Your router is the front door to everything you own

Most of us think of the router as that little box in the corner that we forget about until the internet drops out. In reality, it is the gateway to every laptop, phone, tablet, smart speaker, doorbell and games console in your home. If someone gets past it, they are not just stealing your broadband — they can reach your files, your backups and, in the worst cases, your bank details.

The good news is that the vast majority of intruders are opportunists. They scan for networks left on factory settings, with weak passwords and outdated software, because those are easy targets. Spend half an hour on the steps below and you will be a far less attractive proposition.

Change the two passwords people forget

There are two separate passwords on your router, and both matter. The first is the Wi-Fi password your devices use to connect. The second is the admin password you use to log into the router's settings page itself. Many people change the first and never touch the second.

To reach the settings, type your router's address into a browser — commonly something like 192.168.0.1 or 192.168.1.1, and the address is usually printed on a sticker underneath the unit. Log in with the details on that same sticker, then change them.

• Use a passphrase of at least 12 characters: three unrelated words plus a number works well and is easier to remember than random symbols.
• Never reuse your Wi-Fi password for the admin login. If one is guessed, you do not want the other to fall with it.
• Write the new details down and keep them somewhere physical, not in a note on the device you are trying to protect.

Switch on proper encryption

Inside the wireless settings you will find a security option. You want WPA2 at minimum, and WPA3 if your router offers it — that is the current standard and it closes several weaknesses in older methods.

If you still see WEP or "open" listed, change it today. WEP can be cracked in minutes with free tools, and an open network means anyone nearby can read your traffic. While you are in there, check that your network name, the SSID, does not include your house number, flat or surname. There is no need to advertise which door is yours.

Update the firmware, then diarise it

Router firmware is the software that runs the device, and manufacturers release updates to patch security holes. An unpatched router is the single most common way home networks get compromised.

Log into the admin panel and look for a firmware or update section. Some routers check automatically, but do not assume yours does. If there is a manual check button, press it. If an update is available, install it and let the router reboot — this can take a few minutes.

• Set a repeating reminder every three months to check again.
• If your router is more than five or six years old and no longer receives updates, consider replacing it. A router without security patches is a liability.
• Never install firmware from an email attachment or a random download page. Only use the manufacturer's own update tool.

Turn off the features you are not using

Routers ship with convenience features switched on that you probably do not need. Each one is a potential way in.

• WPS lets you connect devices with a push of a button or an eight-digit PIN. The PIN method has been shown to be brute-forceable, so switch WPS off unless you actively rely on it.
• Remote administration allows you to manage the router from outside your home. Unless you genuinely need it, disable it.
• UPnP lets programs open ports automatically. It is handy for gaming, but it can also let malicious software punch holes in your firewall. Turn it off if you can live without it.
• Guest networks are worth keeping, though. Put visitors, smart plugs and cheap gadgets on the guest network so they cannot see your main devices.

Keep an eye on what is connected

Most routers list connected devices somewhere in the settings, often under "attached devices", "clients" or "DHCP leases". Have a look every so often. If you spot a name you do not recognise, investigate it: check the device list, and if it is genuinely unknown, change your Wi-Fi password, which will kick everything off and force you to reconnect only your own kit.

Finally, remember that the network is only as strong as the devices on it. Keep your computers and phones updated, use a screen lock, and be sceptical of unexpected emails asking you to log in somewhere. A well-configured router plus sensible habits is a genuinely strong combination — and it takes far less time than clearing up after a break-in.