Interactive Router Security Hardening Checklist
Generate an actionable perimeter and wireless security audit checklist tailored to your environment and track each hardening control as you apply it.
Click Generate Security Audit Checklist to build your interactive hardening list.
Why Default Factory Router Settings Are Not Safe Enough
Out of the box, consumer routers are tuned for zero-friction device pairing rather than security. Features like WPS (Wi-Fi Protected Setup), UPnP (Universal Plug and Play), and single-flat-LAN bridging allow convenience devices to connect easily—but they also allow a single compromised IoT smart plug or malware-infected laptop to open inbound NAT ports on your firewall or scan your work computer's SMB file shares.
Critical Router Security Controls Matrix
| Security Setting | Recommended State | Risk if Left at Factory Default |
|---|---|---|
| Router Admin Password | Unique 16+ char passphrase (never same as WiFi password) | Cross-Site Request Forgery (CSRF) & local admin takeover |
| WAN Remote Administration | Disabled (Use WireGuard VPN for remote access) | Automated botnet brute-force & zero-day web GUI exploits |
| WPS (Wi-Fi Protected Setup) | Disabled (Both PIN and Push-Button) | Offline Pixie-Dust / 8-digit PIN brute-force in seconds |
| UPnP (Universal Plug and Play) | Disabled on business/work networks | Malware or rogue IoT cameras silently opening inbound WAN ports |
| WiFi Encryption Mode | WPA3-Personal (SAE) or WPA2/WPA3 Transition (AES) | Legacy WPA/TKIP weakens throughput and enables dictionary attacks |
| Guest / IoT Network Isolation | Enabled (Client Isolation + Block Intranet Access) | Untrusted smart TVs and cameras can probe work laptops and NAS |
| SIP ALG | Disabled | Corrupts SIP headers and drops Zoom, Teams, and WiFi Calling audio |