Every device in a home connects through one box, and that box usually ships configured for easy setup rather than for privacy. The good news is that regulator guidance is unusually consistent: the Federal Trade Commission, the FCC, and the FBI all point at the same short list of settings. Most of it takes one evening.
Change both passwords — there are two
The FTC's home Wi-Fi guidance starts with a distinction many households miss. The Wi-Fi password is what devices use to join the network. The administrator password is what signs in to the router's settings panel — and whoever holds it can change the Wi-Fi password, redirect traffic, and undo every other step on this page. Routers ship with default admin credentials that are publicly documented per model. Change the admin password first, then the Wi-Fi password, and make them different from each other and from anything you use elsewhere.
While you are in the settings, change the network name (SSID) as well. A default name advertises the router's make and model, and a name containing your family name or address ties the signal to your household. Neither helps you; both can help someone choosing a target.
Set encryption to WPA3 or WPA2
In the wireless security settings, choose WPA3 Personal if the router offers it, or WPA2 Personal (WPA2-AES) if it does not. The FTC treats these as the acceptable options. An open network, WEP, or the original WPA should be treated as no encryption at all — WEP in particular can be broken trivially with public tools. If the router offers neither WPA2 nor WPA3 even after a firmware update, the FTC's advice is to consider replacing it.
Update the firmware, then make it automatic
Router software is patched like any other software, and unpatched routers are found by automated scanning, not by burglars. Check the manufacturer's support page or the settings panel for a firmware update, install it, and turn on automatic updates if the model offers them. Registering the product with the manufacturer is how update notices reach you.
Then confirm the router is still supported at all. In a public service announcement dated May 7, 2025, the FBI's Internet Crime Complaint Center warned that criminals were compromising end-of-life routers — models the manufacturer no longer sells or patches, which the Bureau noted likely includes routers dated 2010 or earlier — using variants of the TheMoon malware, and renting the hijacked devices out as proxies so criminal traffic appears to come from homes like yours. No setting fixes an unpatchable router. Replacement is the remedy the FBI recommends.
Turn off the convenience features
The FTC recommends disabling three features unless you specifically need them:
Remote management exposes the admin panel to the internet. The routers named in the FBI's 2025 alert were among those with remote administration enabled.
Wi-Fi Protected Setup (WPS) trades security for an easier pairing button; its PIN mode has well-documented weaknesses.
Universal Plug and Play (UPnP) lets devices on your network open inbound ports on request — including devices you would not choose to trust with that decision.
Confirm the built-in firewall is enabled, and log out of the admin panel when you finish rather than leaving the session open.
Give guests and gadgets their own network
Most routers can run a guest network: a separate SSID with internet access but no route to your computers, storage, or each other. Put visitors on it, and consider putting smart-home devices — cameras, plugs, televisions, appliances — there too. Those devices are the least likely to receive updates and the most likely to outlive their manufacturers' support, which is precisely the profile the FBI's alert describes. Keeping them off the main network limits what a compromised gadget can reach.
The five-minute version
Admin password changed. Wi-Fi password changed and unique. WPA3 or WPA2 on. Firmware current and set to auto-update. Remote management, WPS, and UPnP off. Guest network on for visitors and smart devices. Router still supported by its manufacturer — and if it is not, a replacement ordered. That is the whole list, and it is the same list whether the source is the FTC's consumer guidance, the FCC's consumer tip sheet on Wi-Fi privacy, or the FBI's router alerts.