Home router or Wi-Fi hacked

What this means

Your router sits between your home and the internet. Someone controlling it can change where devices look for websites, open remote access, weaken Wi-Fi security, or keep unknown devices on your network.

An unfamiliar device does not automatically mean an attacker. Phones use private addresses, visitors reconnect, and smart devices have unhelpful names. Look for changed settings and repeated unknown connections before assuming the worst.

Warning signs

• The router’s administrator password no longer works.
• DNS, remote-management, port-forwarding, or Wi-Fi settings changed without you.
• Unknown devices return after you block them.
• Browsers redirect to unexpected pages on several home devices.
• The router uses WEP, has no supported firmware updates, or still uses its factory administrator password.

Recover now

First 15 minutes

1. Disconnect the router’s internet cable. Leave its power on so you can inspect it without exposing it to the internet.
2. Use mobile data to secure your email and router-provider account. Do not change important passwords through a network you think is compromised.
3. Photograph the router label and current settings. Record its model, firmware version, DNS servers, remote-management setting, port forwards, and connected devices.
4. Check the manufacturer’s support page. Confirm that the model still receives security updates and download the current setup instructions using a trusted device.
5. Prepare for a factory reset. Find the provider login, Wi-Fi details, and any settings needed by phones, cameras, printers, or smart-home equipment before erasing anything.

Today

1. Factory-reset the router using its physical reset control. Do not restore an old configuration if you do not know when the compromise began.
2. Install current firmware before reconnecting ordinary devices. Replace the router if the manufacturer no longer supports it.
3. Set a new router-administrator password and a different new Wi-Fi password. Use WPA3 Personal, or WPA2 Personal if WPA3 is unavailable.
4. Turn off remote management, WPS, and UPnP unless you know why a device needs them. Remove unknown port-forwarding and DNS entries; use your provider’s default DNS or a trusted service you chose yourself.
5. Reconnect devices a few at a time. Update them and change any factory passwords, starting with cameras, doorbells, storage boxes, and smart-home hubs.
6. Review email and financial accounts if you entered passwords or payment details while redirects were happening.

Verify recovery

• The administrator page accepts only the new password.
• Firmware is current and the model is still supported.
• Wi-Fi uses WPA3 or WPA2, and WEP is unavailable.
• Remote management, WPS, unwanted UPnP, and unknown port forwards are off.
• Every connected device is recognized after a full day of normal use.
• DNS settings remain unchanged after a restart.

Prepare now

Router settings

• The administrator password and Wi-Fi password are strong, unique, and different from each other.
• WPA3 Personal or WPA2 Personal protects the network.
• Automatic firmware updates are on, or a calendar reminder checks for updates every three months.
• Remote management and WPS are off.
• The router firewall is on.

Keep devices apart

• Visitors and untrusted smart devices use a guest network.
• The connected-device list has been reviewed once, so familiar devices are recognizable later.
• The router model, support page, provider details, and current configuration are stored offline.
• A replacement is planned before the router reaches the end of security support.

Common mistakes

• Changing only the Wi-Fi password. Someone with the administrator password can change it back or create another route in.
• Restoring the suspect configuration. A backup can restore the malicious DNS or remote-access setting too.
• Using WEP because an old device needs it. Put the old device on a separate network or replace it. WEP does not provide useful protection.
• Blocking one unknown device and stopping. The entry point may still be open, and private device addresses can make the same phone look new.
• Resetting before saving provider details. The reset can leave you offline with no way to look up the configuration you need.

Sources

• FTC: How to secure your home Wi-Fi network
• FTC: Securing internet-connected devices at home
• CISA: Using wireless technology securely