Your broadband router is the front door to everything in your home that connects to the internet — phones, laptops, the smart TV, the doorbell, the baby monitor. Most people plug it in on day one and never look at it again. The good news: securing it is a one-evening job, and most of it is changing a few settings. Here's what to do, in order of how much it matters.
First: how to get into your router
Most UK routers can be managed from a web page or your broadband provider's app. The address and admin password are usually on a sticker on the back or bottom of the router, or in the app. If you're not sure, search your provider's help pages for “router settings” and your router's model name. Take a photo of the sticker before you change anything, so you can always get back to where you started.
1. Change the router's admin password
This is the password that lets someone change your router's settings — different from your Wi-Fi password. If it's still the factory default, change it to something long and unique. The US consumer regulator's advice is the same as everyone's: change the default administrative username and password “to something unique”.
Worth knowing: since 29 April 2024, UK law has banned new consumer internet-connected products — routers, smart speakers, cameras and the like — from shipping with universal default or easily guessed passwords. So newer kit should already have a unique password printed on it. Older routers may not.
2. Make sure your Wi-Fi is encrypted (WPA2 or WPA3)
In your router's Wi-Fi or wireless settings, look for the security type. You want WPA3 Personal if your router offers it, or WPA2 Personal (sometimes shown as WPA2-PSK or “WPA2/WPA3”). If it says WEP, “open” or “none”, change it today — anyone nearby can join or snoop.
3. Use a strong Wi-Fi password
The long random password on the sticker is actually fine, as long as you haven't shared it with half the street. If you want something easier to type, the National Cyber Security Centre's tip is to combine three random words — something like “teapot-lantern-orbit” — which is long and hard to guess but easy to remember. Don't use your address, surname or pet's name.
4. Keep the router updated
Routers get security updates just like phones. Many routers supplied by the big UK broadband providers update themselves automatically — but not all, and not ones you bought yourself. In the settings, look for “firmware” or “software update” and turn on automatic updates if there's an option. If your router is many years old and no longer gets updates, ask your provider for a newer one; they often replace them free.
5. Put visitors and gadgets on a guest network
Most routers can run a second, separate “guest” Wi-Fi network with its own name and password. Use it for visitors, and consider putting smart gadgets (plugs, bulbs, cameras, the TV) on it too. That way, if a cheap gadget has a security flaw, it isn't sitting on the same network as your laptop and your banking.
6. Turn off the features you don't use
- WPS (the “push to connect” button or PIN). The PIN version has a long-known weakness. If you don't use it, switch it off.
- Remote management — the ability to change router settings from outside your home. Most people never need it.
- UPnP (Universal Plug and Play) lets devices open connections through your router by themselves. It's convenient for some games consoles, but it's also a way in. If nothing breaks when you turn it off, leave it off.
The same goes for your smart gadgets: the NCSC advises that if you don't need to reach a device when you're away from home, switch off its “remote access”.
7. Check what's connected
Your router's settings or app will show a list of connected devices. Once in a while, have a look. If there's something you don't recognise, change your Wi-Fi password — everything legitimate will ask for the new one, and anything that shouldn't be there gets kicked off.
8. Switch on your provider's free scam filter
Several big UK broadband providers include a free filter that warns you before you land on known scam and malware websites, for every device on your home Wi-Fi, with nothing to install. Sky's is called Sky Broadband Shield and is switched on by default; other providers offer similar tools under their own names. Look in your broadband account settings or search your provider's help pages for “security” or “web protection”.
9. Don't forget the devices themselves
A locked-down router won't save a laptop that hasn't been updated in two years. Turn on automatic updates on your phones, computers and smart devices, change any default passwords on gadgets, and turn on two-step verification wherever it's offered. Our guide to which antivirus you actually need covers the computer side.
Do you need a VPN at home?
Not for security on your own Wi-Fi, once you've done the steps above. A VPN helps most on public Wi-Fi, or if you don't want your broadband provider seeing which sites you visit. Our VPN guide explains when it's worth it and when it isn't.
The ten-minute version
- Change the router admin password from the default.
- Check Wi-Fi security is WPA2 or WPA3.
- Turn on automatic router updates.
- Set up a guest network for visitors and gadgets.
- Turn off WPS, remote management and (if nothing breaks) UPnP.
That's a better-secured home than most. No new kit required.