The short version

Your router ships with settings tuned for convenience, not security — and every device you own connects through it. The highest-impact router security settings to enable in 2026 are: change the default admin password, turn on WPA3, keep firmware updated, disable WPS and remote admin, and put smart-home gadgets on a separate network. The catch: many ISP-supplied routers can’t do half of these. This checklist covers all 15, in priority order.

Your home network is the front door to everything you own — laptops, phones, smart TVs, cameras, thermostats, baby monitors. They all pass through one box, and that box came configured to be easy, not safe. Default passwords, aging encryption, open ports, and no separation between devices mean a single weak gadget can expose the whole house. The good news: fixing it doesn’t take an IT degree. It takes about fifteen settings, done in the right order.

Key takeaways

  • The single most important setting is changing the default admin password — do it before anything else.
  • WPA3 encryption and current firmware close the two vulnerabilities attackers scan for most.
  • Putting IoT devices on their own network is the most-skipped high-impact step — it stops a hacked gadget from reaching your laptop.
  • Several of these settings don’t exist on basic ISP-supplied routers — the hardware decides what’s possible.
  • Do them in order. The first five deliver most of the protection.

The 5 settings that matter most

If you only change five things, change these. They shut down the vulnerabilities automated scanning tools look for across millions of home IP addresses every day.

1. Change the default admin password. Not your Wi-Fi password — the separate password for the router’s admin panel. Default credentials are published online for every model. This is the first thing an attacker tries and the first thing you should fix.

2. Turn on WPA3 encryption. The current Wi-Fi security standard. If your router only offers WPA2, use it — but WPA3 meaningfully hardens your network against password-guessing attacks. If it offers neither, your hardware is too old to trust.

3. Update your firmware — and enable auto-updates. Firmware patches fix known security holes. A router running years-old firmware is running years-old vulnerabilities. Turn on automatic updates if your router supports them.

4. Disable WPS. Wi-Fi Protected Setup’s push-button pairing is convenient and insecure — its PIN can be brute-forced. Turn it off.

5. Turn off remote administration. Unless you specifically need to manage your router from outside your home, disable remote admin so the control panel isn’t exposed to the internet.

Already done these? See the five router mistakes we see most often, and why an end-of-life router can’t be fixed with settings alone.

The next 5: real hardening

6. Create a guest network. Give visitors — and any device that doesn’t need to reach your main devices — a separate SSID. This one step dramatically limits the damage if any device is compromised.

7. Segment your IoT devices. Put smart bulbs, cameras, plugs, and speakers on their own network, isolated from your laptops and phones. It’s the most overlooked setting and one of the most important — we explain why in should your smart TV be on a guest network?

8. Enable the router firewall. Most routers have one; make sure it’s on. It blocks unsolicited inbound connections by default.

9. Turn on DNS filtering. Filtering DNS at the router blocks known malicious and tracker domains for every device on the network at once — including the ones with no security settings of their own.

10. Review your connected device list. Open the admin panel and look at what’s connected. Anything you don’t recognize deserves investigation.

The last 5: for a locked-down home

11. Disable UPnP if you don’t need it. Universal Plug and Play lets devices open ports automatically — convenient, but a common attack vector. Some gaming and streaming setups need it; if yours doesn’t, turn it off.

12. Change the default network name (SSID). A default SSID like “NETGEAR47” tells an attacker your router’s make and model — and which exploits to try. Rename it to something that reveals nothing.

13. Turn on a VPN at the router. A router-level VPN encrypts every device’s traffic before it leaves your home — including devices that can’t run a VPN app. It’s the one privacy setting that covers your whole network at once.

14. Schedule automatic reboots. A periodic reboot clears memory-resident malware that hasn’t written itself to permanent storage. A weekly restart is cheap insurance.

15. Replace hardware that’s past support. If your router is more than five years old and no longer receiving firmware updates, no setting can secure it. Aging hardware that can’t be patched is the vulnerability.

Why your router might not have these settings

Here’s the part most checklists skip: you can’t enable a setting your router doesn’t have. Many ISP-supplied gateways and budget routers omit the advanced controls entirely — no network segmentation, no VPN client, no DNS filtering, limited firewall rules. The convenience-first box that came in the mail simply can’t do the second half of this list.

That’s the difference a capable router makes. Hardware running advanced firmware — AsusWRT, AsusWRT-Merlin, or OpenWrt — exposes every setting above, from IoT isolation to network-wide DNS filtering to a built-in VPN. FlashRouters ships these pre-flashed and tested at our offices, with VPN pre-configuration available as an add-on at checkout — so the advanced settings are there from day one, without flashing firmware yourself.

The hardware that can do all 15

See the best VPN routers of 2026

Every setting in this checklist depends on a router capable of running it. Our 2026 lineup covers Wi-Fi 7, mesh, and travel models across AsusWRT-Merlin, OpenWrt, and GL.iNet — each pre-flashed and tested so segmentation, DNS filtering, firewall rules, and a router-level VPN are ready from day one.

Compare the best routers of 2026 →

Not sure which model fits your home size, speed, and device count? Take the 60-second router quiz and we’ll match you to the right one. Want the deeper hardware breakdown first? Read our guide to the best open-source VPN routers of 2026.

Frequently asked questions

What is the most important router security setting?

Changing the default admin password. Default router credentials are published online for every model, so an unchanged password is the easiest way in. Change it before configuring anything else.

Should I turn off WPS on my router?

Yes. WPS push-button pairing is convenient but insecure — its PIN can be brute-forced by an attacker within range. Disable it and connect devices with your Wi-Fi password instead.

What is network segmentation, and do I need it?

Network segmentation puts different device types on separate networks — for example, smart-home gadgets isolated from your laptops and phones. If any one device is compromised, it can’t reach the others. It’s one of the highest-impact settings, but many basic routers don’t support it.

Why doesn’t my router have all these settings?

Many ISP-supplied and budget routers omit advanced controls like segmentation, DNS filtering, and a built-in VPN client. You can’t enable a setting the hardware doesn’t offer — which is why a capable router running advanced firmware unlocks the full checklist.

A router that can actually do all 15

Segmentation, DNS filtering, firewall rules, and a built-in VPN — pre-flashed and tested before it ships.

Compare the best routers of 2026 →

Not sure which fits? Take the 60-second router quiz

100,000+ Routers Shipped  ·  15+ Years of VPN Expertise  ·  Official NordVPN Partner  ·  US-Based Experts