A wireless router on a table.
Aquarius Studio/Shutterstock.com

A security researcher once discovered a backdoor in many D-Link routers, allowing anyone to access the router without knowing the username or password. This wasn’t the first router security issue and won’t be the last.

To protect yourself, you should ensure that your router is configured securely. This is about more than just enabling Wi-Fi encryption and not hosting an open Wi-Fi network.

Disable Remote Access

Routers offer a web interface, allowing you to configure them through a browser. The router runs a web server and makes this web page available when you’re on the router’s local network.

However, most routers offer a “remote access” feature that allows you to access this web interface from anywhere in the world. Occasionally glitches or firmware problems have cropped up that make routers with remote access enabled vulnerable to attack. If you have remote access disabled, you’d be safe from people remotely accessing your router and tampering with it.

To do this, open your router’s web interface and look for the “Remote Access,” “Remote Administration,” or “Remote Management” feature. Ensure it’s disabled — it should be disabled by default on most routers, but it’s good to check.

Disable remote access.

Update the Firmware

Like our operating systems, web browsers, and every other piece of software we use, router software isn’t perfect. The router’s firmware — essentially the software running on the router — may have security flaws. Router manufacturers may release firmware updates that fix such security holes, although they quickly discontinue support for most routers and move on to the next models.

Advertisement

Most newer routers have an auto-update feature like Windows and our web browsers do. However, if your router is a bit older, you may have to check your router manufacturer’s website for a firmware update and install it manually via the router’s web interface. Check to be sure your router has the latest available firmware installed.

Update your router.

Change Default Login Credentials

Many routers have default login credentials that are fairly obvious, such as the password “admin”. If someone gained access to your router’s web interface through some sort of vulnerability or just by logging onto your Wi-Fi network, it would be easy to log in and tamper with the router’s settings.

To avoid this, change the router’s password to a non-default password that an attacker couldn’t easily guess. Some routers even allow you to change the username you use to log into your router.

Change your router's password.

Lock Down Wi-Fi Access

RELATED: Don't Have a False Sense of Security: 5 Insecure Ways to Secure Your Wi-Fi

If someone gains access to your Wi-Fi network, they could attempt to tamper with your router — or just do other bad things like snoop on your local file shares or use your connection to downloaded copyrighted content and get you in trouble. Running an open Wi-Fi network can be dangerous.

To prevent this, ensure your router’s Wi-Fi is secure. This is pretty simple: Set it to use WPA2 or WPA3 encryption and use a reasonably secure passphrase. Don’t use the weaker WEP encryption or set an obvious passphrase like “password”.

Set Security to WPA2 or WPA3.

Disable UPnP

RELATED: Is UPnP a Security Risk?

A variety of UPnP flaws have been found in consumer routers. Tens of millions of consumer routers respond to UPnP requests from the Internet, allowing attackers on the Internet to remotely configure your router. Flash applets in your browser could use UPnP to open ports, making your computer more vulnerable. UPnP is fairly insecure for a variety of reasons.

Advertisement

To avoid UPnP-based problems, disable UPnP on your router via its web interface. If you use software that needs ports forwarded — such as a BitTorrent client, game server, or communications program — you’ll have to forward ports on your router without relying on UPnP.

Disable UPnP.

Log Out of the Router’s Web Interface When You’re Done Configuring It

Cross site scripting (XSS) flaws have been found in some routers. A router with such an XSS flaw could be controlled by a malicious web page, allowing the web page to configure settings while you’re logged in. If your router is using its default username and password, it would be easy for the malicious web page to gain access.

Even if you changed your router’s password, it would be theoretically possible for a website to use your logged-in session to access your router and modify its settings.

To prevent this, just log out of your router when you’re done configuring it — if you can’t do that, you may want to clear your browser cookies. This isn’t something to be too paranoid about, but logging out of your router when you’re done using it is a quick and easy thing to do.

Change the Router’s Local IP Address

If you’re really paranoid, you may be able to change your router’s local IP address. For example, if its default address is 192.168.0.1, you could change it to 192.168.0.150. If the router itself were vulnerable and some sort of malicious script in your web browser attempted to exploit a cross site scripting vulnerability, accessing known-vulnerable routers at their local IP address and tampering with them, the attack would fail.

Advertisement

This step isn’t completely necessary, especially since it wouldn’t protect against local attackers — if someone were on your network or software was running on your PC, they’d be able to determine your router’s IP address and connect to it.

Change Router LAN IP.

Install Third-Party Firmwares

If you’re really worried about security, you could also install a third-party firmware such as DD-WRT or OpenWRT. You won’t find obscure back doors added by the router’s manufacturer in these alternative firmwares.

If you’re feeling particularly ambitions, you can even build your own router using an old (or new) computer using a high-end network interface card and software like pfSense or OPNsense.

DD-WRT's basic setup screen.


Consumer routers have improved substantially in the last ten years. They usually have automatic firmware updates, more routers now force users to change their default passwords, they’re more feature-rich, and new security protocols are undoubtedly superior to older ones. Despite all of the improvements, routers (and modem-router combo units) still represent a prime target for malicious attacks, especially if your security is lax. Do yourself a favor — take 15 minutes and make sure you’re doing everything you can to keep your network secure.

Profile Photo for Chris Hoffman Chris Hoffman
Chris Hoffman is Editor-in-Chief of How-To Geek. He's written about technology for over a decade and was a PCWorld columnist for two years. Chris has written for The New York Times and Reader's Digest, been interviewed as a technology expert on TV stations like Miami's NBC 6, and had his work covered by news outlets like the BBC. Since 2011, Chris has written over 2,000 articles that have been read nearly one billion times---and that's just here at How-To Geek.
Read Full Bio »
Profile Photo for Nick Lewis Nick Lewis
Nick Lewis is a staff writer for How-To Geek. He has been using computers for 20 years --- tinkering with everything from the UI to the Windows registry to device firmware. Before How-To Geek, he used Python and C++ as a freelance programmer. In college, Nick made extensive use of Fortran while pursuing a physics degree.
Read Full Bio »