A Year-End Check for Your Home Wi-Fi Router
The box behind the TV may be years out of date. Check its age, admin password, encryption and remote access, and know when to replace it, per FTC and FBI.
Nobody thinks about the router until the Wi-Fi drops. It sits between every device in the house and the internet, and many homes have never changed the settings on it. Here is a one-sitting check, with a clear rule for when to retire the box.
Start with the rule, because it changes what you do next. On May 7, 2025, the FBI’s Internet Crime Complaint Center warned that “routers dated 2010 or earlier likely no longer receive software updates issued by the manufacturer,” and that some end-of-life routers with remote administration turned on were found compromised by a new variant of TheMoon malware. A router that no longer gets updates can’t be fixed by changing a setting.
Find out what you have
- Read the model number on the label on the router.
- Search the maker’s own support site for that model and look for the most recent firmware date and any end-of-support notice.
- If your internet provider supplied it, ask the provider whether it updates the router automatically, as the FTC suggests. Ask whether a newer model is available under your plan.
| What you find | Decision |
|---|---|
| Recent firmware, supported model | Keep it; do the settings below |
| Update available | Install it first, then do the settings |
| Only WPA or WEP encryption after updating | Replace it; the FTC says to consider a new router if WPA2 or WPA3 isn’t available |
| Maker says support has ended, or no updates in years | Replace it; the FBI’s advice for end-of-life devices is to swap them for a supported model |
| Router is provider-supplied and old | Ask the provider for a current model |
The settings, in the FTC’s terms
The FTC’s home Wi-Fi guide is unusually specific. Most router apps or admin pages have these options under Settings or Wireless. Do them while you’re connected to Wi-Fi at home, and write down the new details as you go.
Admin login
“Change the default administrative username, password, and network name to something unique.” Leave your name, address and the router brand out of them.
Encryption
Choose “WPA3 Personal or WPA2 Personal.” The FTC calls WPA3 the newest and best option if your devices support it.
Remote management
“Turn off ‘remote management,'” along with WPS and UPnP, if you don’t need them. The FBI gives the same advice on remote administration.
Guest network
“Set up a guest network” with its own name and password, for visitors and smart devices.
When you finish, the FTC says to “Log out as administrator” so a hacker can’t change your security settings. The FBI also recommends long, random, unique passwords that aren’t reused. A password manager can create and store them, and our 20-minute cleanup gets you started.
Why a guest network matters at the holidays
When relatives arrive, the Wi-Fi password gets shared around. A guest network lets you hand over a password that doesn’t reach your computers or printer. The FTC notes it limits who knows your main password and keeps malware on a guest’s device off your primary network. It’s also the natural home for the smart camera or speaker someone just gave you; our camera setup guide covers those.
Warning signs worth a closer look
A slow connection is usually just a slow connection. Treat these as more significant:
- You can’t log in to the admin page with a password you know is right.
- Settings you didn’t change have changed.
- An unfamiliar device name appears in the connected list, and nobody in the house can claim it.
- Browsing suddenly lands on odd pages even on trusted sites.
The FBI’s response for suspicious activity: update firmware, change passwords and reboot. If the router is end-of-life, replace it.
When you buy a replacement
Avoid the temptation of the cheapest box on a shopping site. Look for WPA3 support, automatic updates and a maker that publishes support periods. Set it up with the steps above from the first boot. Then reset the old router to factory settings before recycling it, since it may still hold your Wi-Fi password and account details.
Working from a hotel or a relative’s house
You won’t control the router everywhere you connect this season. Our report on attacks on hospitality Wi-Fi explains why a hotel sign-in page that asks for your email password is a stop sign.
Add it to the calendar
Once a year is enough for most homes. Pick a date you’ll remember, such as the first Saturday of December, check for a firmware update and read the device list. It takes five minutes after the first pass.
Common mistakes that undo the work
- Writing the new password on the router. Anyone who visits can read it. Keep it in a password manager, or on paper somewhere private.
- Reusing the Wi-Fi password as the admin password. The FTC treats these as separate things, and guests should only ever know the Wi-Fi one.
- Forgetting the second box. A separate modem, mesh satellite or old extender may have its own admin login and its own firmware.
- Skipping the admin password because the app handles everything. Check the app’s account too, and turn on two-step sign-in if it’s offered.
If someone else set it up
If a relative or installer configured your router years ago, you may not have the admin password at all. Most routers can be reset to factory settings with a recessed button, after which you log in with the details on the label and set new ones. Check your model’s support page first, because a reset also wipes the Wi-Fi name and password your devices rely on.