How to Secure Your Home Router (Most People Skip This)

The average home router sits untouched for years. Same firmware it shipped with. Same default password. Remote management left on. UPnP enabled. The admin interface accessible from the internet on port 8080. It's not that users are careless — it's that nobody tells them these things matter.

Change the Admin Password First

Router admin credentials default to 'admin/admin' or 'admin/password' for a substantial fraction of consumer routers. These defaults are public knowledge — Mirai, the botnet that took down large chunks of the internet in 2016, spread primarily by trying default credentials on internet-connected devices. Log into your router's admin interface (usually 192.168.1.1 or 192.168.0.1), find the admin password setting, and change it to something long and unique.

Disable Remote Management

Remote management lets you access your router's admin interface from outside your home network — over the internet. Most people don't need this. When it's enabled with a weak password, your router is accessible to anyone on the internet who finds it. Disable it unless you have a specific reason to keep it on. The setting is usually under Administration, Advanced, or Remote Access.

Update the Firmware

Router firmware contains bugs, and some of those bugs are security vulnerabilities. Manufacturers release firmware updates to patch them. Most home routers don't auto-update, which means the router you bought three years ago is probably running firmware with known, publicly disclosed vulnerabilities.

Check the manufacturer's website for your model. Log into the admin interface and look for a firmware update option — some routers check automatically. If your router is more than five or six years old and no longer receiving firmware updates from the manufacturer, that's a legitimate reason to replace it. An end-of-life router is a permanently vulnerable router.

Network Segmentation With Guest Wi-Fi

Most modern routers support guest networks — separate Wi-Fi SSIDs that are isolated from your main network. Put IoT devices on the guest network. Smart TVs, thermostats, security cameras, and cheap smart speakers frequently have unpatched firmware and weak security. Keeping them isolated means a compromised smart bulb can't reach your laptop or NAS.

Here's the thing — this one change probably reduces your actual home network risk more than anything else. IoT devices are the most common attack vector on home networks, and most of them don't need to communicate with your computers to do their job.

DNS Settings: Often Overlooked in Router Hardening

Most router hardening guides cover admin passwords, firmware, and UPnP. They miss the DNS settings. By default, your router forwards DNS queries to your ISP's resolver — which logs your queries, may inject ads into NXDOMAIN responses, and in some countries is required to block certain domains. Changing your router's upstream DNS to a privacy-respecting resolver (Cloudflare 1.1.1.1, NextDNS, or Quad9) takes about two minutes and applies to every device on your network.

NextDNS goes further — it lets you configure blocklists, log queries, set up parental controls, and see exactly what every device on your network is looking up. It's free for up to 300,000 queries per month. For a household with IoT devices making constant background DNS requests, seeing which domains those devices contact is genuinely revealing — and occasionally alarming.