Home Networks & Wi-Fi · Securing Your Wi-Fi · Lesson 3 of 5

WPS, UPnP and Remote Management

Turn off router features you don't use and keep updates coming in.

Three Doors You Can Close

Routers come with features that make life easier. Some of them also give attackers an easier way in. Three are worth knowing by name.

WPS, short for Wi-Fi Protected Setup, lets a device join by pressing a button on the router or typing an 8-digit PIN instead of the password. The PIN method has a known flaw that lets attackers guess it fairly quickly. CISA, the US government's cybersecurity agency, advises turning WPS off. Typing the real password once is barely slower.

UPnP, short for Universal Plug and Play, lets apps and devices inside your home open doors in the router by themselves, without asking you. Game consoles and some video calling apps use it. The problem is that malware on any device can use it the same way. If nothing in your home needs it, turn it off. If a game console stops working well online, you can turn it back on later.

Remote management, sometimes called remote administration or web access from the internet, lets someone sign in to your router's admin page from anywhere online. Very few people need this. If it's on, attackers around the world can try to guess your admin password. Turn it off. Your router's own app may still let you check things away from home through the maker's account, which is a different, safer setup.

These settings usually live under Advanced, Security or Administration in your router's app or admin page.

On the practice computer, open the router's advanced settings. Turn off WPS, read about UPnP and turn it off, turn off remote management, and turn automatic firmware updates on.

Updates and a Smaller Target

Security people talk about the attack surface. That is every way an attacker could try to get into a device. Each feature that is turned on is one more possible way in. Each feature you turn off makes the target smaller.

So a simple rule works well: if you don't use a feature, turn it off. WPS, UPnP and remote management are the usual three. Some routers also offer older sharing features, such as a USB drive shared to the network. Turn those off too if you don't use them.

The other half of router safety is firmware, the software that runs the router itself. Makers release firmware updates to fix security holes that attackers already know about. An old router with old firmware is one of the easiest targets in a home.

• Find Automatic updates or Auto firmware update in your router's app or admin page and turn it on.
• If there's no automatic option, check for updates every few months.
• Many updates restart the router. Expect the internet to drop for a few minutes.

Every router reaches an end of life, the point when its maker stops sending updates. After that, new holes never get fixed. Look up your model on the maker's support page. If support has ended, plan to replace it. Many internet companies replace the routers they provide for free or for a small fee.

Write down any setting you change. If something stops working, like a game console online, you'll know which switch to check first.