Think your router was hacked? What to do
In short: Slow or odd internet usually has an ordinary cause. If you still have a reason to worry, the FBI and CISA give a short list of steps, and the first ones are simple.
First, some calm
Slow or odd internet has many ordinary causes: a busy Wi-Fi channel, a failing cable, a provider outage, or one device hogging bandwidth. Our is my router hacked page goes through the real signs. If you still have a reason to worry, the FBI and CISA give a short list of steps, and the first ones are simple.
Signs the FBI lists
The FBI says: "Commonly identified signs of malware infections on routers include overheating devices, problems with connectivity, and changes to settings the administrator does not recognize." The first two have many harmless causes. The third, a setting you did not change, is worth checking.
Steps, in order
- Write down what you see. Note the odd behavior and any settings that look changed. This is our suggestion, and it helps if you ask for help later.
- Update, change the password and restart. The FBI says: "If you believe there is suspicious activity on any device, apply any necessary security and firmware updates, change your password, and reboot the router."
- Turn off remote management. The FBI: "Login online to the router settings and disable remote management/remote administration, save the change, and reboot the router."
- Disconnect, restart, then change the password first. This is CISA's advice for one known infection, Mirai: "Disconnect device from the network." Then, because "Mirai malware exists in dynamic memory, rebooting the device clears the malware." CISA stresses the order: "If you reconnect before changing the password, the device could be quickly reinfected with the Mirai malware." That advice is about Mirai specifically. The FBI notice does not say whether other malware survives a restart.
- Replace the router if it is no longer supported. The FBI: "If the router is at end of life, replace the device with an updated model if possible." See how long a router should last.
A factory reset, which wipes the router's settings back to how it came, is a common next step. The FBI and CISA notices we read do not mention it. If you do it, you have to set the router up again, and you should change the default password straight away.
Accounts and reporting
The FBI's notice has a section for victims: "If you suspect you are a victim of a proxy service or your personal information has been compromised," it says to "File a complaint with the FBI Internet Crime Complaint Center (IC3)" at ic3.gov. It also says: "Contact your account provider immediately to regain control of your accounts, change passwords, and place alerts on your accounts for suspicious login attempts and/or transactions."
What Network Check can and cannot tell you
The free check cannot tell whether a router is compromised. It only shows which common doors answer from the internet. A clear result does not rule out a problem, and an open door does not prove one. If you want help reading your result, see the support page, or read what a check can and cannot see.
Run the free checkSources
- FBI Internet Crime Complaint Center, "Cyber Criminal Proxy Services Exploiting End of Life Routers" (alert I-050725-PSA, May 7, 2025): ic3.gov
- CISA, "Heightened DDoS Threat Posed by Mirai and Other Botnets" (alert TA16-288A, released October 14, 2016, now archived): cisa.gov
Quotes are copied from those pages. We read them directly on November 8, 2026. Agencies revise and archive pages, so check the originals for anything you plan to rely on.