Your router is the hub for all of the devices on your home network, and helps protect all of the devices on your network against attack from the Internet. Here are some ways you can make sure your security is in tip-top shape.

This Cybersecurity Awareness Week article is brought to you in association with Incogni.

Disable Remote Access

Routers offer a web interface, allowing you to configure them through a browser. The router runs a web server and makes this web page available when you're on the router's local network.

However, most routers offer a "remote access" feature that allows you to access this web interface from anywhere in the world. Occasionally glitches or firmware problems have cropped up that make routers with remote access enabled vulnerable to attack. If you have remote access disabled, you'd be safe from people remotely accessing your router and tampering with it.

To do this, open your router's web interface and look for the "Remote Access," "Remote Administration," or "Remote Management" feature. Ensure it's disabled — it should be disabled by default on most routers, but it's good to check.

Update the Firmware

Like our operating systems, web browsers, and every other piece of software we use, router software isn't perfect. The router's firmware — essentially the software running on the router — may have security flaws. Router manufacturers may release firmware updates that fix such security holes, although they quickly discontinue support for most routers and move on to the next models.

Most newer routers have an auto-update feature like Windows and our web browsers do. However, if your router is a bit older, you may have to check your router manufacturer's website for a firmware update and install it manually via the router's web interface. Check to be sure your router has the latest available firmware installed.

Change Default Login Credentials

Many routers have default login credentials that are fairly obvious, such as the password "admin". If someone gained access to your router's web interface through some sort of vulnerability or just by logging onto your Wi-Fi network, it would be easy to log in and tamper with the router's settings.

To avoid this, change the router's password to a non-default password that an attacker couldn't easily guess. Some routers even allow you to change the username you use to log into your router.

Lock Down Wi-Fi Access

If someone gains access to your Wi-Fi network, they could attempt to tamper with your router — or just do other bad things like snoop on your local file shares or use your connection to downloaded copyrighted content and get you in trouble. Running an open Wi-Fi network can be dangerous.

To prevent this, ensure your router's Wi-Fi is secure. This is pretty simple: Set it to use WPA2 or WPA3 encryption and use a reasonably secure passphrase. Don't use the weaker WEP encryption or set an obvious passphrase like "password".

Disable UPnP

A variety of UPnP flaws have been found in consumer routers. Tens of millions of consumer routers respond to UPnP requests from the Internet, allowing attackers on the Internet to remotely configure your router. Flash applets in your browser could use UPnP to open ports, making your computer more vulnerable. UPnP is fairly insecure for a variety of reasons.

To avoid UPnP-based problems, disable UPnP on your router via its web interface. If you use software that needs ports forwarded — such as a BitTorrent client, game server, or communications program — you'll have to forward ports on your router without relying on UPnP.

Log Out of the Router's Web Interface When You're Done Configuring It

Cross site scripting (XSS) flaws have been found in some routers. A router with such an XSS flaw could be controlled by a malicious web page, allowing the web page to configure settings while you're logged in. If your router is using its default username and password, it would be easy for the malicious web page to gain access.

Even if you changed your router's password, it would be theoretically possible for a website to use your logged-in session to access your router and modify its settings.

To prevent this, just log out of your router when you're done configuring it -- if you can't do that, you may want to clear your browser cookies. This isn't something to be too paranoid about, but logging out of your router when you're done using it is a quick and easy thing to do.

Change the Router's Local IP Address

If you're really paranoid, you may be able to change your router's local IP address. For example, if its default address is 192.168.0.1, you could change it to 192.168.0.150. If the router itself were vulnerable and some sort of malicious script in your web browser attempted to exploit a cross site scripting vulnerability, accessing known-vulnerable routers at their local IP address and tampering with them, the attack would fail.

This step isn't completely necessary, especially since it wouldn't protect against local attackers — if someone were on your network or software was running on your PC, they'd be able to determine your router's IP address and connect to it.

Install Third-Party Firmwares

If you're really worried about security, you could also install a third-party firmware such as DD-WRT or OpenWRT. You won't find obscure back doors added by the router's manufacturer in these alternative firmwares.

If you're feeling particularly ambitions, you can even build your own router using an old (or new) computer using a high-end network interface card and software like pfSense or OPNsense.

Consumer routers have improved substantially in the last ten years. They usually have automatic firmware updates, more routers now force users to change their default passwords, they're more feature-rich, and new security protocols are undoubtedly superior to older ones. Despite all of the improvements, routers (and modem-router combo units) still represent a prime target for malicious attacks, especially if your security is lax. Do yourself a favor — take 15 minutes and make sure you're doing everything you can to keep your network secure.