Secure your office router and Wi-Fi in half an hour.

Your office router is the front door to everything on your network, and most were set up once by whoever installed the broadband and never touched again. To secure your office router and Wi-Fi, change the admin password, switch off remote admin, update it, use WPA3 or WPA2 encryption and give guests their own network. With the router’s login details to hand, it’s about half an hour’s work.

These steps also line up with the firewall control in Cyber Essentials, so they’re worth doing before an assessment.

Before you start

• Find the router. It’s usually the box with your broadband provider’s logo.
• Look on the sticker underneath for the admin address (often something like 192.168.1.1), the admin username and the admin password. The admin password is not the same as the Wi-Fi password.
• Pick a quiet time. Some changes restart the router and drop everyone’s connection for a minute or two.

1. Change the admin password

Sign in to the admin page from a computer on the office network. If the admin password is still the one printed on the sticker, change it to something long and unique and store it in your password manager. Cyber Essentials requires default admin passwords on firewalls and routers to be changed to a strong, unique one.

2. Turn off remote admin

Look for a setting called remote management, remote access or web access from WAN, and switch it off. Cyber Essentials says the admin page shouldn’t be reachable from the internet unless there’s a documented business need, and then only behind multi-factor authentication or a short list of trusted IP addresses. If your IT provider manages the router remotely, ask them how it’s protected.

3. Update the firmware

Router software has security holes like anything else. Look for firmware update or software update, install anything waiting and turn on automatic updates if it’s offered. If the manufacturer stopped releasing updates years ago, it’s time for a new router. Your broadband provider will often send one free.

4. Check the Wi-Fi encryption

In the wireless settings, choose WPA3 if every device supports it, or WPA2/WPA3 mixed mode if not. Avoid anything labelled WEP, WPA or “open”. Give the network a long password that isn’t written on the wall, and change it when someone leaves.

5. Give guests their own network

Most routers can run a separate guest network. Turn it on for visitors, personal phones and smart devices like TVs and speakers. Guests get the internet and nothing else, so they can’t see your shared drives, printers or cameras.

6. Switch off what you don’t use

Two settings are often on by default and rarely needed in an office:

• WPS, the push-button pairing feature, which has a history of weaknesses
• UPnP, which lets devices on your network open holes in the firewall without asking anyone

Also look at any port forwarding rules. Each one is a door from the internet into your network. If nobody knows what a rule is for, find out and remove it if it isn’t needed. Cyber Essentials expects every inbound rule to be approved, documented and removed when it’s no longer used.

Write it down

Keep a short note somewhere safe: the router model, where the admin password is stored, the date you updated it, and what each port forwarding rule is for. Next time something goes wrong, or an assessor asks, you won’t be starting from scratch.

FAQ

Do home routers count for Cyber Essentials?

Only if your business supplies the router. Home routers your staff own are out of scope, so the requirements expect a software firewall to be switched on on each work laptop instead.

Is the firewall built into my router enough?

For most offices, yes, as long as it blocks unrequested inbound connections by default, which nearly all do. The steps above are about making sure nobody else can change it.

Should I hide the Wi-Fi network name?

It doesn’t add much. Hidden networks are easy to find with free tools and can make devices harder to connect. A strong password and WPA2 or WPA3 do the real work.