Your Wi-Fi Router, Smart Devices and Public Wi-Fi

Think of your home internet as a house with one front door. The router is that door. Your internet company brings the connection to the wall, and the router shares it with your phones, computers, TV and everything else, by cable or by Wi-Fi (the wireless signal). If the door is left open, or the lock is a cheap one that was broken years ago, it does not matter how careful you are with passwords inside.

The good news is that this door is easy to lock. The FTC gives a short list of steps and we will follow it. The bad news is that criminals do go after routers, because one taken-over router gives them a safe place to hide their other crimes. In May 2025 the FBI warned that criminals were breaking into old routers and renting them out to hide their tracks. We will come back to that.

Step one: get into the router and change two passwords

A router has two passwords, and people mix them up. The Wi-Fi password is what you type on a phone to join the network. The admin password is what you type to change the router's settings. The FTC points out that whoever has the admin login can undo every other protection, including your Wi-Fi password. So the admin one matters most.

If you rent the router from your internet company and cannot sign in, call the number on your bill (the one printed on a paper bill, or listed on the company's real website that you typed yourself). Ask them how to change the admin password and the Wi-Fi password. Do not search the web for "router help" and call whatever number comes up first. Scammers buy ads for those searches.

Step two: choose the right Wi-Fi security

Wi-Fi encryption scrambles the signal between your device and the router so a neighbor with a laptop cannot read it. The names are a bit of alphabet soup, but the ranking is simple.

Step three: updates, and the old router problem

Your router runs its own built-in software called firmware. Like Windows or iPhone software, it gets fixes for security holes. Unlike them, it often does not update itself. The FTC says to check the maker's website for newer software, to register the router to get update notices, and to ask your internet company whether it pushes updates automatically when it supplied the router. Apple's router guidance also says to turn on automatic firmware updates when the router has that option.

There is an end to it, though. After some years the maker stops writing fixes. On May 7, 2025, the FBI said that end-of-life routers (ones the maker no longer sells or supports) were being taken over by a family of malicious software called TheMoon. The FBI said routers dated 2010 or earlier likely no longer get updates. Criminals used the hijacked routers as hiding places for other crimes, which can bring trouble to the owner who did nothing. The FBI told owners to replace old routers with a supported model, install updates, and turn off remote management and then save and reboot.

How to tell if yours is old: find the model number on the sticker, type it into a search engine with the words "end of support" or "end of life," and read the maker's own page. If the router came from your internet company and is more than about five years old, ask them whether it is still supported and whether they will swap it. Many companies do this free or for a small fee. As of October 2026, no one guarantees an exact number of years, so check the maker's page for your model.

Step four: switch off the risky extras

Routers come with features meant for convenience that happen to be good for criminals. The FTC advises turning these off:

• Remote management (or remote administration, or remote access): lets someone change router settings from the internet. Unless you have a reason you can name, turn it off.
• WPS (Wi-Fi Protected Setup): the button or eight-digit PIN that lets a device join without the password. Convenient, and the FTC lists it as something to turn off.
• UPnP (Universal Plug and Play): lets devices on your network open doors in the firewall by themselves. The FTC also advises turning it off. If a game console or a camera stops working afterward, you can turn it back on for a test.

The FTC also says to make sure the router's built-in firewall is on. Most routers have one and have it on by default. A firewall is a guard that stands between the internet and your home. It looks at connections coming in from outside and drops the ones nobody asked for. Your router's firewall protects the whole house at once. Your computer has its own, a second guard.

Step five: a guest network

A guest network is a second Wi-Fi name on the same router. It has its own password, and it is walled off from your main network. The FTC lists two benefits: fewer people know the password to your main Wi-Fi, and an infected device on the guest side is less likely to reach your computer and phone.

Use it for visitors, of course. But the better use is for the gadgets that you do not fully control: the smart TV, the doorbell camera, the thermostat, the robot vacuum, the voice speaker. Those rarely get long-term updates. Putting them on the guest side means that if one of them is ever taken over, it is on the wrong side of the wall. Your banking computer and your phone stay on the main network.

Smart TVs, cameras, doorbells and voice assistants

A smart device is any object that connects to your Wi-Fi: a TV, a camera, a video doorbell, a speaker you talk to, a baby monitor, a thermostat, a lightbulb. Engineers call this the Internet of Things, or IoT. Each is a small computer. Each needs a password, updates and a sensible place on your network.

Before buying any smart gadget, spend two minutes on the maker's support page. Does it say how long the device will get updates? Does it let you set your own password? If the page is hard to find or the company has no phone number, buy a different one. An off-brand gadget with a rock-bottom price is cheap for a reason.

The warning about cheap streaming boxes

On June 5, 2025, the FBI warned about a network of infected devices called BADBOX 2.0. It said the malware either comes already installed on the device before you buy it or arrives through apps from unofficial stores. The FBI named TV streaming devices, digital projectors, add-on car entertainment systems and digital picture frames, and said most were made in China. Once infected, the device lets criminals use your home internet connection for their own crimes.

The FBI listed signs that a device may be one of them: generic streaming boxes sold with "all channels free" or promising free content, gadgets from brands you cannot find a website for, Android devices that are not Play Protect certified, any instruction to turn off Google Play Protect, and unexplained internet traffic. The FBI itself says these signs alone do not prove a crime. But the advice is simple. Skip the "free channels" box. If you already own one, think about unplugging it. And if you think you were a victim, you can report it at ic3.gov.

Printers, and the kids' and grandkids' devices

A home printer is also a computer on your network, and many are never updated. Check the maker's support page for your model, and install any update there (some printers have an Update option on their screen). If your printer has a web page or an app with an admin password, change it from the factory default. Many printers also have a feature that gives them an email address so you can print from anywhere. Turn it off if you do not use it. And when you replace a printer, reset it to factory settings first, because some store the Wi-Fi password.

Children and grandchildren bring phones, tablets, game consoles and laptops into your house. You cannot lock all of them down, and you should not need to. The simple plan: they join the guest network, not the main one. You give them the guest password and not the main password. When they leave, nothing of yours stays reachable. If you have young children living with you, Apple, Google and Microsoft each have free family settings (Screen Time, Family Link, Microsoft Family Safety) that let a parent approve downloads and set limits. Setting those up is a chore for a parent or guardian, but a good one.

Public Wi-Fi and your phone's hotspot

Public Wi-Fi is the free network at a coffee shop, hotel, airport or library. Anyone can join it, including a criminal. The FTC has for years called free public Wi-Fi "often insecure." You can join a fake network with a name like the real one, set up by someone else. Or a stranger on the same network can try to watch what you send.

Most of the web now uses scrambled connections, and your banking app does too, so reading a menu on public Wi-Fi is mostly fine. What you should avoid is anything with money or passwords, and anything that asks you to download something.

• Ask staff for the network name. Do not guess. A look-alike called "Airport_Free_WiFi_2" may not be the airport's.
• Skip banking, shopping and sign-in to important accounts on a network you do not control. Wait until you are home or switch to cellular data.
• Turn off automatic joining. On an iPhone, Settings, then Wi-Fi, tap the (i) beside the network and switch off Auto-Join. On Android, Settings, then Network and internet, then Internet, tap the gear beside the network and turn off Auto-connect. Menu names differ by brand.
• Do not agree to install anything to get online, and do not enter a Social Security number or card number on a "sign-in page" a Wi-Fi network shows you.
• Turn off file sharing and AirDrop to Everyone in public places (the phones lesson covers those).

The safer choice is your own phone's hotspot. It turns your phone into a small Wi-Fi network using your cellular data. Open Settings, find Personal Hotspot (iPhone) or Hotspot and tethering (Android), switch it on and set a long password of your own. Your data plan may have a monthly limit on hotspot use, so check your plan. Turn the hotspot off when you finish. If you only need to check your bank, skip Wi-Fi altogether and use the bank's official app on cellular data.

VPNs: what they do and when they help

A VPN (virtual private network) is a service you install on a device. It scrambles your traffic and sends it through the VPN company's computers before it reaches the website. That hides what you do from whoever runs the Wi-Fi network you are on, such as the coffee shop. The FTC has said VPN apps can shield personal information sent over a public Wi-Fi network. But a VPN does not move trust to nobody. It moves it to the VPN company, which can see your traffic instead. The FTC told people to research the app before downloading it, review the permissions it asks for, confirm that it really encrypts your data, and check whether it shares your information with others. That is good advice, because many free VPN apps make their money by selling data.

Questions and answers

How do I know if someone is using my Wi-Fi without permission?

Sign in to the router and look for a list called Connected devices, Attached devices or Client list. Go through it. You will see your own phones, TVs and computers, often with odd names. If you see a device you cannot account for, the simplest cure is to change the Wi-Fi password, and then re-join your devices one at a time. Also look at whether the unfamiliar item is a gadget you forgot, like a printer or a smart plug.

Should I turn off my Wi-Fi at night?

You do not have to. It does not make a strong setup safer, and it can stop automatic updates that run overnight. Restarting the router once in a while is fine, and the FBI's advice after a possible infection includes updating, changing the password and rebooting.

The router from my internet company works. Do I need to buy my own?

Not necessarily. A company router is fine if it is supported and updated, and if you can change the settings. Ask the company three plain questions: Is this model still supported? Does it update itself? Can I change the admin password and turn on a guest network? If the answer to any is no, ask for a newer one. Buying your own can cut a monthly rental fee, but then keeping it updated is up to you.

What is the difference between Wi-Fi and the internet?

Wi-Fi is the wireless link inside your house between your device and the router. The internet is the outside network that the router connects you to. If the internet company has an outage, your Wi-Fi may still show bars but pages will not load.

Is it okay to give a visitor my Wi-Fi password?

Give them the guest network password instead. You can change it any time without redoing your own devices. Some routers show a QR code for guests that you can display on a phone or print.

Can someone watch me through my smart TV or camera?

It is possible when a camera has a weak or reused password and no updates. It is far less likely with a unique password, two-step sign-in and current software. Practical steps: a physical cover over any camera you do not use, the guest network, and a strong password in the camera's app.

Do I need to hide my network name?

No. Choose a plain name, choose WPA2 or WPA3, and make the password long. Those do the real work.

What do I do with my old router?

Press and hold its reset button for about 10 seconds (check the manual for the exact time) to erase your settings, then take it to an electronics recycling drop-off or a store take-back program. Many internet companies take back routers they supplied.

Hard questions

Is a VPN worth paying for?

For many households, no. If you rarely use public Wi-Fi, and you use your bank's official app, a VPN adds little. The FTC advises researching the app, reviewing its permissions, confirming it really encrypts and checking whether it shares your information with others. If you travel often and must use hotel or airport Wi-Fi, a VPN from a company with a clear privacy policy and a real address and phone number can be useful. Your phone's own hotspot costs nothing extra on most plans and avoids the question. A free VPN from a pop-up ad, or one a caller tells you to install, is a bad idea.

I cannot afford a new router. What is the minimum I should do?

Turn off remote management, change both passwords, and use the best encryption the router offers. Look up whether the maker has any update. Then ask your internet company whether it will send a newer router; many do it for free or at low cost when a router is old. Some libraries, senior centers and local nonprofit groups can help you set it up, and some utilities and internet companies have low-income plans. Call and ask. If the router truly cannot be updated and the FBI advises replacing it, treat the replacement as a safety purchase and watch for sales.

Is it safe to bank on my phone?

It is a good bet when you use the bank's official app, downloaded from the Apple App Store or Google Play, with a screen lock and an updated phone. Doing it on cellular data or your own home Wi-Fi is better than on a cafe network. The bigger danger is a phone call or text that tricks you into giving a code, not a hacker on your Wi-Fi.

Why not just stay offline and avoid all this?

That is a real choice, and some people make it. But banks, doctors, pharmacies and Medicare now push people to go online, and a family member's help is easier to give by video call. Staying offline is not a failure. But a router with a good password and updates takes about an hour, and it makes going online safe enough for most people.

My internet company says I must use their router and settings. Am I stuck?

You can still ask them to change the admin password, turn on the guest network and tell you the firmware status. If they refuse, ask whether you can use your own router. Many companies allow it. Whichever you choose, write down who you called and when.