deciding what gets in and out of your home network — and almost nobody ever logs into it after setup day.

That's exactly why it's the target. A compromised router doesn't need to break into your laptop; it just sits between your laptop and the internet and reads or redirects everything that passes through. It's the highest-leverage device in your home, and the least-audited.

I run a Proxmox homelab at home, which means I actually have to think about what's exposed to the internet — not in theory, but because a misconfigured router setting can expose a service I never meant to publish. What follows is the exact walkthrough I did on my own router (a FRITZ!Box 7590, common in German households), screen by screen, with the reasoning for each change — not just a list of settings to flip.

Step 1: Change the default admin credentials

This is the step every checklist puts first, and it earns the spot. Routers ship with a factory admin login — often literally admin / admin or admin / password — and internet-wide scanners test exactly those combinations against every IP address, continuously, whether or not you've ever been individually targeted.

When I installed my current router, this was the first screen: System → FRITZ!Box Users → your username. I set a unique password of at least 16 characters, generated by a password manager rather than typed from memory — the admin panel is not somewhere you log into often enough to justify a memorable-but-weak password.

Step 2: Update the firmware — then make sure it keeps happening

Outdated firmware is one of the most exploited weaknesses in home routers, precisely because most people update it once, on setup day, and never again. Manufacturers patch real vulnerabilities on a regular cadence; those patches are useless if they sit undownloaded for two years.

On my router, this lives at System → Update → FRITZ!OS. Most consumer routers have an equivalent screen, and most also have an "automatic update" toggle — turn it on. If yours doesn't support automatic updates, the fix isn't a one-time visit to this article; it's a recurring calendar reminder, because a router that never gets checked again is functionally the same as a router that never gets updated at all.

Step 3: Switch to WPA3 — or WPA2-AES if your router doesn't support it

Wireless encryption is where the biggest jumps in real-world security have happened over the last decade, and it's also where the most outdated advice still circulates.

Standard	Status	Real-world exposure
WPA2-TKIP	Deprecated	Known cryptographic weaknesses; crackable with commodity tools
WPA2-AES (CCMP)	Acceptable	No practical break; still the fallback if WPA3 isn't available
WPA3	Recommended	Individualized encryption per session (SAE), resistant to offline dictionary attacks

If your router and every device you own supports WPA3, use it — it's on the wireless security screen, usually labeled WLAN → Security or similar. If even one older device on your network only speaks WPA2, most routers offer a WPA2/WPA3 transitional mode rather than forcing you to choose. Never select WPA2-TKIP or an "open" option out of convenience.

Step 4: Turn off WPS and UPnP

These two features exist purely for convenience, and both expand what an attacker on your network — or within radio range — can do.

WPS (Wi-Fi Protected Setup) lets you connect a device by pressing a button or entering an 8-digit PIN instead of your full Wi-Fi password. The problem is that the PIN is verified in two halves, which cuts the effective search space enough that it can be brute-forced in a matter of hours on cheap hardware — regardless of how strong your actual Wi-Fi password is.

UPnP (Universal Plug and Play) lets devices on your network open ports on your router automatically, without asking you. It's convenient for game consoles and some smart-home hubs. It's also how malware on a compromised device can quietly punch a hole through your firewall without you ever seeing a prompt.

Step 5: Turn off remote administration from the WAN side

Some routers let you log into the admin panel from outside your home network — useful if you manage a relative's router remotely, useless and risky for almost everyone else. An admin panel reachable from the internet is a target for automated scanners the moment it's turned on, independent of whether you've changed the default password.

Check Internet → Permit Access (or your router's equivalent) and confirm remote/WAN-side administration is off unless you have a specific, ongoing reason to need it.

Step 6: Put IoT devices on a separate network

Your laptop and your smart plug do not need to be able to see each other. Most consumer IoT devices — cameras, plugs, the TV, the robot vacuum — have a worse security track record than your primary devices, and once one is compromised, being on the same network as everything else means it can probe your laptop, your NAS, and your homelab directly.

The fix is network segmentation: a guest network for untrusted devices, or a proper VLAN split if your router and switches support it. On my setup, that split looks like this:

VLAN 1 (Trusted):    laptop, phone, homelab management interface
VLAN 2 (Guest/IoT):  smart TV, smart plugs, robot vacuum, any device
                      you didn't personally configure the firmware on

Most consumer routers expose a basic version of this as a "guest network" toggle — turn it on, put anything you don't fully trust onto it, and keep it separate from the network your laptop uses for WireGuard back into your homelab.

Step 7: Rename the SSID — without identifying yourself

Once the settings above are handled, renaming your Wi-Fi network is a minor step, but it's free. Avoid names that include your last name, apartment number, or the router's brand and model — the model name in particular can tell an attacker exactly which known vulnerabilities to try.

The setting most checklists skip: verify what your DNS is actually doing

Most router-hardening checklists stop at the settings above. One thing they consistently miss: what your router does with DNS by default. Unless you've changed it, every device on your network is sending every domain you visit — in plaintext, by default — to whatever DNS resolver your ISP assigned. Encrypted DNS changes what that traffic exposes to anyone positioned between you and the resolver, including on public Wi-Fi later. It's a five-minute change on the router's WAN/DNS settings screen, and it's the one this checklist would be incomplete without mentioning.

Router hardening checklist (copy this)

1. Change the default admin username/password.
2. Update firmware; enable automatic updates if available.
3. Set wireless security to WPA3 (or WPA2-AES if WPA3 isn't supported).
4. Disable WPS.
5. Disable UPnP.
6. Disable remote/WAN-side admin access.
7. Move IoT devices to a guest network or VLAN.
8. Rename the SSID to something non-identifying.
9. Set your DNS resolver to an encrypted option instead of your ISP's default.

The whole process takes 20–30 minutes on most consumer routers, and it puts you meaningfully ahead of the majority of home networks that have never had a single setting touched since installation.

Frequently asked questions

Is it really necessary to change the default router password?

Yes — it's the single most important step on this list. Automated internet scanners test default admin credentials against every reachable IP address continuously, not just against routers someone has specifically targeted.

Do I need WPA3, or is WPA2 still fine?

WPA2-AES (not TKIP) is still acceptable if your hardware doesn't support WPA3. WPA3 is the better choice when available because it resists offline dictionary attacks in a way WPA2 doesn't, but a strong WPA2-AES password is far better than an unpatched WPA3 setup with weak credentials elsewhere.

Should I disable UPnP on my router?

For most home users, yes. UPnP lets any device on your network open ports automatically, which is convenient for some game consoles but also gives malware on a compromised device a way to punch through your firewall without your knowledge.

How often should I check for router firmware updates?

Enable automatic updates if your router supports them. If it doesn't, set a recurring reminder — every few months at minimum — since most routers are never checked again after initial setup.