Update your home router’s firmware, change the default admin and Wi-Fi passwords, and turn on modern encryption (WPA3 or WPA2). The FTC’s home Wi-Fi guidance puts router software updates and unique admin credentials at the center of a safe household network — this is not the same as a quick “is my Wi-Fi safe” checklist or a guest network how-to. Buy-nothing is valid: a patched router plus good passwords beats buying another app first.

Why router updates matter

Your router is the front door for every phone, laptop, camera, and smart TV on the network. Outdated firmware can leave known bugs open; a default admin password lets someone change your settings and undo the rest of your hardening.

The FTC advises: keep the router up to date, change default admin and network names/passwords, encrypt with WPA3 Personal or WPA2 Personal, turn off convenience features that weaken security when you do not need them, and set up a guest network for visitors.

Step-by-step: find the admin page and update firmware

Manufacturer menus differ, but the sequence is the same for most U.S. home routers and ISP gateways.

  1. Find the router brand and model. Check the sticker on the device or the box. Note whether it came from your ISP (Comcast/Xfinity, Verizon, AT&T, Spectrum, etc.).
  2. Connect on your home network. Use Ethernet if you can; Wi-Fi works if you already know the current Wi-Fi password.
  3. Open the admin page. Common addresses are 192.168.1.1, 192.168.0.1, or a brand URL printed on the sticker. Search “[manufacturer] router admin login” if the sticker is missing.
  4. Sign in with the admin password (this is different from the Wi-Fi password you type on phones). If you never changed it, look for the default on the sticker — then change it immediately after you update.
  5. Check for firmware / software updates in the admin UI (often under Administration, System, or Advanced). Prefer the manufacturer’s or ISP’s published update. The FTC says: before you set up a new router or change settings, visit the manufacturer’s site for a newer software version; register the router and sign up for update notices when offered. If the ISP owns the gateway, ask whether it pushes automatic updates.
  6. Install the update and wait. Do not unplug the router mid-update. Reconnect and confirm the new firmware version shows in the admin status page.
  7. Log out of the admin account when you finish. The FTC specifically warns not to leave the admin session open.

Harden settings after the update

Firmware alone is not enough. Apply these FTC-aligned settings while you are still in the admin UI.

Encryption

  • Set Wi-Fi security to WPA3 Personal when available, otherwise WPA2 Personal.
  • If the router only offers old WPA or WEP, try a firmware update again; if those remain the only options, the FTC says consider a newer router.

Passwords and name

  1. Change the Wi-Fi network password to a long unique passphrase.
  2. Change the router admin password to a different long unique passphrase (not your name, address, or the router brand).
  3. Change the default network name (SSID) to something that does not advertise the brand or your family name.

Features to turn off when you do not need them

  • Remote management (admin over the internet)
  • Wi-Fi Protected Setup (WPS) push-button join
  • UPnP if you do not rely on it for a specific device

Extras that help

  • Turn the router firewall on if it has a switch.
  • Create a guest Wi-Fi network with a separate password so visitors never learn the main passphrase.

FAQ

How often should I update home router firmware?

Check the manufacturer or ISP after you buy or move, then whenever they publish a security update. Register the device so notices reach you. ISP-managed gateways may update automatically — confirm with the provider.

Is updating the router the same as running antivirus on my PC?

No. Router firmware protects the gateway. PC protection is separate; Microsoft Defender is enough for many home PCs.

What if I cannot open 192.168.1.1?

Confirm you are on that router’s network, try the other common LAN IPs, or use the brand’s admin URL from the sticker. Still stuck: contact the manufacturer or ISP rather than following random “fix” download sites.

Do I need a VPN at home if the router is patched?

A patched, encrypted home Wi-Fi with unique passwords is the baseline the FTC describes for home networks. A VPN is a different tool (more relevant on untrusted public networks — see banking apps on public Wi-Fi). Do not buy a VPN to skip router updates.

Will a firmware update erase my Wi-Fi password?

Sometimes settings reset. Re-check encryption mode, SSID, Wi-Fi password, admin password, guest network, and remote management after every major update.

Router updates and passwords are free. They do not replace careful browsing or device protection, and they are not a reason to buy a second real-time antivirus engine next to Defender. If the household later wants a paid multi-device suite, use only these on-site paid links: TotalAV, Norton, Bitdefender, McAfee, Avast.