The box supplied by your internet provider works as soon as it is plugged in, with its factory settings. Those default settings are exactly what intruders try first. Half an hour is enough to close the most common doors. Here are the settings to check, in order, on any box or Wi-Fi router.
1. Open the admin page
All settings are made from a web page inside the box. Its address is printed on the label under the device, usually 192.168.1.1 or 192.168.0.1, along with the admin username and password. Open it from a computer or phone connected to that network.
2. Change the admin password
The factory password (often admin, or the one on the label) is the first one tried. Replacing it with your own, different from the Wi-Fi password, stops anyone already connected from changing every setting.
3. Pick the right encryption: WPA2 or WPA3
In the wireless security section, the mode should be WPA2-PSK (AES), or WPA3 if the box offers it. Mixed WPA2/WPA3 keeps older devices working. WEP and WPA with TKIP are outdated and break in minutes: if they are on, that is the first thing to change.
4. A long Wi-Fi password
Length matters more than complexity. A phrase of four or five unrelated words, at least 12 characters long, is both strong and easy to read out to guests. Avoid the family name, phone number and birth date. After the change, every device has to reconnect with the new password.
5. Turn off WPS
WPS connects a device with a button or an 8-digit PIN. The PIN mode is known to be weak. If nobody at home uses the WPS button, turn it off in the wireless settings.
6. Update the firmware
The box’s internal software receives security fixes. The admin page shows the installed version and often offers automatic updates. On a router bought separately, check the maker’s website two or three times a year.
7. A guest network for visitors and smart devices
A guest network gives internet access without access to the other devices at home. Put visitors there, and also connected bulbs, plugs and cameras, which are rarely updated. If a Wi-Fi camera is hacked, it cannot see the computer holding your documents.
8. Switch off remote management
Remote management lets you configure the box from the internet. Unless you need it, keep it off: the settings page is then only reachable from home.
9. Check who is connected
The box lists connected devices, often by name. An unknown device that keeps coming back is a good sign the password has spread. In that case, change the Wi-Fi password: every device is disconnected and only those given the new password come back.
What does not really protect you
- Hiding the network name (SSID). The network stays visible to any scanning tool, and your own devices have a harder time reconnecting.
- MAC address filtering. A MAC address is easy to copy. The filter mostly gets in the way when you change phones.
And if the Wi-Fi is weak?
Security and range are two separate things. If the signal does not reach the bedrooms, a Wi-Fi extender or a powerline kit fixes the range, and these devices are set up with the same WPA2 or WPA3 encryption. The guide weak Wi-Fi: extender, powerline or router helps choose.
