Guide · Network security
Is your router login still admin / admin?
Affiliate disclosure: This page contains affiliate links, which are labeled. If you buy through one, Small Biz Cyber Guide may earn a commission at no extra cost to you. Recommendations are not for sale. See the full affiliate disclosure.
Every laptop, phone, printer, and camera in your office sits behind one box: the router. It was often installed by the internet provider years ago and left alone, still using the admin login printed on its sticker or in its manual. Default logins for common models are easy to look up online, so “admin / admin” is a published password, not a secret.
Old routers are now a target in their own right. In May 2025 the FBI warned that criminals were taking over end-of-life routers, especially ones with remote administration turned on, and selling them as proxies for other crimes. This guide is the companion to our Short on router defaults.
Quick verdict
- Change the router admin password today to a unique, random password. The FBI recommends 16 to 64 characters. Keep it separate from the Wi-Fi password.
- Update the firmware and turn off remote management. Turn on automatic updates if your router offers them.
- Replace it if it no longer gets updates. The FBI notes that routers from 2010 or earlier likely no longer receive security patches from the manufacturer.
The 20-minute router checklist
| Setting | What to do | Why it matters |
|---|---|---|
| Admin password | Unique and random, 16+ characters. Change the username too if the router allows it | Default logins are public |
| Firmware | Update now, then turn on automatic updates | Patches the known holes attackers scan for |
| Remote management | Off, unless your IT provider truly needs it. If they do, ask how they restrict it | The FBI tied compromised routers to remote admin being on |
| WPS | Off | CISA says it raises the odds of unauthorized access |
| UPnP | Off, unless a device really needs it | Malware can use it to open ports and spread |
| Wi-Fi encryption | WPA3 Personal or WPA2-AES. Never WEP, WPA, or WPA2-TKIP | Older modes can be broken |
| Guest network | Separate guest Wi-Fi for visitors and smart devices | Keeps them off the network your work laptops use |
The WPS, UPnP, and encryption rows follow CISA’s router settings guidance. For the guest network, see guest Wi-Fi is not staff Wi-Fi.
How to change it (generic steps)
- Connect from an office computer, wired if you can. Open the router’s admin address (often printed on the label, such as 192.168.0.1 or 192.168.1.1) or the manufacturer’s app.
- Sign in with the current login from the label, the manual, or your internet provider.
- Find Administration, System, or Management and change the admin password, plus the username if that’s allowed.
- Open the Firmware or Update section. Install any update and turn on automatic updates.
- Turn off remote management, which may be labeled remote access, cloud access, or web access from WAN.
- Turn off WPS and UPnP and confirm the Wi-Fi uses WPA3 or WPA2-AES.
- Save, reboot, and sign back in with the new password to confirm it took. The FBI also recommends a reboot after these changes.
Menus differ by brand. If your internet provider manages the router, call them and ask three questions: Do you patch it automatically? Can I change the admin password? Is remote management on, and who uses it?
Is your router end-of-life?
- Find the model number on the label and look it up on the manufacturer’s support page. If the latest firmware is years old, or the model is on an end-of-life list, plan a replacement.
- Watch for warning signs. The FBI lists overheating, connection problems, and settings changes you don’t recognize. If you see them, update, change the password, and reboot. If the router is unsupported, replace it.
- Track it like any other asset. CISA’s edge device guidance recommends keeping a list of routers and firewalls with their end-of-support dates, so replacements happen on schedule and not after an incident.
When you replace it, pick a router whose maker publishes a support period and ships automatic updates. Then change the default admin password before it goes into service.
Store the new password where the business can find it
A strong router password that only lives in one person’s head becomes a problem the day that person leaves. Store it, along with the model, firmware version, and ISP account details, in a shared vault that only admins can open.
Keep network logins in a team vault: NordPass Business
Shared folders, admin-only access, and a clean revoke when someone leaves. Store the router, ISP, and Wi-Fi credentials together so the next person isn’t hunting for a sticker.
Prefer another vault? Compare options in password managers for small business.
Bottom line
The router guards every device behind it, so it shouldn’t be the one still using a factory password. Twenty minutes gets you a unique admin password, current firmware, and remote management off. If the router can’t get updates anymore, replace it.
Prefer video? Watch the under-a-minute version on YouTube: Is Your Router Login Still admin / admin?.
Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.
Record the router change and the next firmware check. The Small Business Security Essentials Toolkit ($79) includes a Network sheet in the Asset & Admin Inventory and a Security Calendar for firmware review dates.