Before your router even connects to the internet, change these 6 settings

Similar to other new hardware, the out-of-box experience of a router can leave your network with a lot of loose ends, despite it being able to function properly right away. These defaults are intentional: manufacturers ship these devices with settings that prioritize getting users online in just a few minutes, and they're not necessarily the most secure or performant. Every time I set up a new router, I run through this list of settings before a single device touches the network, and it only takes a few minutes.

Flash the latest firmware and enable automatic updates

Before you start changing settings, start here

Before it lands in your home, routers sit in warehouses for months after manufacture, which mean that the firmware on the device is almost certainly out of date. The first thing I do before anything else is sit down, plug a laptop into a LAN port and check for a firmware update. All router manufacturers have had serious CVEs in their firmware at some point, and the only way most of them get remedied is through a firmware update. This initial wired-in window is the safest moment to apply them, before any device on your network gets a chance to be compromised.

While you're in that section of the admin panel, flip on automatic updates if your router supports them. Some firmware lets you split this into security-only updates versus all updates; if you've ever been burned by a feature update breaking something, security-only is the safer pick.

Change the admin password

Despite having per-device credentials, you should still change them

Newer routers increasingly ship with unique per-device admin credentials printed on the sticker, which is better than generic admin/admin username and password defaults that they used to use, but it's still a security risk. I don't let strangers into my home and show them the sticker on the bottom of my router, but having stronger credentials can't hurt. I change the password to something stored in a password manager, and if the router lets me change the admin username too, I do that.

Turn off WPS

Having it on is just asking for trouble

Wi-Fi Protected Setup's PIN method has well-documented vulnerabilities that are bad enough to warrant turning off the feature entirely. The first, Reaver, is a brute-force attack that exploits a protocol design flaw: the router validates the eight-digit PIN in two halves and tells the attacker when the first half is correct, which collapses the search space from 100 million combinations to about 11,000. On a router without rate-limiting, that's a few hours of work to recover the Wi-Fi password. The second, Pixie Dust, is much worse—it exploits weak random number generation in specific Ralink, Realtek, MediaTek, and Broadcom chipsets, lets an attacker compute the PIN offline from a single captured handshake, and doesn't care about rate-limiting at all. The button method of WPS is less risky but rarely used, so turning off the whole feature is a must for me.

Disable remote administration

You don't need it

There's almost no legitimate reason for a home router's admin panel to be reachable from the open internet. Routers with remote management exposed have been mass-compromised in past. If you genuinely need to access your router's admin panel from outside of your local network, do it through a VPN. Tailscale running on the router itself or a separate device is far cleaner than punching a dedicated hole for the admin panel to the WAN.

Set the DNS if applicable

A third-party resolver will likely be better than what your ISP offers

ISP DNS tends to be slow, sometimes injects ads or NXDOMAIN redirects, and hands the ISP a complete log of every domain on the network. Setting a third-party resolver at the router level means every device on the network inherits it, including IoT devices. If you're running a Pi-hole, AdGuard or a similar DNS sinkhole, that's where you'll be pointing the router.

Manually configure channel width

If you're in a congested area, this is a must

Auto channel selection on 2.4 GHz is notoriously bad in dense apartments. It'll usually select congested channels, and it rarely re-evaluates after the initial setup, so I lock mine to one of the three non-overlapping channels after checking what the neighbors are using. I also force the 2.4 GHz channel width to 20 MHz; 40 MHz looks faster on a spec sheet, but in any environment with other 2.4 GHz networks nearby, the interference cost almost always outweighs the theoretical throughput gain.

A few minutes for practical changes before you plug in all of your devices

When you pick up a router off the shelf at a big-box store, or order one online, it's almost a certainty that it will come with default settings that are compromising to your network's performance and security. Changing these settings before you bring your devices online creates a solid foundation that you can then build off of with more advanced stuff, like segmenting devices into VLANs or creating a DNS sinkhole.