Home network

Check that your router still gets updates

Your router is the box that brings the internet into your home. Look up its model on the maker's website. If the maker no longer updates it, replace it.

Replace a router that no longer gets updates

When a manufacturer stops supporting a router, it stops fixing security flaws in it. The FBI has warned that criminals take over these end-of-life routers and use them to hide their own activity.

• Look up your model on the manufacturer's website to see whether it still receives firmware updates.
• The FBI notes that routers from 2010 or earlier likely no longer get updates.
• If yours is end-of-life, replace it with a current model.

Change the admin password and keep firmware current

The router's admin password controls all of its settings. The default one is often printed on the router or published online.

• Change the default admin username and password to something long, random and unique, and save it in your password manager.
• Turn on automatic firmware updates if your router offers them. If it doesn't, check the manufacturer's site for updates every few months.
• Keep the router somewhere private. Anyone who can reach it can reset it and use the default details on its label.

Use WPA3, or WPA2 with AES, and a long passphrase

Encryption keeps people nearby from reading your traffic or joining your network.

• In the router's wireless settings, choose WPA3 Personal. If some of your devices can't connect, use WPA2 with AES.
• Avoid the older WEP, WPA and WPA2 TKIP options. If your router offers nothing newer, ask your internet provider for an upgrade or replace it.
• For the Wi-Fi password, CISA suggests five to seven unrelated words, at least 16 characters in all.

Turn off WPS, UPnP and remote management

These features make setup easier but give attackers more ways in. Turn them off unless you have a specific need.

• WPS lets devices join with a button or a short PIN instead of your Wi-Fi password.
• UPnP lets devices on your network open connections to the internet on their own. If a device needs it during setup, turn it back off afterward.
• Remote management lets the router's settings be reached over the internet, not just from inside your home.

Give visitors a guest network

Most routers can run a second Wi-Fi network for visitors. Give guests that one instead of your main Wi-Fi password.

Give visitors a guest network

Most routers can run a separate guest network with its own password. Visitors get internet access without your main password. If a guest's phone carries malware, it is less likely to reach the devices on your main network.

Put smart-home devices on their own network

Cameras, doorbells, TVs, speakers and other smart devices usually only need internet access. On a guest or separate network, they are kept away from your computers and the router's settings.

• If your router supports more than one guest network, use one for visitors and another for smart devices.
• If it supports only one, put smart devices there and keep computers and phones on the main network.

Check what is connected

Your router's app or admin page lists the devices currently on your network.

• Look through the list now and then. Rename devices you recognize so a new one stands out.
• If you find one you can't identify, check it isn't one of your own devices, then block it and change your Wi-Fi password.
• Disconnect old devices you no longer use. Their security may be out of date.

Cameras, doorbells and smart TVs

Treat each smart device as a small computer that needs the same care.

• Change any default username and password, and don't reuse a password from another account.
• Install firmware updates, and keep the device's phone app updated.
• Turn on two-factor sign-in for the device's cloud account, if offered.
• Turn off features you don't use, such as remote access. On a smart TV, review the tracking settings and remove apps you don't use.

Keep a backup that isn't always plugged in

Ransomware often looks for backups it can reach and deletes or encrypts them too. CISA recommends offline, encrypted backups that you test.

• Copy important files to an external drive, then unplug it and store it safely.
• Encrypt the drive if you can, and try restoring a file now and then to confirm the backup works.
• A cloud backup in a separate account is a good second copy.

Know the signs

The FBI lists warning signs of a taken-over router:

• the router overheats;
• your connection has problems for no clear reason;
• settings have changed that you don't recognize.

Reset, update and change passwords

Work through these steps in order, ideally before the router goes back on the internet:

• Before you start, write down any sign-in details your internet provider gave you, download the latest firmware on another device, and pick a time when going offline for a while is OK. If you aren't sure, call your internet provider or the router maker first.
• Do a factory reset. A reboot alone may not clear the problem.
• Install the latest firmware.
• Set a new admin password right away. A reset brings back the default one.
• Set a new Wi-Fi passphrase, then turn WPS, UPnP and remote management back off.
• If the router is end-of-life, replace it instead. Updates won't fix it.

Then check your accounts

Change passwords on your email and financial accounts from a device you trust, and review their recent sign-in activity. If money or personal information was taken, report it.