Router Security Settings to Change on a New Router

A design flaw in the WPS PIN method cuts the attempts needed to brute force it to 11,000 in total, according to a CERT/CC vulnerability note. Worse, many wireless routers do not implement any kind of lockout policy for brute force attempts. That one switch shows why the router security settings you change on day one matter as much as the hardware.

Passwords are not the whole story either. The FBI warns that TheMoon does not require a password to infect routers, and that routers dated 2010 or earlier likely no longer receive software updates issued by the manufacturer. The steps below run in roughly the order CISA lists them, from the admin password to UPnP, then close with a check on whether the router is worth securing at all.

Key Takeaways

• CERT/CC found that the WPS PIN design flaw brings brute-force attempts down to 11,000 in total, so the PIN method belongs near the top of the list.
• CISA asks for a Wi-Fi passphrase of 5 to 7 unrelated words totaling at least 16 characters.
• The NSA wants a strong passphrase with a minimum length of 20 characters on WPA3 or WPA2/3 networks.
• In its router precautions, the FBI says passwords should contain at least 16 but no more than 64 characters.
• According to the FBI, routers dated 2010 or earlier likely no longer receive software updates.
• The UK’s consumer connectable product security regime came into effect on 29 April 2024 and bans universal default and easily guessable passwords.
• eero promises guaranteed software security updates until at least 5 years from when you bought them new on eero.com or Amazon.com.

Before You Start: Log In to Your Router’s Admin Page

The NSA’s “Best Practices for Securing Your Home Network” Cybersecurity Information Sheet, released Feb. 22, 2023, is the starting point for this guide. It suggests that you consider using a personally owned routing device that connects to the ISP-provided modem/router for more administrative control. Every setting below lives in that router’s admin page.

The NSA wrote the guidance to help teleworkers protect their home networks from malicious cyber actors, a concern our remote work security data tracks across employers. Location matters too. CISA says to store your router in a secure physical location, because anyone with physical access to your router could perform a factory reset and use the default information displayed on the router to gain access to the network.

The checklist below sums up every change, with the agencies and makers that recommend each one. Use it as the order of work.

Source: CISA Project Upskill Module 5, NSA Best Practices for Securing Your Home Network (2023), FBI PSA I-050725-PSA (2025), NETGEAR

Start with the setting an attacker would try before any other.

Step 1: Change the Router Admin Password

The opening instruction in CISA’s Project Upskill home Wi-Fi checklist is to change your router login username and password, because your default router information may be publicly available for anyone to find. For length, the FBI’s router precautions say to use strong passwords that are unique and random and contain at least 16 but no more than 64 characters.

Keep the admin password apart from the Wi-Fi password. ASUS tells owners to use separate passwords for your WiFi network and router login, and its support FAQ asks for passwords with more than 10 characters mixed with capital letters, numbers, and special characters. The FBI also says to avoid reusing passwords and disable password hints.

• Open the administration or system section of the admin page and find the login or password setting.
• Change the username if the router allows it, then set a new random password.
• Store it in a password manager, since reuse is the habit our password and credential theft data keeps flagging.

Do I need to change my router password if it came with a unique one?

Yes. The UK rules that came into effect on 29 April 2024 ban universal default and easily guessable passwords. CISA created its December 15, 2023 Secure by Design alert to urge technology manufacturers to eliminate the risk of default password exploitation. A printed password is still readable by anyone holding the router.

A strong password does nothing for a known firmware hole.

Don’t chase tech news. We track it for you.

One weekly briefing with the launches, AI developments, and breaches that matter. No filler.

Email address

Subscribe Now

Read by pros at Fortinet, TSMC, Barclays, and Deloitte.

Step 2: Update Firmware and Turn On Automatic Updates

Start with the NSA’s patching rule: The routing devices on your home network should be updated to the latest patches, preferably through automatic updates, and should also be replaced when they reach end-of-life (EOL) for support. The FBI puts a date on that risk: Routers dated 2010 or earlier likely no longer receive software updates issued by the manufacturer.

CISA notes that firmware updates enhance product performance, fix flaws, and address security vulnerabilities, and that some routers have the option to turn on automatic updates. Maker settings differ:

• NETGEAR says you can allow your router to automatically update its firmware to the latest version, and also that you can also disable this feature, so confirm it is still on.
• ASUS routers can automatically install the latest firmware when auto upgrade is enabled, and owners can check for firmware updates through the ASUS Router app or Web GUI.
• Google says that for Nest Wifi Pro, Nest Wifi, and Google Wifi devices, software updates occur automatically when available, and software versions are rolled out over a number of days or weeks.
• eero offers guaranteed software security updates until at least 5 years from when you bought them new on eero.com or Amazon.com.

The support window is the setting most buyers never see, and it decides whether every other step keeps working. Under UK rules, makers now face a duty of publishing information on minimum security update periods, so check that figure before you buy or keep an older unit.

How often should I update router firmware?

Install updates as soon as the maker ships them, which is why automatic updates matter. The NSA prefers patching preferably through automatic updates. Where a router lacks that option, CISA says to check your router manufacturer’s website to ensure you are running the latest firmware version, and the FBI says to immediately apply any available security patches and/or firmware updates.

Patched firmware still broadcasts whatever encryption you left on.

Step 3: Set Wi-Fi Encryption to WPA3 or WPA2-AES

CISA says to check to make sure your router uses WPA3 Personal or WPA2 AES encryption, calling them the only two forms of encryption that are considered safe and secure. If a router uses an older generation of encryption such as WEP, WPA, or WPA2 Temporary Key Integrity Protocol (TKIP), CISA says you should contact the internet service provider (ISP) that provided your router to request an upgrade or consider purchasing a new router.

The NSA allows a mixed mode for older gadgets: If you have devices on your network that do not support WPA3, you can select WPA2/3 instead. It also says that when available, protected management frames should also be enabled for added security. ASUS takes the same line, stating that for most users, keeping WPA2-AES or WPA3 enabled is the safest default setting.

Change the Wi-Fi password in the same menu. CISA suggests a memorable passphrase using 5 to 7 unrelated words totaling at least 16 characters, and the NSA asks for a minimum length of 20 characters on WPA3 networks. Encryption is also the dividing line between a home network and the risks of open public Wi-Fi.

Is WPA3 better than WPA2?

Yes, against password guessing. The Wi-Fi Alliance says users of WPA3-Personal receive increased protections from password guessing attempts, and that all WPA3 networks use the latest security methods, disallow outdated legacy protocols, and require use of Protected Management Frames (PMF). Wi-Fi Alliance introduced Wi-Fi CERTIFIED WPA3 on June 25, 2018, and WPA2 devices will continue to interoperate and provide recognized security.

Encryption protects the airwaves, and two convenience features open side doors.

Step 4: Turn Off the WPS PIN and Remote Management

CERT/CC says the WPS PIN design lets an attacker determine if the first half of the PIN is correct. Together with the PIN’s final checksum digit, that flaw cuts brute-force guessing to 11,000 attempts in total. CISA’s checklist answer is blunt: Disable Wi-Fi Protected Setup (WPS).

The stakes are listed in the same note. An attacker within range of the wireless access point may be able to brute force the WPS PIN and retrieve the password for the wireless network, change the configuration of the access point, or cause a denial of service, and the flaw carries a CVSS Base score of 9.3. CERT/CC first published the note on December 27, 2011, and the PIN design it describes is part of the WPS specification itself.

NETGEAR narrows the advice. It says only the WPS PIN connection method is vulnerable to brute force attacks; its routers protect themselves after several failed attempts to authenticate by entering a temporary lockdown state, and NETGEAR recommends disabling this function. You can still use the WPS push button method to connect to your wireless network.

Remote management is the other side door. CISA explains that this setting allows you to log in to your router over the internet to make changes, and the NSA’s rule is to only make network configuration changes from within your internal network. In its router alert, the FBI found that some routers at end of life, with remote administration turned on, were identified as compromised by a new variant of TheMoon malware.

In TP-Link’s FAQ, the setting sits under Security->Remote Management, and with the default setting (Port 80 and IP address 0.0.0.0), the Remote Management function is disabled. Anyone who needs to reach home devices while away is better served by a VPN tunnel back into the network than by an open admin page.

Should I turn off WPS on my router?

Yes, at least the PIN method. CISA says many routers lack a proper lockout policy after a certain number of failed attempts to guess the PIN, and the flaw informs them when the first half of the eight-digit PIN is correct. NETGEAR, whose routers lock out repeat guesses, still recommends disabling this function and keeps the push button available.

The next setting takes a judgment call.

Step 5: Decide on UPnP and Set Up a Guest Network

CISA warns that threat actors can use UPnP to spread malware to devices in your network and control them remotely, so it tells owners to disable it. It allows one exception: In some cases, you may need to enable UPnP to initially add your device to the network, but you should disable UPnP after doing so.

UK government security guidance explains the mechanism. UPnP allows an internal device to automatically open ports on the router without administrator intervention, and UPnP is normally only required in consumer environments for things such as game consoles. CISA adds that malware within your network can use UPnP to bypass your router’s firewall.

Next, switch on the guest network. CISA’s guest Wi-Fi instructions include these steps:

• If your router has a “Guest” Wi-Fi option, you should enable it.
• Protect it with a separate password that is long, random, and unique.
• Connect any smart home and other IOT devices to your Guest Wi-Fi if internet access is the only thing they require.

That device list tends to grow, as our connected device and IoT growth data tracks.

NSA guidance goes further: At a minimum, your wireless network should be segmented between your primary Wi-Fi, guest Wi-Fi, and IoT network. In the NSA’s words, this segmentation keeps less secure devices from directly communicating with your more secure devices, which matters more as smart home adoption spreads.

Should I turn off UPnP?

Yes, unless a specific device needs it. CISA says to disable UPnP unless you have a specific need for it, and the NSA lists Disable Universal Plug-and-Play (UPnP) beside turning off remote administration. If a games console needs open ports, UK guidance says it is recommended to configure this manually rather than relying on UPnP.

The agencies agree on the list. They disagree on the numbers.

Router Security Settings Compared: NSA, CISA, FBI and Makers

For a WPA3 passphrase, the NSA sets a minimum length of 20 characters, while CISA asks for 5 to 7 unrelated words totaling at least 16 characters for the Wi-Fi password. The FBI wants passwords that contain at least 16 but no more than 64 characters, and ASUS asks for more than 10 characters.

The figures govern different passwords. The NSA and CISA numbers apply to the Wi-Fi passphrase, while the FBI range sits in its router precautions without naming which password it covers. A Wi-Fi passphrase that meets the NSA length meets the longest length rule of the four. CISA’s word count and ASUS’s character mix are separate tests.

Source: CISA Project Upskill Module 5, NSA Best Practices for Securing Your Home Network (2023), FBI PSA I-050725-PSA (2025)

All three agencies agree on remote administration and split on length. The chart below isolates the minimum length each agency sets, from CISA’s at least 16 characters to the NSA’s minimum length of 20 characters.

The NSA adds one more habit to its list: At a minimum, you should schedule weekly reboots of your routing device, smartphones, and computers, because malicious implants have been reported to infect home routers without persistence.

None of these numbers help a router the maker has stopped patching.

When to Replace Your Router Instead of Changing Settings

The FBI’s public service announcement on end of life routers says routers dated 2010 or earlier likely no longer receive software updates issued by the manufacturer and could be compromised by cyber actors exploiting known vulnerabilities. Its advice is direct: If the router is at end of life, replace the device with an updated model if possible.

Watch for the warning signs the FBI lists:

• Commonly identified signs of malware infections on routers include overheating devices, problems with connectivity, and changes to settings the administrator does not recognize.
• If you believe there is suspicious activity on any device, apply any necessary security and firmware updates, change your password, and reboot the router.

Botnets built from unpatched routers are one strand of the wider cyber threat landscape we track.

A working router is not the same as a supported one. eero states that when software security updates end, your eero device will still work and can still provide wifi, and the NSA ties replacement to support: Devices should also be replaced when they reach end-of-life (EOL) for support. The dates below trace how router guidance has tightened.

How do I know if my router is too old to secure?

Check the label date, the maker’s support period, and the encryption menu. The FBI flags routers dated 2010 or earlier, UK rules require publishing information on minimum security update periods, and CISA says a router stuck on WEP, WPA, or WPA2 Temporary Key Integrity Protocol (TKIP) needs an upgrade or replacement.

Should you hide your Wi-Fi network name?

The NSA advises against it: Do not hide the SSID, as this adds no additional security to the wireless network and may cause compatibility issues. Instead, change the default service set identifier (SSID) to something unique, a step CISA’s checklist repeats: Change the name of your Wi-Fi network.

Conclusion

The WPS PIN flaw that cuts brute-force attempts to 11,000 attempts in total sums up the problem with factory defaults: Convenience settings may ship switched on, so the owner has to check each one. The order is short: Change the admin password, turn on automatic firmware updates, set WPA3 or WPA2-AES, switch off the WPS PIN and remote management, then turn off UPnP and move guests and smart devices to their own network.

Anyone setting up a new or ISP-supplied router can work through these router security settings in one sitting. The step that keeps paying off is the yearly check that the maker still ships updates, because settings cannot fix a router that no longer gets patches.