Lock your router’s front door
Your router is the one device every other device trusts. Whoever controls its settings controls your whole network: they can switch off its protection, open it to the internet, or quietly send all your traffic somewhere else. In this lesson you’ll close the four ways in that attackers use most: the admin password, out-of-date firmware, remote management, and routers that no longer get updates at all.
In this lesson
- Change your router’s admin password
- Check for and install firmware updates, and switch off remote management
- Find out whether your router is still supported by its maker
You’ll need: your router’s admin page open, and the label on the router itself (it shows the model number).
Two passwords, two different jobs
Your router has two passwords, and people often mix them up. The Wi-Fi password lets devices join your network. The admin password lets someone change the router’s settings. Older routers shipped with the same admin login on every unit, “admin” and “admin” or similar, and those lists are public. Newer ones usually print a unique password on the label, and in the UK, universal default passwords on connected devices have been banned since April 2024. Either way, the password you use to log in should be one only you know.
Try it yourself · part 1
Change the admin password
- In the admin page, look for Administration, System, Management or Router password. (It’s a different setting from the Wi-Fi password.)
- Set a new password that’s long and unique. The Password Tools generator makes a strong one; a passphrase of five random words works well too.
- Save it in your password manager before you click save on the router. If you forget it, the only way back in is a factory reset.
- If your router came from your internet provider and you can’t change the admin password, that’s usually because the provider manages it. Make sure the label’s password isn’t written anywhere visitors can see it.
Why firmware updates matter so much
Firmware is the software your router runs. When a security hole is found, the maker publishes a fix, and at the same moment the hole becomes public knowledge. A router that never updates stays open to an attack anyone can look up. That’s exactly what happened in April 2026, when the FBI warned that hackers working for Russian military intelligence had taken over vulnerable home and small-office routers, many of them older TP-Link models that no longer receive updates, and changed their settings to redirect traffic. Lesson 5 checks whether that’s happened to yours.
Try it yourself · part 2
Update the firmware, and close remote access
- Find Firmware, Software update, Router update or Administration in the admin page. Note the version number it shows.
- Click Check for updates if there is one, and install anything available. Don’t switch the router off while it updates; it can take a few minutes and restart by itself.
- If there’s an option for automatic updates, turn it on.
- Now find Remote management, Remote access or Web access from WAN, and make sure it’s off. It makes your router’s login page reachable from anywhere on the internet, so anyone can try to guess the password or use a flaw in the login page itself. Both the FBI and TP-Link recommend turning it off.
Is your router still supported?
Every manufacturer eventually stops making updates for older models. From then on, any new flaw stays open for good. In February 2026, security agencies in the US and UK jointly warned that state-backed hackers specifically target routers, firewalls and VPN devices that are past their support date, and US government agencies were given a year to remove theirs. For a home router, the same logic applies: if yours no longer gets updates, replacing it is the single biggest improvement you can make.
Try it yourself · part 3
Check your model’s support status
- Find the model number and, if shown, the hardware version (often “V2”, “Ver: 3.0”) on the label under the router. The admin page usually shows them too.
- Search the manufacturer’s website for that model plus “end of life” or “EOL”. Most makers publish a list of models they no longer support.
- Compare the firmware version from part 2 with the latest one on the model’s support page. If the newest firmware is several years old, the model has probably stopped getting updates.
- If it’s a router from your internet provider, ask them whether it’s still updated, and whether they’ll replace it if not. Some providers will replace an old router at no cost.
| What you found | What to do |
|---|---|
| Supported, firmware up to date | Turn on automatic updates if available, and check again every few months |
| Supported, update available | Install it now, then recheck the settings from this lesson; updates occasionally reset them |
| No longer supported | Plan to replace it. Until then, make sure remote management is off and the admin password is unique |
| Provider’s router | The provider usually updates it; ask them to confirm, and ask for a newer model if it’s old |
Key takeaways
- The admin password controls your whole network: make it long, unique and stored in a password manager.
- Firmware updates fix holes that become public the day they’re fixed. Install them, and turn on automatic updates.
- Remote management puts your router’s login page on the internet. Turn it off.
- A router that no longer gets updates will never be fixed; replacing it is the biggest single improvement.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. Your router is still using the admin password printed on its label, which is also shared by every unit of that model. What’s the risk?
2. What does turning off remote management do?
3. The newest firmware for your router came out six years ago. What does that most likely mean?
Read how attackers used out-of-date routers in 2026, and how to check yours, in Has Your Router’s DNS Been Hijacked?
This lesson is part of the free course Secure Your Home Network, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.