This guide walks through the settings that matter, in rough order of importance. None require special software: just the router’s admin page and half an hour. If you haven’t changed your admin password yet, start with our home WiFi guide and come back.

1. Firmware updates: the unglamorous big one

Router firmware is software, software has bugs, and some bugs let attackers in without a password. Routers sit between every device you own and the internet, which makes them a permanent target: whole botnets exist purely from compromised routers.

Check the admin page for a section called Firmware Update, System Update or Administration. Newer routers check for updates themselves; just switch auto-update on. Older routers need you to download a file from the manufacturer’s support page and upload it. Match the exact model number printed on the router’s label, not the brand alone. Then set a calendar reminder every three months.

If the manufacturer hasn’t released an update in years, that’s a sign the router itself is due for replacement. Security support for routers ends, just like it does for phones.

2. Remote administration: off

Settings named “Remote Management”, “Web Access from WAN” or “Remote Administration” let you reach the router’s admin page from the internet. Unless you deliberately use that (and even then, better options exist), turn it off. Scanners find exposed router logins constantly, and “protected” isn’t the word for a login page the whole internet can knock on.

3. UPnP: off, with one caveat

UPnP (Universal Plug and Play) lets applications on your network open ports in the router’s firewall automatically, without asking you. Games consoles and video calls use it for convenience. So does malware: anything on your network can quietly punch a hole to the internet through UPnP.

Turning UPnP off is one of the highest-value changes you can make. The cost: some applications that rely on it need manual port forwarding instead. Set up the one or two forwards you actually need, by hand, and leave everything else closed.

4. DNS: a free upgrade with security benefits

Your router forwards every domain lookup on your network. Point it at a filtering DNS service and known malicious domains get blocked for every device, including the smart TV and the tablet that has no antivirus. Two well-known options:

• Cisco OpenDNS FamilyShield: 208.67.222.123 and 208.67.220.123. Blocks phishing and adult content.
• Cloudflare for Families: 1.1.1.3 (malware + adult) or 1.1.1.2 (malware only). Fast and privacy-focused.

Change it in the router’s LAN/DHCP or Internet settings under DNS. It’s the closest thing to free network-wide protection you’ll find.

5. Check what’s connected

Most admin pages list every device on the network, by name and MAC address. Sit down with that list once. Anything you don’t recognise deserves a question: is it the printer’s second network card, or is it a device that shouldn’t be there? While you’re there, look for features like “new device must be approved before joining” if your router has them.

6. Small settings that matter

• Disable WPS (see our home WiFi post for why).
• Turn off “cloud” features you don’t use. Some routers want an app account. If you don’t use the app’s remote features, don’t create the account.
• Set a strong WiFi password with WPA2/WPA3, covered in our encryption guide.

Business networks are a different animal

Everything above applies at the office too, with higher stakes: VLANs to separate departments, managed switches, firewall rules for remote workers, and monitoring when something starts acting oddly. An IT audit is the quickest way to get a clear picture of what you’ve got and what needs attention; that’s exactly the kind of assessment we run for businesses across the Helderberg.

Related guides

• Secure your home WiFi: 7 weak spots to fix
• Firewalls: the guard at your network’s gate
• Do you need a VPN? What VPNs actually do