Why factory settings are a weakness
A new router arrives ready to use. It has a preset network name, a preset Wi-Fi password and a preset login for its settings page. That convenience comes at a cost: the defaults are shared across many units, follow predictable patterns, or are printed on a label that anyone with physical access can read.
Default router settings are risky for a few reasons:
- Administrator logins are widely documented. Many models use the same username and password out of the box, and lists of these are easy to find. Anyone who can reach the settings page could try them.
- Preset Wi-Fi passwords may be guessable. Some are generated from a pattern, and a label on the router is visible to a houseguest, a repair visitor or a previous tenant.
- Default names reveal the brand. A network name that includes the router’s model or provider tells a curious neighbor which equipment you use, which may help them look up its known quirks.
None of this means a router with default settings will certainly be abused. It means you are relying on obscurity rather than on a secret that only you know. Replacing the defaults takes about ten minutes and removes much of that exposure.
Two different passwords
People often mix up the two passwords involved, so it helps to separate them.
The Wi-Fi password lets devices join the wireless network. You share it with family and sometimes guests.
The administrator password lets someone log in to the router’s settings page and change how the network works. This one should be known only to the adults who manage the network. It controls everything else, so it matters more.
Use different values for each, and do not reuse either on an email or banking account. The risks of password reuse apply here as much as anywhere.
How to reach the settings page
Most routers are managed through a web page. Your router’s manual or the label on the device typically gives the address to type into a browser, along with the default login. Some routers use a phone app instead. You need to be connected to the network, either by Wi-Fi or by a network cable, to open it.
Because menus differ by brand, look for sections labeled something like Administration, System, Wireless or Security. If you cannot find the page, the provider’s support site is a safer source of instructions than a random search result, since search results can include unreliable pages.
If you have changed the administrator password in the past and forgotten it, most routers have a small reset button that restores factory settings. Be aware that a reset erases every custom setting, so you will need to set the network up again from scratch.
Replacing the administrator password
When you find the setting for the router’s login, change the password to something long and unique. Length helps more than complexity: a passphrase made of several unrelated words is often stronger and easier to type than a short jumble of symbols. If you are unsure how to build one, see the notes on memorable passphrases.
Some routers also let you change the administrator username. If yours does, it is worth doing, since it means an attacker has to guess two things rather than one.
Store the new login somewhere safe. For many households, password managers are ideal because it removes the need to memorize yet another secret. A written note kept in a locked drawer is better than a sticky label on the router itself.
Choosing a network name
The network name, also called the SSID, is broadcast to everything within range. When picking one, aim for something that is neither identifying nor attention-seeking.
Good practice includes:
- Avoid your surname, apartment number or street address.
- Avoid names that mention the router brand or model.
- Avoid jokes or messages aimed at neighbors, which can invite attention or conflict.
- Make it distinctive enough that you can tell it apart from neighboring networks. Otherwise someone might accidentally join the wrong one, and you might too.
That last point has a security side as well. Look-alike network names are a known trick in public places, as discussed in the article about fake Wi-Fi hotspots. At home, a clearly unique name makes it easier to notice if something odd appears.
Changing the name will disconnect your devices, since they remember the old network. Plan to reconnect each one: phones, laptops, televisions, game consoles, printers and smart speakers.
Setting a new Wi-Fi password
Pick a long passphrase that the household can type without much trouble. Do not reuse the administrator password. Keep in mind that every device will need the new password after you change it, and some gadgets are awkward to reconfigure, so do this at a time when you can go through them one by one.
While you are in the wireless settings, confirm that the security mode is set to a modern option. The basics of Wi-Fi encryption types are covered elsewhere, but the short version is that WPA3 or WPA2 with AES is generally preferred and older modes should be avoided.
After the change
Write down the date you made the changes, and test that your key devices reconnect. If something stops working, check that the device has the new password rather than assuming the router is faulty.
If you rent your router from your internet provider, it is still worth changing the login, but the provider may manage some settings remotely. If you are unsure what you are allowed to change, contact their support. Likewise, if you are returning or replacing the device, reset it first so your credentials do not go with it.
Replacing the defaults will not make a network invulnerable, and outcomes depend on the rest of your setup. It is, however, one of the most useful single steps you can take.