Router security checklist for home networks

Your router is the front door, the doorbell and the post office of your home network, and it runs software that nobody remembers to update. This checklist gives every lock a test you can run in a few minutes.

The short answer

How do you secure a home router? Work through these checks in order: confirm that the model still gets updates, change the admin password, switch off remote access you do not use, use WPA2 or WPA3 with a long Wi-Fi password, turn off the WPS PIN, review UPnP and port forwardings, keep the firewall on, and move guests to the guest network. These are the points the German Federal Office for Information Security (BSI) names for home routers [1][2][3]. Replace the router only when the manufacturer says updates have ended or the device cannot do WPA2 or WPA3. A review, a new Wi-Fi standard or a feeling of "old" is not evidence.

How it works

1. Know what you have. Read the model name and hardware version off the label on the device. Note whether you own it or your internet provider supplied it. On a provider-supplied FRITZ!Box the Update menu is missing, because the provider installs new FRITZ!OS versions automatically [6]. Check: write model, hardware version and the owner of the device on a note. Every later step needs them.
2. Updates are check number one. Updates close known vulnerabilities, and the BSI advises switching on automatic updates where the router offers them [1]. If your router has no automatic function, check regularly and subscribe to the manufacturer's newsletter, which can announce firmware early [3]. FRITZ!Box models install new FRITZ!OS some weeks after release in the default setting, called Auto-Update level III [6]. Telekom Speedport routers install firmware automatically at night when switched on and online; the Speedport 7 does updates only that way, and other models only if the EasySupport function is on [18]. Check: open the router's update page (on a FRITZ!Box: System, Update, then the button to search for a new FRITZ!OS [6]), note the installed version and compare it with the newest version the manufacturer lists for your model. AVM also lists the security fixes of each FRITZ!OS version on a separate page, so you can see what an update closes [9].
3. Find the end of support before it finds you. An up-to-date router that no longer receives fixes is still a router with known holes next year. The BSI asks buyers to prefer manufacturers that have delivered software updates for at least five years in the past [3]. Its technical guideline TR-03148 for manufacturers expects them to publish how long they fix serious vulnerabilities and to show in the router's interface when support has ended [4]. Whether your model follows that is something to check, not to assume. The next section shows where each brand keeps this information. Check: find the manufacturer's statement for your exact model and hardware version, and write down the page and the date.
4. Admin password and user. Default passwords such as "admin" are known to attackers, so change them at once; the longer the new one, the better [1]. If the interface offers HTTPS inside your network, use it, and log out when you are done [3]. AVM advises individual user names on a FRITZ!Box, nothing guessable like admin, guest, fritzbox, remote or user, and a password you use nowhere else; a password manager helps [7]. Check: log out and back in with the new data. On a FRITZ!Box, System, Event Log, System (German interface: System, Ereignisse, System) lists every login with user name, IP address and time [7][26].
5. Remote access: off unless you need it. The BSI says to switch off features such as remote access when you do not use them, because they can be an entry point [1]. If you truly need it, the CSBW factsheet from Baden-Württemberg recommends having a skilled person set it up [5], and the BSI asks for HTTPS and a stronger password in that case [3]. On a FRITZ!Box, Diagnostics, Security, section FRITZ!Box Services (German interface: Diagnose, Sicherheit) shows which services are reachable from the internet; switch off the ones you do not use, but note that the HTTPS access is needed for MyFRITZ!Net [7][26]. TP-Link advises against its remote management function and points to its Tether app instead [14]. Check: from a device on mobile data, not on your Wi-Fi, try to open the router's login page via your public address. The example section shows a port scan for this.
6. Wi-Fi encryption. The BSI names WPA2 and WPA3 as the currently most secure Wi-Fi encryption and says that a router supporting neither should be replaced by a newer model [1]. The CSBW factsheet recommends the combined WPA2 plus WPA3 mode, WPA2 with CCMP on older models, and never the outdated WPA or WEP [5]. Check: look at the Wi-Fi security page of the router. On Linux, nmcli device wifi list shows a SECURITY column for each network in range [25]. We could not confirm from the manual how WPA3 is labelled there, so treat the router page as the main check.
7. Wi-Fi password and network name. The Wi-Fi password is not the router password. The BSI advises at least 20 unrelated characters, different from the admin password, and a change if yours is shorter [1]. The same figure appears in BSI-CS 131 [3]. The network name should not tell attackers your router model or your name [1]. Check: count the characters, and make sure the Wi-Fi key and the admin password differ.
8. WPS. Wi-Fi Protected Setup is the button or PIN that connects devices without typing the password. The BSI lists the WPS PIN method among the services to switch off [3]. The CSBW factsheet allows only the push-button method, because holes keep turning up in the other variants [5]. BSI TR-03148 says PIN-based WPS may only exist if it is off in the initial state and a new PIN is made per device [4]. A document from the Austrian federal security portal about FRITZ!Box advises switching WPS off right after adding repeaters and using the button lock so nobody can add a device by pressing keys [22]. Check: find the WPS setting on the Wi-Fi page. No PIN option should be active.
9. UPnP. UPnP lets devices on your network ask the router to open ports on their own. BSI-CS 131 names UPnP-IGD, together with the WPS PIN, among the services that should normally be disabled [3]. The price is that some consoles, games and peer-to-peer tools stop working properly; our glossary entries on UPnP and NAT type explain what then happens. On a FRITZ!Box the permission is a setting per device, to create port releases on its own via UPnP or TR-064 [11]. Check: list the current mappings. On Linux, the tool upnpc -l (package miniupnpc) lists the redirections the router reports [23]. The router's own list of port releases shows them too.
10. Port forwardings and exposed hosts. A forwarding opens a gate in the firewall, and the device behind it can then be reached directly from the internet [10]. The BSI says to review configured forwardings regularly and deactivate those you no longer need [3]. AVM added a risk hint to FRITZ!OS for forwardings of port 80 or 443 [11]. Check: open the list (on a FRITZ!Box: Internet, Permit Access; German interface: Internet, Freigaben [12][7][26]) and delete every entry you cannot explain. Our assessment: if you want to reach home from outside, one forwarding for a VPN server such as WireGuard is safer than five forwardings for five services; our guide on WireGuard and Tailscale compares both options.
11. Firewall and unneeded services. The BSI says to check that the firewall is on and that the box "Internet access to router" is not ticked [1]. A FRITZ!Box blocks unsolicited incoming data by default, keeps all TCP and UDP ports closed, and hides devices behind NAT [10]. Beyond that, the BSI wants every service you do not need switched off, such as a media server or the router's NAS function, and recommends call barring for foreign and premium numbers, preferably at the provider, because that also works if the router is compromised [3]. AVM gives the same advice for telephony [7]. Check: the router's list of active services, and the call barring list.
12. Guest network. Guests get their own Wi-Fi so they cannot see your computers and your banking [1]. According to the Austrian portal, devices on a FRITZ!Box guest network have only internet access and are isolated from the main network, and the guest network should be as well secured as the main one; do not run it as a public hotspot [22]. The BSI adds to switch it off when nobody needs it and to change its key more often [3]. Check: join the guest network with a phone and try to open the router login and a device in your main network. Both must fail. If you need to separate more than guests, for example smart-home devices, our VLAN guide goes further.
13. Replace or keep? Buy a new router only on evidence. Evidence one: the manufacturer states that your model is end of life, end of support or end of maintenance. TP-Link and ASUS say in their policies that they recommend a new product once a model is off the market [13][16]. Evidence two: the router cannot do WPA2 or WPA3, which the BSI calls a reason to switch [1]. Not evidence: a missing Wi-Fi standard, a poor review, a model age without a statement. If the manufacturer gives no date, as AVM currently does not [21], treat the situation as unknown, ask the manufacturer's support in writing and set a reminder. A rented router is the provider's job; ask the provider.
14. Keep it that way. Settings drift: a firmware update, a new console or a visitor can change them. Check: put one date a quarter in your calendar, repeat the update check, the forwarding list, the UPnP list and the outside test, and write down the result. A FRITZ!Box can also mail you when someone logs in from the internet [7].

Where the update evidence lives

Update periods come from the manufacturer or not at all. The table shows where each brand keeps them, as of 25 Oct 2026. Pages are partly regional; check the page of your own country.

A worked example

This is an example, not a report on our network. We make no statement about which router Bytearium uses or about its state. Assume a FRITZ!Box with a recent FRITZ!OS. Menu names change between versions, so follow the logic if a label differs.

1. Update check: System, Update, search for a new FRITZ!OS, note the version [6].
2. Security overview: Diagnostics, Security, section FRITZ!Box Services; switch off what you do not use [7][26].
3. Port sharing: Internet, Permit Access; delete forwardings you cannot explain [7][12][26].
4. Wi-Fi: check encryption, key length, WPS and the guest network on the Wi-Fi pages [22].
5. Outside test: switch your phone to mobile data, switch Wi-Fi off, look up your router's public address on its status page, and run from a laptop on that other connection, against your own address only:

nmap -Pn -p 80,443,8080,8443 203.0.113.7

Replace the documentation address 203.0.113.7 with your own public address. Nmap reports each port as open, closed or filtered; open means something answers, filtered means a firewall blocks it [24]. You want no open port you cannot explain. From inside your network, check what the router has opened on its own:

upnpc -l

The output lists redirections with external port, protocol and internal host [23]. An empty list is a good sign; an entry from a game you uninstalled is a reason to find the device. Finish with the guest test from item 12 and write down date and results.

Checklist

• Read model and hardware version from the label, and note whether you or your provider own the router.
• Install the current firmware and switch on automatic updates where available.
• Find the manufacturer's statement on updates or end of support for your exact model, and write down the page and the date.
• Change the admin password and use an individual user name, not admin.
• Switch off remote access to the router unless you need it, and test from a mobile data connection that the login page does not answer.
• Set WPA2 or WPA3, never WEP, WPA or open Wi-Fi.
• Set a Wi-Fi password with at least 20 unrelated characters that differs from the admin password.
• Disable the WPS PIN, and use the button method only for the moments you add a device.
• Review UPnP, test with upnpc -l and delete or forbid mappings you cannot explain.
• Delete forwardings you do not need, and prefer one VPN forwarding over many service forwardings.
• Keep the firewall on, and switch off services such as media server, NAS function and unused telephony features.
• Move guests and visitors to the guest network, and prove with a phone that it cannot reach the main network.
• Buy a new router only if the manufacturer states end of support or the router lacks WPA2 and WPA3.
• Repeat the checks every quarter and write down the date.

Related pages: UPnP automatic port mapping; VLANs at home: separating IoT and guests; WireGuard or Tailscale for reaching your homelab; NAT type on consoles and games; WPA3 Wi-Fi security; Exposed host (router). More on the topic in the IT security section. Two guides continue where the router ends: Passkeys and 2FA: secure your accounts; Home firewall: OPNsense or pfSense?