Your router is the most ignored device in your house

Every connection in your house goes through it, it is on permanently, and most people have never opened its settings. Here is what is actually worth doing, in order of what it is worth.

1. Change the admin password

Not your Wi-Fi password — the separate one for the router's own settings page. A large share of home routers still use admin/admin or admin/password, and default credentials are published for every model.

Reach it by typing 192.168.1.1 or 192.168.0.1 into a browser. The sticker on the router usually gives the address and the current login.

This is the single most valuable five minutes on this page, because anyone who reaches that page controls where every device in your house thinks the internet is.

2. Turn on automatic firmware updates

A router is a small computer running software that has security flaws like any other. Most modern ones can update themselves and many arrive with it switched off.

If yours cannot update automatically, check manually once or twice a year. If it no longer receives updates at all, replace it — a router past its support life is a permanent unpatched device on your network.

3. Use WPA3, or WPA2 at minimum

In the wireless settings. If you see WEP or "WPA/WPA2 mixed", move up. WEP is broken and has been for twenty years.

Your Wi-Fi password should be long rather than clever. Three or four unrelated words beat a short string of symbols, and you can actually read it out to a guest.

4. Turn off WPS

The "press the button to connect" feature. Its PIN method has a known weakness that lets an attacker recover your Wi-Fi password. Pairing a printer once is not worth leaving it on.

5. Turn off remote management

Also called remote administration or management from the internet. Almost nobody needs to reach their router's settings from outside the house, and leaving it on exposes that login to the entire internet.

6. Use the guest network

Two good reasons: visitors do not need access to your printer, your NAS or your laptops; and it is the right home for smart devices — plugs, bulbs, cameras, a television — which are the least maintained things you own. On a guest network a compromised bulb reaches nothing.

What about the one your provider gave you?

Usually fine, and often better than the alternative, because BT, Sky, Virgin and the rest push security updates automatically. That is worth more than the features on a router you have to maintain yourself.

Buy your own if you need better coverage or specific features. Do not buy one believing it is inherently more secure.

What a VPN does here

A VPN on the router covers everything in the house, including the things that cannot run VPN software themselves — a television, a console, a smart speaker. That is a real benefit, and it is the only way to cover those devices.

It does not fix a router with a default admin password or unpatched firmware. Those are the foundation, and a tunnel out of a compromised house is still a tunnel out of a compromised house. Do the six steps above first.