Your router is the front door to your digital life. Every device, every password typed, every bank login passes through it. So the thought that someone might have broken into the router itself — quietly, without the flashing warnings a virus triggers — is genuinely unsettling. Router takeovers do happen: attackers change the router’s DNS settings so your banking site silently resolves to a look-alike, or enrol your router into a botnet. The good news is that a hijacked router leaves footprints, and you can check for every one of them in about fifteen minutes.
This guide lists the warning signs of a compromised router, walks you through a step-by-step security audit inside your admin page, and explains exactly how to clean house and lock the door if you find anything wrong.
Warning Signs Your Router May Be Compromised
No single sign is proof, but several together are a siren. Watch for: websites redirecting oddly or showing far more ads than usual; browser warnings about invalid certificates on major sites like your bank or Google; your Wi-Fi password or admin password no longer working even though nobody changed them; the router’s DNS settings pointing to unfamiliar addresses you never entered; unknown devices in the connected list at hours when the house is asleep; internet that slows dramatically at odd times; and settings — port forwards, remote management, UPnP — enabled that you do not remember touching. Attackers typically want your traffic or your bandwidth, and both leave these kinds of traces.
The Audit: Checking Your Router Step by Step
Step 1: Log In and Verify the Admin Password
Go to 192.168.0.1 or 192.168.1.1 and log in. If the default password from the label (admin/admin and similar) still works, that is finding number one: your door had a toy lock. Change it immediately to a strong, unique password — whether or not anything else is wrong.
Step 2: Inspect the Connected Devices List
Open the client/device list and account for every entry. Match phones, laptops, TVs, and gadgets by name and MAC address. An unknown device is not automatically a hacker — it is often a forgotten smart plug or a phone using a randomised MAC address — but anything you cannot identify after checking deserves removal: change the Wi-Fi password and everything unknown falls off.
Step 3: Check the DNS Settings (The Critical One)
Find the Internet/WAN settings and note the DNS server addresses. They should be set to automatic (your ISP’s) or to a provider you chose, such as 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google). Strange addresses you do not recognise are the classic signature of router hijacking — write them down, then reset the DNS to automatic. The FBI and security agencies have repeatedly warned about exactly this trick; CISA’s security advisories on home router compromises document real campaigns that used it.
Step 4: Review Remote Management, Port Forwarding, and UPnP
Remote administration from the internet should be OFF unless you deliberately enabled it. Port forwarding rules should be ones you created — delete anything unfamiliar, especially forwards to internal admin ports. UPnP is convenient but risky; if you do not actively need it, disable it.
Step 5: Check the Firmware Version
Note the firmware version and compare it with the latest on the manufacturer’s support site. Attackers exploit known, patched bugs in old firmware — a router that has not been updated in three years is soft targets’ row. Update it now.
If You Found Something Wrong: The Clean-Up
Do not just fix the one suspicious setting — a compromised router gets a full reset. Perform a factory reset (paperclip in the Reset hole for 10 seconds, power on), then set the router up fresh: strong admin password first, firmware update second, then your Wi-Fi name with a NEW Wi-Fi password (the old one may be known), WPA2/WPA3 security, WPS and remote management off. Change passwords for important accounts — email and banking especially — from a clean device afterwards, since traffic may have been observed. For the full hardening checklist, follow Network Ustad’s router security hardening guide.
How Routers Get Hacked in the First Place
Understanding the entry points helps you close them. The most common are embarrassingly simple: default admin passwords never changed; old firmware with public, documented vulnerabilities; WPS PIN brute-forcing; malicious websites that attack the router through your own browser while you are logged in; and fake “router update” pop-ups that trick owners into installing malware-laced firmware. None of these need a genius attacker — they are automated, scanning the internet for exactly these weaknesses around the clock.
Quick Check: Use Your Router’s Log Files
Most routers keep a system log, and it is an underused detective tool. In the admin page, look for a section called System Log, Logs, or Status — then scan recent entries for clues: repeated failed admin login attempts from an IP address that is not yours, configuration changes timestamped when nobody was home, or the router obtaining a new internet connection repeatedly at odd hours. Logs are written in dense technical language, but you are not reading them line by line — you are looking for patterns that do not match your household’s life. Some routers can even email logs or save them periodically; turning that on after any scare gives you a record if odd behaviour returns. If the log shows the admin page being accessed from the internet (a WAN-side address) and you never enabled remote management, treat that as a serious finding: factory reset the router, rebuild it with the hardening steps above, and then change your important account passwords from a trusted device.
Common Mistakes and Tips
Mistake one: panicking at an “unknown device” that turns out to be your own smart TV — audit calmly and identify before concluding anything. Mistake two: changing the Wi-Fi password but leaving the admin password as “admin,” which is like fitting a new door lock and leaving the key under the mat. Mistake three: cleaning the router but not the computers — if a PC’s malware changed the router settings once, it can do it again, so scan your devices too. Tip: turn on automatic firmware updates if your router offers them, and set a six-monthly reminder to repeat this fifteen-minute audit.
Conclusion
A hacked router whispers rather than shouts: odd DNS addresses, mystery devices, redirects, and settings you never touched. Fifteen minutes in the admin page — devices, DNS, remote access, firmware — will tell you whether your front door is sound. If in doubt, reset it, rebuild it with strong passwords, and update everything. Your whole network’s safety is worth that quarter of an hour.
Frequently Asked Questions
What is the single biggest sign of a hacked router?
Changed DNS settings pointing to servers you never chose. That is the hallmark of traffic-hijacking attacks. Note the addresses, then reset DNS to automatic and factory-reset the router to be safe.
Can my router be hacked if I never changed the default password?
Yes — that is precisely how most home routers are compromised. Default passwords for every model are publicly known, and automated scanners try them constantly. Change the admin password today if you have not.
Will a factory reset remove a router infection?
In the overwhelming majority of cases, yes. A reset wipes malicious settings and configuration-based malware. Afterwards, update firmware, use new strong passwords, and turn off remote management so it cannot simply happen again.
How often should I check my router for intruders?
A quick audit every few months is plenty for most homes, plus immediately whenever you notice redirects, certificate warnings, unknown devices, or unexplained slowdowns.
Does antivirus software protect my router?
Not directly — antivirus protects the computer it runs on. Router protection comes from strong admin passwords, updated firmware, disabled WPS and remote access, and good DNS hygiene. Some security suites add network scanning, which helps spot rogue devices.
Leave a Reply