The Most Common Router Security Mistakes

Most home and small office routers ship ready to use — and ready to be exploited. Here are the mistakes that leave them that way, and exactly how to fix each one.

By TechODash.com  ·  14–18 minute read  ·  Published 2026

There is a particular kind of router that shows up in almost every home and small office I have ever worked in. It sits on a shelf or in a corner, blinking quietly, doing its job well enough that nobody thinks about it. The brand name varies. The mistakes are almost always identical.

Consumer routers are remarkably capable devices. The problem is not the hardware. It is that they arrive from the factory optimized for easy setup, not for security. The defaults that make them simple to install are the same defaults that make them easy to exploit. And because most people never revisit those settings after the initial setup, those vulnerabilities sit there indefinitely.

After 25 years of working with home networks and small office environments, I can tell you that the mistakes are predictable. The same ten issues come up again and again, across brands, across price points, and across the full range of users — from single remote workers to small businesses running 30 or 40 devices.

The good news: every one of them is fixable. Most take less than five minutes. None require a networking background.

This guide is written for remote workers, home office users, and small business owners running standard consumer or prosumer routers. If you have a Netgear, ASUS, TP-Link, Eero, Orbi, or similar device — this applies to you.

Mistake 1: Never Changing the Default Admin Credentials

This is the most common mistake, and the most consequential. Every consumer router ships with a default admin username and password. For many brands, these are admin/admin, admin/password, or a combination printed right on the label attached to the device. They are also documented publicly on manufacturer websites, in forum posts, and in the reference libraries used by automated attack tools.

Anyone who gets access to your router — whether through your network or through an exposed admin panel — will try these credentials first. In most cases, they work.

The fix

Log into your router admin panel (usually 192.168.1.1 or 192.168.0.1 in a browser), navigate to the Administration or System section, and change both the username and the password. Use a password of at least 16 characters — a mix of upper and lowercase letters, numbers, and symbols. Store it in a password manager, not on a sticky note.

Mistake 2: Ignoring Firmware Updates

Router firmware is the software that runs your device. Manufacturers release updates to patch security vulnerabilities, fix bugs, and occasionally add new features. Most people install firmware once — when the router is first set up — and never update it again.

This is a significant problem. Unpatched routers are a known target. Security researchers regularly publish vulnerability disclosures for consumer router models, and attackers use those disclosures as a shopping list. If your router is running firmware from 2022, there is a reasonable chance it has known, publicly documented flaws.

The fix

Find the Firmware or Software Update section in your router's admin panel and check for available updates. Install them, allow the router to restart, and if your router supports automatic updates, enable that setting. If your router has not received a firmware update from the manufacturer in over a year, it may no longer be supported — which is worth noting for the next time you are in the market for new hardware.

Mistake 3: Using Outdated Wi-Fi Encryption

Wi-Fi encryption is what prevents people nearby from reading your wireless traffic. The standard has evolved over the years: WEP, then WPA, then WPA2, and now WPA3. The older standards have well-documented weaknesses. WEP can be cracked in minutes. WPA is not much better.

Despite this, many routers still ship with WPA2 as the default, and some older installations are still running WEP or WPA. In a few cases, routers are configured to support mixed modes for backward compatibility — which means they fall back to weaker encryption when an older device connects.

The fix

In your router's wireless settings, set the security mode to WPA3 if it is available. If your router does not support WPA3, WPA2-AES is acceptable. For most households in 2026, WPA2/WPA3 Transition Mode is a sensible middle ground — it allows WPA3 for capable devices while maintaining WPA2 for older hardware that hasn't caught up yet.

Mistake 4: Leaving the Default Network Name (SSID) Unchanged

Your SSID is the name of your Wi-Fi network. Default SSIDs often include the router's brand name or model number: NETGEAR-7823, ASUS_RT-AX88U, or similar. This is not just aesthetically uninspiring — it is a small but meaningful security issue.

Broadcasting your router's make and model tells anyone scanning for networks which vulnerabilities to look for. It also makes your network easier to identify if someone is watching for it specifically.

The fix

Rename your network to something neutral that does not reveal your hardware, your location, or your name. Avoid names that include your address, your last name, or anything that would help someone identify which network belongs to which home or office. Something simple and generic is fine.

Mistake 5: Using a Weak Wi-Fi Password

A router with strong encryption and a weak password is still a router with a weak password. Short passwords, dictionary words, and anything based on personal information — a birthday, a pet's name, a street address — are all vulnerable to the same automated cracking tools that are freely available online.

I have seen home networks with Wi-Fi passwords like "internet1" and "homewifi2024." These would be cracked in seconds by any halfway serious tool.

The fix

Use a password of at least 16 characters. A random passphrase works well — something like Copper-Ladder-Rain-51 is strong, memorable, and easy enough to type on a phone. Avoid anything that could be guessed by someone who knows basic facts about you.

Mistake 6: Skipping the Guest Network

Most modern consumer routers support a guest network — a separate wireless network that is isolated from your main devices. Most people never turn it on.

Without a guest network, every device that connects to your Wi-Fi is on the same network as everything else: your work laptop, your NAS drive, your printer, your files. A smart TV with outdated firmware, a friend's phone carrying malware, or a cheap IoT device with no security update history — all of them land on the same network as your most sensitive devices.

The fix

Enable your guest network and put three categories of devices on it: smart home devices (TVs, speakers, cameras, thermostats), any device belonging to a visitor, and any device you do not fully trust or regularly update. This is the simplest form of network segmentation, and it meaningfully reduces your exposure.

If your router doesn't support a guest network

Older consumer routers, and some basic ISP-supplied units, do not support guest networks or proper network isolation. If you are hitting limitations like this, it is worth evaluating whether your hardware is still serving you well. A mid-range modern router will support guest networks, WPA3, and automatic firmware updates out of the box.

Mistake 7: Leaving UPnP Enabled

UPnP — Universal Plug and Play — is a feature that allows devices on your network to automatically open ports on your router without any manual configuration. It was designed to make connecting devices easier. It also makes it easier for malware to punch holes in your firewall without your knowledge.

UPnP has a long history of security vulnerabilities, and new ones continue to surface. As recently as June 2026, a high-severity vulnerability (CVSS 8.8) was disclosed affecting a popular consumer router model, where the UPnP port-mapping function could be manipulated by an unauthenticated attacker to expose the router's admin panel directly to the internet. It is enabled by default on virtually every consumer router, and the vast majority of home users and remote workers have no need for it.

The fix

Find UPnP in your router's settings — usually under Advanced or WAN settings — and disable it. If a specific application stops working after you do this, you can investigate whether it genuinely requires UPnP before re-enabling it. In practice, most users never notice it is gone.

Mistake 8: Leaving WPS Enabled

WPS — Wi-Fi Protected Setup — was designed to make connecting new devices to a Wi-Fi network easier by using an 8-digit PIN instead of a password. It sounds convenient. The problem is that the PIN authentication method has a well-known flaw that allows an attacker to brute-force it in a matter of hours, regardless of how strong your Wi-Fi password is.

WPS has been known to be broken for over a decade. It is still enabled by default on most consumer routers.

The fix

Disable WPS in your router's wireless settings. There is no compelling reason for most home or small office users to have it on. Any device that cannot be connected without WPS can be connected by entering the Wi-Fi password manually.

Mistake 9: Never Checking the Connected Device List

Most people set up their router and never look at it again. The connected device list — a page in your admin panel that shows every device currently on your network — goes unexamined indefinitely.

This matters for a few reasons. Unauthorized devices can connect to your network if your password is weak or has been shared. Smart devices are sometimes added and forgotten. And occasionally, something shows up that genuinely should not be there — a neighbor's device that found its way onto your network, or a device with an unfamiliar name that turns out to be a previously forgotten gadget.

The fix

Make a habit of reviewing your connected device list once a month. It takes about five minutes. Look for anything unfamiliar. If you see a device you do not recognize, cross-reference it against what you know is connected, and investigate before dismissing it.

Tools that help: Fing and GlassWire are free network monitoring apps that make this monthly check faster and more visual.

Mistake 10: Leaving Remote Management Enabled

Remote management allows your router's admin panel to be accessed from outside your home network — over the internet. It is a feature that has legitimate uses in some contexts, but almost none for the typical home user or remote worker.

When remote management is on, your router's login page is accessible to anyone who knows — or can discover — your public IP address. Combined with default credentials (Mistake 1), this is a straightforward path to full router access for anyone looking for it.

The fix

Find Remote Management, Remote Access, or WAN Access in your router's administration settings and disable it. If you genuinely need to manage your router remotely, there are safer approaches — but for the overwhelming majority of home and small office users, this feature should simply be off.

All Ten Mistakes at a Glance

Use this as a quick reference. If you can check every row, your router is in significantly better shape than the average home or small office network.

Where to Go From Here

Working through these ten fixes puts your router in a genuinely defensible state. That is a real accomplishment for most home and small office networks, where even half of these items are typically unaddressed.

If you work from home or run a small business, your router is just the start.

The SOHO 2026 Guide covers the full picture — network architecture, device segmentation, remote work security, and Wi-Fi optimization. Written in plain English. Built on 25+ years of real-world IT experience.

TechODash.com

Calm, practical guides for remote workers, content creators, and small business owners who want networks that work reliably and safely — without the enterprise complexity. Built on 25+ years of hands-on IT experience.