Start by staying calm
Suspecting that a stranger is on your Wi-Fi is unsettling, but it is a common worry and usually has a simple explanation. When there really is an unwanted user, the response is straightforward: remove access, close the gap and check your accounts. You do not need special tools or deep technical knowledge.
Nothing here replaces advice from your internet provider or the router maker, and it is general information only.
Signs that may point to an unwanted user
None of the following proves that someone is on your network. They are reasons to take a look.
- Unfamiliar devices in your router’s list. This is the most direct sign, though a lot of harmless devices show up under confusing names. See the article on how to read the connected device list.
- Unexplained slowdowns. The connection becomes sluggish at times when your household is not busy.
- Activity lights on the router blinking heavily when all your devices are idle. Many devices update or sync in the background, so this alone means little.
- Unfamiliar network settings. Changes you did not make, such as a different Wi-Fi name, altered DNS settings or a new account on the router.
- Your provider contacts you about unusual activity or a possible policy breach.
- Devices behaving oddly, such as a smart gadget resetting itself.
Rule out ordinary explanations first
Before assuming the worst, consider the common causes.
- Slow speeds are often caused by streaming, large downloads, many devices, congestion with neighbors on the same channel, distance from the router, or a provider issue. Restarting the router and testing near it frequently clarifies things.
- Unknown device names are commonly printers, televisions, speakers, game consoles, e-readers, thermostats and visitors’ phones.
- Duplicate entries can occur when a device switches Wi-Fi bands or randomizes its address.
- Blinking lights can come from automatic updates, cloud backups or devices syncing photos.
A calm audit of everything you own, as described in the article on seeing which devices are on your network, solves most cases.
A calm response plan
If something remains unexplained after that, work through these steps in order.
1. Change the Wi-Fi password
This is the single most effective action. Pick a long, unique passphrase that you do not use elsewhere. Once you change it, every device is signed out, and only those you reconnect with the new password get back on. Memorable but long phrases are a good fit, as described in the guide to memorable passphrases.
2. Change the router’s administrator password
If someone might have reached the settings page, particularly if you never changed the factory login, replace it too. Use a different password from the Wi-Fi one. The article on default router settings explains how.
3. Check the encryption mode
Make sure the wireless security is WPA3 or WPA2 with AES. If it is set to an open, WEP or original WPA mode, change it. Also consider turning off WPS if you do not use it, because that feature has had weaknesses.
4. Look at the router’s settings
Check for settings you did not make: remote administration switched on, port forwarding rules you do not recognize, unknown user accounts, or altered DNS addresses. If you see something you cannot explain, note it down and consider a factory reset, then set the router up again carefully. Remember that a reset erases your own settings too.
5. Update the firmware
Install any available update. A router with known flaws is an easier target, as discussed in the article on router firmware updates. If your router is no longer supported, consider replacing it.
6. Reconnect your own devices
Join each phone, laptop and gadget to the network with the new password. Take the chance to rename entries in the router list so they are easy to recognize next time. Then look at the list again. If an unknown entry does not return, that is reassuring.
7. Set up a guest network
Give visitors and cheaper gadgets a separate network, so the main password stays private. The article on guest networks explains how.
If you believe your accounts were affected
Someone on your Wi-Fi does not automatically gain access to your accounts, and most account traffic is encrypted. Still, if you have reason to think your devices or information were exposed, take sensible precautions:
- Change passwords for important accounts such as email and banking, starting with email, from a device you trust.
- Turn on two-step sign-in if it is not already on.
- Check account activity pages for logins you do not recognize.
- Review bank and card statements and set up transaction alerts.
- If anything looks wrong, follow the guidance on hacked account response.
When to contact others
- Your internet provider. They can check the line, confirm whether the router is theirs to manage, and advise on resets. They can also tell you if your account shows unusual usage.
- Your bank or card issuer, if you notice unauthorized charges.
- Local police, if you believe a crime has taken place, or if you feel threatened or are being harassed or stalked. Contact local emergency services if anyone is in immediate danger.
If the unauthorized user turns out to be someone you know, such as a neighbor who had the password from an earlier arrangement or a former partner, the same steps apply. If a situation involves control or intimidation, consider seeking support from a trusted person or a local support organization.
A realistic view
In many cases, a suspected stranger turns out to be a forgotten gadget or an ordinary slowdown. When it is a genuine intruder, the steps above remove access promptly. No method offers a guarantee, but changing passwords, updating the router and keeping an eye on the device list handle the large majority of ordinary cases.