Setting Up a New Router Securely: The First 20 Minutes

Most people set up a new router the same way: plug it in, type the password from the sticker into their phone, see that the internet works, and never open the settings again. That router then sits in the hallway for five to seven years, handling every banking login, work call and doorbell camera feed in the house, running whatever settings the factory chose on the day it was boxed.

Those factory settings are built for one goal, which is getting you online with the fewest support calls. Security comes second. The good news is that closing the obvious gaps takes about 20 minutes, needs no special tools, and only has to be done once. This guide walks through it in the order I do it when helping friends set up a new box, and it explains which steps matter most if you only have five minutes.

Why the defaults are the weak point

A router is a small computer that faces the internet directly. Anything wrong with it is reachable by anyone scanning address ranges, and automated scanners do exactly that, all day, looking for login pages that still accept the manufacturer's default credentials or firmware with known holes.

Three defaults cause most of the trouble I see. The admin password for the router's settings page is either printed on the sticker or, on older and cheaper models, the same for every unit of that model. Features designed for convenience, such as WPS and remote management, are often switched on. And the firmware in the box is usually several months old by the time it reaches you, because it was installed at the factory before shipping.

None of this means your router is compromised. It means the settings were chosen for someone who never logs in, and you can do better.

The 20-minute setup, step by step

You will need a laptop or phone connected to the router, the sticker on the bottom of the router, and your password manager open. Most routers are reached by typing 192.168.0.1 or 192.168.1.1 into a browser, and the exact address is usually printed on that same sticker. Mesh systems like eero, Google Nest Wifi and TP-Link Deco do everything through a phone app instead, so the menus look different, but the same settings exist.

1. Change the admin password. This is the password for the settings page, not the Wi-Fi password, and many people never realize there are two. Replace it with a long random one from your password manager. If someone joins your network as a guest, this is what stops them from changing your settings.
2. Update the firmware. Look for a section called Firmware, System, Administration or Update. Check for a new version and install it before you change anything else, since updates sometimes reset settings. Then turn on automatic updates if the router offers them.
3. Set Wi-Fi security to WPA3, or WPA2/WPA3 mixed. If your devices are older, WPA2 with AES is acceptable. Avoid anything labeled WEP, WPA (without a number) or TKIP. These are old standards that can be broken quickly.
4. Choose a new Wi-Fi name and password. The name should not include your surname, flat number or street. The password should be at least 14 characters; a few random words joined together is easy to type on a smart TV and hard to guess.
5. Turn off WPS. WPS lets devices join by pressing a button or entering an 8-digit PIN. The PIN version has a design flaw: the router checks the PIN in two halves, so an attacker only needs to try about 11,000 combinations instead of 100 million. Tools that automate this have existed since 2011. Some routers keep the push-button version separately; turn off the PIN option at minimum.
6. Turn off remote management. Sometimes called Remote Access, Web Access from WAN, or Cloud Management. This lets the settings page be reached from the internet. Unless you specifically need it, switch it off.
7. Create a guest network for visitors and smart devices. Put guests, smart plugs, bulbs, speakers and cameras on it. If one of those cheap devices is ever compromised, it sits on a network that cannot see your laptop or your shared files.

Store the admin password and Wi-Fi password in your password manager under the router's name. If you are not using one yet, our explanation of why every account needs its own password applies to network equipment just as much as to email.

The setting people tell you to disable that you might need

Many security checklists say to turn off UPnP, a feature that lets devices on your network open ports on the router automatically. The reasoning is sound: malware on one device can use UPnP to expose itself to the internet without asking you.

The trouble is that games consoles, some video calling apps and certain remote-play tools rely on it. Turn it off and your PlayStation may report a "strict NAT" type, voice chat stops working in some games, and you end up spending an evening learning manual port forwarding, which carries its own risks if done carelessly.

My honest view: if nobody in your home games online or uses peer-to-peer apps, turn UPnP off. If someone does, leave it on, keep firmware updated, and keep untrusted smart devices on the guest network where UPnP abuse would matter less. A checklist that ignores how a household actually uses its network is advice people undo the first time it breaks something, and then they distrust the rest of the list too.

If you only have five minutes

Do three things: change the admin password, update the firmware, and turn off WPS. Those cover the routes that automated attacks use most, and each takes under two minutes. Everything else can wait until the weekend.

The admin password matters more than the Wi-Fi password, and it is the one almost nobody changes.

These steps sit alongside the other everyday habits covered in the security habits that matter most. A well-configured router does not protect a reused password or a phishing click, but it does stop your network from being the easy entry point.

What to do with an older router you already own

Everything above applies to a router that has been running for years, with one extra check. Look up your model on the manufacturer's website and find its support or end-of-life page. If it no longer receives firmware updates, new vulnerabilities will stay unpatched forever. Several popular models from 2016 to 2019 have already reached that point. A router without updates is the one piece of household equipment I would replace even if it still seems to work perfectly.

Also look at the list of connected devices in the settings. On the last few setups I helped with, there was at least one device nobody could identify. Usually it turned out to be an old phone or a forgotten smart plug, but it is worth knowing what is on your network.

One task for this week

Turn the router over tonight, find the admin address on the sticker, and log in. If the admin password still matches what is printed there, change it and save the new one in your password manager. That single change closes the most common gap, and once you are inside the settings, the firmware update is two clicks away. For more beginner-friendly protection, browse the security basics section.