Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To reduce avoidable risk, keep your router supported and updated, secure its administrator settings and Wi-Fi, and keep an eye on the devices connected to it. These steps make a home network harder to abuse as a foothold or relay; they cannot guarantee immunity from a state actor or fix a compromise at your internet provider.
This is a U.S.-oriented guide for household networks, not an enterprise incident-response plan. State-linked campaigns have exploited vulnerable small-office and home-office (SOHO) routers, but that does not mean every household whose router is exposed is itself being targeted.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why would a state-sponsored actor use a home router?
A vulnerable router can be valuable even when its owner is not the intended target. An attacker may compromise it as a stepping stone or relay, using its internet connection and location to obscure or support activity directed elsewhere. A device can therefore be abused without its household being the focus of an espionage operation.
In a February 2024 advisory, CISA, the NSA, the FBI and partner agencies described Volt Typhoon’s use of compromised SOHO routers as launching pads in activity against U.S. critical infrastructure. The advisory’s recommendations include patching internet-facing systems, using phishing-resistant multifactor authentication (MFA) where appropriate, and logging. Those are broad security recommendations, not a list of controls every consumer router exposes. The agencies reported at least five years of foothold in some victim IT environments; that observation applies to certain critical-infrastructure environments, not to home routers or the duration of any household compromise. Read the joint advisory.
Later advisories describe other activity but should not be collapsed into one campaign. An August 2025 multinational advisory about Chinese state-sponsored activity says targeting included telecommunications and other networks, including provider-edge and customer-edge routers. It says that activity only partially overlaps with industry labels such as Salt Typhoon. Separately, in April 2026, the NSA highlighted an FBI warning about Russian GRU exploitation of vulnerable SOHO routers. These reports establish that vulnerable routers can matter to state-linked operations; they do not establish that a particular household is a target or provide a percentage of U.S. homes compromised. See the 2025 multinational advisory and the NSA’s April 2026 announcement.
In April 2026, the NSA also said compromised SOHO equipment and Internet of Things (IoT) devices frequently appear in China-nexus covert networks. This is another reason to secure devices at the edge of a household network, not proof that a given smart device has been compromised. Read the joint guidance announcement.
Popular on Amazon
What should I secure first?
Start with the router because it connects your household devices to the internet and may be exposed to attacks directly. Then secure the devices and accounts that rely on it. The order matters: a strong account password cannot repair an outdated router, while a secure router does not make an old camera or reused account password safe.
- Identify and update the router. Find its manufacturer, model and firmware version, then check the maker’s or internet service provider’s update and support information.
- Secure router administration. Change default administrator credentials, disable internet-facing remote administration if you do not need it, review WPS and UPnP, and keep the firewall enabled.
- Secure Wi-Fi. Prefer WPA3 Personal when available; use WPA2 Personal if WPA3 is unavailable. Set a strong Wi-Fi password and a separate guest network if the router supports one.
- Review connected devices and accounts. Update device software, change device-default passwords, remove devices you no longer use, and enable MFA on important accounts where offered.
- Investigate suspicious changes proportionately. Record what you see, ask the router maker or ISP for model-specific help, secure affected accounts, and report a suspected intrusion to the FBI’s Internet Crime Complaint Center (IC3).
How do I find out whether my router is supported?
Check the actual router in your home rather than relying on a remembered model name or the wireless network name. If your ISP supplies or manages the equipment, ask the ISP how it handles firmware updates and whether the model remains supported.
- Locate the model information. Check the router’s label or its management interface or app. Record the manufacturer and exact model; if the ISP supplied the router, record that too.
- Find the firmware version. Look in the router’s administration interface or app for a status, system or device-information page. The exact label and location differ by model.
- Check the official support channel. Use the manufacturer’s support information or contact your ISP to find out whether updates are available and whether the model still receives security support. Do not install firmware from an unrelated third-party site.
- Apply updates through the supported method. Follow the router maker’s or ISP’s instructions, and confirm the firmware version afterward if the interface shows it. Some ISP-managed routers receive updates through the provider rather than through a consumer-facing manual update control.
- Decide whether the router has reached end of life. If it no longer receives security updates, replace it when possible. The FBI specifically recommends replacing end-of-life routers. If an updated router offers only WEP or WPA, the FTC advises considering replacement rather than treating that network mode as adequate. Read the FBI’s end-of-life router alert and the FTC’s home Wi-Fi guidance.
Do not treat “it still connects” as evidence that a router is safe to keep indefinitely. Continued operation and security support are different things. If the provider or maker cannot confirm that the device receives security updates, that uncertainty is relevant to the replacement decision.
How do I lock down router administration?
The router administrator password controls settings; the Wi-Fi password lets devices join the wireless network. Changing one does not change the other, so secure both independently.
Free tools Windows power users keep installed
One-click scans. No signup required.
Change the administrator credentials
Use a unique, hard-to-guess password for the router’s administrator account and replace any default credentials you can change. Do not reuse a password from email, shopping or another account. If the router or ISP offers a way to change the administrator name as well, follow its guidance, but do not assume every model allows that option.
Also popular on Amazon
Turn off internet-facing remote administration when it is unnecessary
Remote administration can expose the router’s management interface to connections from outside the home. If you do not need to manage the router from away, disable internet-facing remote management. Look for controls called “remote management,” “remote administration” or similar in the router’s interface, app or ISP instructions; names and locations vary.
Do not assume that every feature branded as remote access means the same thing. A manufacturer’s phone app or a provider’s support feature may work differently from exposing the router’s administrator interface to the public internet. If you are unsure what a switch controls, check the documentation or ask the provider before changing it.
Review WPS and UPnP
Disable Wi-Fi Protected Setup (WPS) if you do not use it, and turn off Universal Plug and Play (UPnP) if your household does not require it. These convenience features can make setup or device connectivity easier, but a feature that is unnecessary is another avoidable setting to leave enabled. If turning one off disrupts a device or service you rely on, check the device’s instructions and the router documentation before deciding whether to re-enable it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Leave the firewall on
Confirm that the router firewall is enabled. Router interfaces vary, so follow the model-specific instructions rather than looking for one universal menu path. Do not disable the firewall as a generic troubleshooting step; if a device or game has a connection problem, investigate that specific issue instead of broadly removing a network safeguard.
How should I secure Wi-Fi and smart-home devices?
Use the strongest Wi-Fi security mode available on your router and devices, and treat every connected device as something that needs updates and account protection. The FTC identifies WPA3 Personal as the newer preferred option and WPA2 Personal as workable. Its guide explains home Wi-Fi security settings.
Also popular on Amazon
Choose a current Wi-Fi security mode
In the router’s wireless security settings, select WPA3 Personal if the router and the devices that need to connect support it. If WPA3 is unavailable, WPA2 Personal is the next option supported by the FTC guidance. If the router offers only WEP or WPA after updating, consider replacing it. Do not mistake a network name that sounds secure for an encryption setting; check the actual security mode in the router interface.
Use a distinct Wi-Fi password and guest network
Choose a strong Wi-Fi password that is different from the router administrator password. A guest network can give visitors a separate way to connect without sharing the household’s main Wi-Fi credentials. If you want to use guest mode to separate smart-home devices, inspect the router’s settings and documentation: the existence of a guest network does not establish that a particular model isolates every type of device in the way you expect.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Keep device software and account access current
Review the router’s connected-device list and compare it with the computers, phones, cameras, televisions and other devices you recognize. Update device software and firmware through the device maker’s supported process, replace default device passwords, enable offered two-factor authentication, and remove older devices you no longer use. Give extra attention to devices that remain connected while rarely receiving updates or whose support status is unclear.
Router security and account security address different risks. The 2024 CISA-led advisory recommends phishing-resistant MFA in its broader critical-infrastructure guidance. For households, use phishing-resistant MFA on important accounts when the account and your authenticator support it; it protects account sign-in, not router firmware, and is not a substitute for a router update.
What should I do if I suspect a router compromise?
Unexpected settings, an unfamiliar connected device or unexplained activity are reasons to investigate, not proof of a state-sponsored attack. Start by recording what changed and seeking advice specific to your router model and ISP rather than inferring attribution from one symptom.
- Write down the observation. Note the date, what setting or device looked unfamiliar, and any relevant messages shown in the router interface. Avoid making a conclusion based only on a slow connection, heat, or an unfamiliar IP address.
- Contact the router maker or ISP. Ask for model-specific steps to review settings and address suspected unauthorized access. If the router is managed by your provider, involve it in determining update and remediation options.
- Secure accounts that may be affected. From a device and connection you trust, change passwords for affected accounts and enable MFA where available. Follow your employer’s reporting rules if a work device or work account is involved.
- Report a suspected intrusion. The FBI directs people to report suspected cyber incidents to IC3. A report can document a concern; it does not itself confirm who was responsible. Visit IC3.
The FBI cautions that an IoT indicator alone does not establish malicious activity. Avoid treating a single warning, device, or unfamiliar address as proof of infection or government attribution. If you believe an incident affects a work network or a critical service, follow the relevant employer or provider reporting channel as well as household remediation steps.
Also popular on Amazon
What can home-router settings not protect against?
Router hardening reduces risks at the household network edge; it does not control every part of an internet connection. A reported intrusion into a telecommunications provider is not the same as an intrusion into a subscriber’s router, and changing home Wi-Fi settings cannot repair provider-side access.
This distinction matters when reading reporting about Chinese-linked telecommunications intrusions and labels such as Salt Typhoon. The 2025 multinational advisory says the activity it describes only partially overlaps with some industry labels. The documented use of SOHO routers by Volt Typhoon in activity against critical infrastructure is a different finding; neither report establishes that a household subscriber’s router was compromised merely because the subscriber uses an affected provider.
A virtual private network (VPN) is not a replacement for router security updates or secure administration. A VPN may protect some traffic under some circumstances, but the cited router warnings do not establish that a consumer VPN prevents router exploitation, removes malware from a router, or resolves an ISP compromise. The NSA’s reference to organizational VPN policy in telework guidance is not evidence of those consumer protections.
There is no defensible figure in the cited official material for the percentage of U.S. home networks compromised by state actors or an effectiveness rate for consumer router protections. Treat security improvements as risk reduction, not a promise of immunity. As NSA Cybersecurity Technical Director Neal Ziring put it in a February 2023 home-network announcement: “We can minimize this risk by securing our devices and networks, and through safe online behavior.” Read the NSA announcement.
Should I replace my router?
Replacement is a practical security step when the router is end of life, no longer receives security updates, or cannot provide a currently supported Wi-Fi security option. If the router is managed by an ISP, first confirm whether the provider can update or replace it; do not assume that a device is unsupported just because its interface does not offer manual firmware installation.
Also popular on Amazon
When choosing a replacement, prioritize the security-support lifecycle and update process over headline speed claims. Look for clear support information, a dependable way to receive firmware updates, secure administrator defaults, WPA3 Personal or WPA2 Personal, and guest-network controls if you need them. CISA and the FBI favor automated signed updates and management interfaces that are not exposed to the internet; those are useful design criteria, not verified attributes of any specific retail model. No particular model or price is established here.
If shopping, the phrase “WPA3 home Wi-Fi router with security updates” describes the relevant category, but verify the maker’s support commitments and actual feature documentation before buying. A compatible FIDO2 security key can be useful for phishing-resistant MFA on accounts that support it; compatibility must be checked for each account. A security key does not fix compromised router firmware.
How do I keep the protections from slipping?
Make router and device upkeep a recurring household task rather than a one-time setup. A short check after a router update, a new smart-home purchase or an ISP equipment change can catch forgotten defaults and devices that are no longer needed.
- Keep a note of the router model, firmware version and update/support channel.
- Periodically check for firmware updates and confirm the administrator and Wi-Fi passwords remain distinct.
- Review remote administration, WPS, UPnP and firewall settings after a reset, replacement or provider support visit.
- Check connected devices for unfamiliar entries and remove equipment you no longer use.
- Before adding a connected device, confirm that it can be updated and that its default credentials can be changed.
- Use MFA on important accounts where available, with phishing-resistant options when supported.
The NSA’s July 2026 router-hygiene guidance also discusses SNMPv3, Cisco Smart Install and protocol filtering, but these are organization- and router-specific topics, not universal controls for ordinary consumer equipment. Do not change unfamiliar enterprise-oriented settings just because they appear in a government advisory; use guidance intended for your router model or ask the provider. See the July 2026 announcement.
Frequently Asked Questions
Can hackers use my router without me knowing?
A compromised router may be used as a relay without obvious signs to the household. The official advisories establish that vulnerable SOHO routers have been abused in operations, but they do not provide a reliable household symptom checklist or show that a quiet connection is evidence either way.
How long did Volt Typhoon remain in victim networks?
CISA, NSA, FBI and partner agencies reported at least five years of foothold in some critical-infrastructure victim IT environments in their February 2024 advisory. That figure is not a finding about home networks or the time any household router remained compromised.
Can my internet provider fix a compromise on its network?
Your provider controls equipment and systems on its side of the connection and may also manage the router it supplied, so it is an appropriate contact for provider-side concerns. A provider response does not establish that the router or a particular subscriber account was compromised.
Recommended Free Tools
Should I install firmware I found on a forum if the manufacturer has no update?
No: use the router maker’s or ISP’s supported update channel rather than third-party firmware files of uncertain origin. If official security support has ended, replacement is the safer path than relying on an unofficial download.
