Lock down your router: the settings that matter

The checklist

1. Change the router's own password. This is the "admin" password for the settings page, not the Wi-Fi password. On many TP-Link routers it is under Advanced, then System, then Administration. On others, look for Administration, Maintenance or Account.
2. Turn off Remote Management. Also called Web Access from WAN or Remote Access. It lets people outside your home sign in to the router. Almost nobody needs it.
3. Check the Port Forwarding list. It may be called Virtual Server or NAT. Each line is a door your router opens to the outside. Delete anything you did not set up on purpose.
4. Turn off UPnP. It lets apps open doors on their own. If a game or app stops working afterward, turn it back on.
5. Turn on automatic updates. Look for Firmware, Router Update or Auto Update. If there is no automatic option, check for updates every few months. If the maker no longer updates your model, it is time to replace the router.
6. Use a guest network for visitors and smart gadgets. Put TVs, cameras and smart plugs on it, so they are kept apart from your computers.
7. Check your Wi-Fi security. Choose WPA3 or WPA2, never "Open" or "WEP", and use a long password that is not easy to guess.
8. Look at the list of connected devices. It is often called Attached Devices or Client List. If you see a device you do not recognize, see Which device is this?

Where to look on common routers

• Netgear: sign in at routerlogin.net. Look under Advanced, then Advanced Setup (or Administration), for Remote Management, Port Forwarding and UPnP.
• TP-Link: sign in at tplinkwifi.net. Look under Advanced, System, Administration for Remote Management, and under NAT Forwarding for Port Forwarding and UPnP.
• ASUS: sign in at router.asus.com. Administration, then System, has Enable Web Access from WAN (set it to No). WAN, then Virtual Server / Port Forwarding, lists the doors.
• Linksys: sign in at 192.168.1.1 or myrouter.local. Look under Security or Administration for Remote Management, and under Security or Apps for port forwarding.
• Google Nest Wifi or eero: you manage these in the phone app. Look for port management or UPnP in the network or advanced settings. These do not normally have a remote settings page.
• A modem or gateway from your internet company: sign in with the address and password on its label, or use your provider's app. If you cannot find the setting, call them and ask them to turn off remote management and any port forwards you did not set up.

Using the phone app instead

Google Nest Wifi, eero, Xfinity and Spectrum are mostly set up in a phone app. The same ideas apply. Look for Settings, then Advanced, Security or Network, and for the words in the list above.