Every device in your home — laptops, phones, TVs, doorbells, the kids’ tablets — talks to the internet through one box: your router. That makes it the single most important piece of privacy and security hardware you own, and also the most neglected. Most routers ship with weak defaults, out-of-date software, and settings that quietly report back to the manufacturer or hand your browsing to your internet provider. Forty-five minutes of setup turns that front door from “wide open” into “locked and boring to attackers.” Here’s the practical checklist.

Get into your router

You configure a router through an admin page. Find your router’s address (commonly 192.168.1.1 or 192.168.0.1, printed on a sticker on the device) and open it in a browser, or use the manufacturer’s app. You’ll need the admin login — which brings us to the first and most important fix.

1. Change the two default passwords

Routers have two passwords people confuse:

  • The admin password that logs into the router’s settings.
  • The Wi-Fi password that devices use to join the network.

Change both away from the factory defaults. Factory admin passwords are published online for every model — leaving it default means anyone who gets on your network (or exploits a remote flaw) can take over the router entirely. Set a strong, unique password for each, and store them in your password manager.

2. Use strong Wi-Fi encryption

In the wireless settings, set security to WPA3 if your router and devices support it, or WPA2 (AES) if not. Avoid the older WEP and WPA/TKIP options entirely — they’re broken and trivially cracked. If you see a “WPS” push-button pairing feature, turn it off; it’s a long-standing weak point.

3. Update the firmware — and turn on auto-updates

Router software (firmware) gets security holes just like everything else, and an out-of-date router is one of the most commonly exploited devices in a home. In the admin page, check for a firmware update and install it. Then look for an automatic updates setting and enable it so you don’t have to remember. If your router is old enough that the manufacturer no longer ships updates, it’s time to replace it — an unpatched router is a genuine liability.

4. Stop your ISP from reading your browsing: encrypted DNS

By default, every website lookup your home makes (“where is example.com?”) goes to your internet provider in plain text, giving them a log of every site every device visits — which many ISPs monetize. Fix it with encrypted DNS:

  • The simplest approach is to set encrypted DNS on each device or browser (see browser hardening — DNS over HTTPS).
  • Better, set it router-wide so every device is covered, including the smart-home gadgets that can’t configure it themselves. In your router’s DNS settings, point it at a privacy-respecting resolver that supports DNS-over-TLS/HTTPS (Cloudflare’s 1.1.1.1, Quad9’s 9.9.9.9, and others publish setup instructions).

This doesn’t hide that you’re online from your ISP, but it stops them from building a page-by-page log of where you go.

5. Put untrusted gadgets on a guest network

Smart TVs, doorbells, plugs, and other “Internet of Things” devices are notorious for phoning home, weak security, and getting abandoned by their makers. You don’t want a compromised smart bulb sitting on the same network as your laptop and its files. The fix is network segmentation, and most modern routers make it a one-click affair:

  • Turn on the Guest network (or a dedicated IoT network if your router offers one) and put all your smart-home gadgets on it.
  • Enable client/AP isolation on that network so devices on it can’t see each other or reach your main network.
  • Bonus: give actual guests that same network, so a visitor’s possibly-infected phone never touches your primary devices.

Now if a cheap gadget gets compromised, the damage is contained to a network with nothing important on it.

6. Turn off the risky remote features

Poke through the admin settings and disable what you don’t use:

  • Remote administration / remote management — lets you configure the router from outside your home. Convenient, and a favorite target. Turn it off unless you genuinely need it.
  • UPnP — lets devices open ports automatically. Convenient for some games and apps, but it’s been abused; turn it off and only forward ports manually if something truly needs it.
  • Cloud account requirements — some routers push you to link a manufacturer cloud account that then sees your network activity. Use local admin instead where you can.

7. Rename your network (a small but real leak)

Your Wi-Fi network name (SSID) is broadcast to everyone nearby. Two quick tips:

  • Don’t put identifying info in it — not your name, apartment number, or “The Smith Family.” “Netgear-Guest-2G” is more private than “Apartment 4B Smith.”
  • Hiding the SSID entirely provides little real protection and can cause connection headaches, so it’s optional at best. Focus on the password and encryption instead.

Optional next steps for the keen

  • A VPN encrypts all your traffic to a provider you choose instead of your ISP — useful on untrusted networks and to keep your ISP from seeing traffic patterns. Choose a reputable no-logs provider; a VPN moves trust, it doesn’t eliminate it.
  • Router-level ad/tracker blocking (via something like a Pi-hole or a router with built-in filtering) blocks trackers for every device, including the ones you can’t install an extension on.
  • A travel router gives you your own trusted network on hotel and café Wi-Fi — see the gear page.

The bottom line

The essentials — change both passwords, use WPA3/WPA2, update firmware, turn on encrypted DNS, and segment your smart-home junk onto a guest network — take under an hour and shut down the ways a home network leaks and gets attacked. Do those five and you’re ahead of almost every household on your street.

When you’ve locked yours down, check it off in the privacy checklist.