Secure a Hacked Router: Step-by-Step Recovery

If you suspect your home router has been compromised, acting quickly can prevent attackers from intercepting your traffic, stealing credentials, or using your network for illegal activity. This guide walks you through a full recovery: from isolating the device to resetting it, updating firmware, and locking down settings. You’ll need physical access to the router and its admin password (or the ability to reset it).

What You’ll Need

Physical access to the router (to press the reset button if needed)
The router’s default admin credentials (often printed on a sticker on the device) or your custom ones if you remember them
A computer or phone that can connect via Ethernet cable or Wi-Fi
An Ethernet cable (recommended for initial setup)
Your internet service provider (ISP) username and password if your connection requires them (check ISP documentation)

Step-by-Step

Disconnect the router from the internet. Unplug the modem’s Ethernet cable from the router’s WAN/Internet port. This stops the attacker from reaching your network while you work. If you have a combined modem-router unit, unplug the coaxial or fiber line from the wall.
Power-cycle the router. Unplug the power adapter, wait 30 seconds, and plug it back in. This clears temporary memory and may drop any malicious processes running in RAM.
Connect to the router via Ethernet. Plug a computer directly into one of the router’s LAN ports using an Ethernet cable. This avoids Wi-Fi interference and ensures you’re on the local network even if the Wi-Fi password was changed.
Perform a factory reset. Find the reset hole or button on the router (usually on the back or bottom). With the router powered on, press and hold the reset button with a paperclip for 10–15 seconds until the lights blink. Release it. This restores the router to its default settings, wiping any malicious configuration.
Log in with default credentials. After the router reboots (about 1–2 minutes), open a browser and go to the router’s default IP address (commonly 192.168.1.1, 192.168.0.1, or 10.0.0.1 – check the sticker on the device). Enter the default username and password (often “admin” / “admin” or “admin” / “password”). If the default doesn’t work, look up the model online.
Change the admin password immediately. Go to the Administration or System settings. Set a strong, unique password (at least 12 characters, mix of letters, numbers, symbols). Do not reuse this password elsewhere.
Update the firmware. In the router’s admin panel, find the Firmware Update or Administration > Firmware section. Check for updates and install the latest version. If the router doesn’t have an automatic check, download the latest firmware from the manufacturer’s official website onto your computer, then upload it via the admin panel. This patches known vulnerabilities.
Change the Wi-Fi network name (SSID) and password. Go to Wireless Settings. Set a new SSID (avoid using your name or address) and a strong WPA2 or WPA3 password (at least 12 characters). Disable WPS (Wi-Fi Protected Setup) if it’s on – it’s a known attack vector.
Review connected devices. Look for a “Connected Devices” or “Attached Devices” page. You should see only your own devices. If any unknown device appears, note its MAC address and consider blocking it via MAC filtering (though this is not foolproof).
Disable remote management. Ensure that remote access to the router’s admin interface is turned off. This is usually under Administration > Remote Access. It should be disabled or set to “LAN only”.
Reconnect the modem to the router. Plug the modem’s Ethernet cable back into the router’s WAN port. Wait for the internet light to become steady.
Reconnect your devices. Connect your Wi-Fi devices to the new network using the new password. For computers, consider running a malware scan to ensure they aren’t compromised.
Monitor the network for a few days. Check the connected devices list periodically. If you see unknown devices again, repeat the reset and consider replacing the router if the issue persists.

Common Mistakes

Skipping the factory reset. Just changing the password may not remove malicious settings like DNS redirects. A full reset is essential.
Not updating firmware. Old firmware often has known vulnerabilities that attackers exploit. Always update after a reset.
Using weak admin credentials. “admin” / “admin” is the first thing attackers try. Use a strong, unique password.
Leaving WPS enabled. WPS can be brute-forced in hours. Disable it.
Forgetting to change the Wi-Fi password. If the attacker knew the old Wi-Fi password, they can still connect. Change it.
Reconnecting compromised devices. If a device on your network is infected, it can re-infect the router. Scan all devices before reconnecting.

Tips

Use a guest network for IoT devices (smart bulbs, cameras) to isolate them from your main devices.
Enable WPA3 if your router supports it; otherwise use WPA2 with AES (not TKIP).
Turn off UPnP (Universal Plug and Play) if you don’t use it – it can be abused to open ports.
Change the default IP range (e.g., from 192.168.1.x to 192.168.50.x) to make it slightly harder for automated attacks.
Set up automatic firmware updates if your router supports it.
Use a strong router admin password and store it in a password manager.

Troubleshooting

Can’t log in after reset? Ensure you’re using the correct default IP and credentials. Try a different browser or clear your cache. If the router doesn’t respond, do another factory reset and wait longer.
Firmware update fails? Download the firmware file again and verify it matches your router model. Use a wired connection. If it still fails, try a different browser or reset the router again before updating.
Internet doesn’t reconnect after reconnecting the modem? Power-cycle the modem as well: unplug it for 30 seconds, plug it in, wait for it to sync, then reconnect to the router. If you need PPPoE credentials, re-enter them in the WAN settings.
Unknown devices still appear? They might be your own devices you forgot about (e.g., a smart TV). Check MAC addresses against your devices. If truly unknown, repeat the reset and change the Wi-Fi password again. Consider updating the router’s firmware to the latest version.
Router is completely unresponsive? Try a 30-30-30 reset: hold reset while unplugging, wait 30 seconds, plug in while holding, wait 30 seconds, release. If that fails, the router may be damaged – consider replacing it.

Frequently Asked Questions

How do I know if my router is compromised?

Signs include: unknown devices in the connected device list, slow internet, redirections to unexpected websites, changed DNS settings, or the admin password no longer working. But these can also be caused by other issues, so a reset is a good precaution.

Can a factory reset remove all malware?

Yes, in most cases. A factory reset wipes the router’s configuration and restores it to its original state, removing malicious settings. However, if the router’s firmware itself is corrupted or replaced, you may need to flash the original firmware manually. That’s rare but possible.

Should I replace my router after a compromise?

Not necessarily. If the reset and firmware update work and no unknown devices reappear, the router is likely safe. If the compromise recurs or the router is very old (no longer receiving updates), replacing it is a good idea.

What is the best Wi-Fi security setting?

Use WPA3 if available, otherwise WPA2 with AES encryption. Avoid WEP and WPA (TKIP) as they are outdated and easily cracked.

Can an attacker see my internet traffic through the router?

If the router is compromised, yes – they could redirect your DNS or intercept unencrypted traffic. That’s why it’s important to use HTTPS and a VPN for sensitive activities, and to secure your router.

How often should I change my router password?

At least every few months, and immediately after any suspected compromise. Use a unique, strong password each time.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →