How to Secure Your Router and Switch: Best Security Settings 2026

 Most network breaches do not begin with a sophisticated exploit. They begin with a device that was never configured beyond plugging it in.

Default administrator passwords for virtually every router model are published openly. Remote management is enabled by default on a surprising number of devices. WPS remains switched on in millions of homes despite a known, unfixable design flaw. None of this requires skill to exploit — it requires only someone bothering to look.

This guide covers how to secure your router and switch properly, separated into home settings and enterprise settings, with an honest assessment of what each measure actually protects against.

Start With the Change That Matters Most

Change the default administrator password. Not the Wi-Fi password — the password that logs into the device's configuration.

These are different credentials and people confuse them constantly. A strong Wi-Fi passphrase with a default admin password of "admin" means anyone who joins your network, including a guest you invited, can reconfigure the entire thing.

Default credential lists for every major manufacturer are freely available online. They are not secret, they are documentation.

While you are there:

1. Change the default username too if the device allows it.
2. Use a genuinely long passphrase, not a short complex one. Length defeats brute force far more effectively than symbols.
3. Do not reuse a password you use anywhere else.
4. Record it somewhere secure — a password manager, not a note taped to the device.

This single change eliminates the largest category of real-world router compromise.

Home Router Settings, in Order of Importance

1. Use WPA3, or WPA2 with AES

WPA3 encryption is the current standard and should be selected if both your router and your devices support it.

If any device cannot support WPA3, use WPA2-Personal with AES.

Never use:

• WEP — broken for two decades. It can be cracked in minutes.
• WPA with TKIP — deprecated and vulnerable.
• An open network with no passphrase.
• Mixed mode WPA/WPA2 unless genuinely required for an old device, because it permits the weaker protocol.

Choose a passphrase of at least 15 characters. A passphrase of several unrelated words is both stronger and easier to type than a short string of symbols.

2. Disable WPS

Disable WPS — this is not optional advice.

WPS was designed to simplify connecting devices using an eight-digit PIN. The implementation has a flaw: the PIN is validated in two halves, which reduces the number of possible combinations from 100 million to roughly 11,000. That is a few hours of automated guessing.

The flaw is in the specification, not a bug in one vendor's firmware. It cannot be patched away. Turn it off.

3. Disable remote management

Almost every router has an option to allow configuration from the internet. On some models it is enabled by default.

Unless you have a specific, ongoing need for it, disable it. If you genuinely need remote access, use a VPN into your network rather than exposing the management interface directly.

Also disable any Telnet or plain HTTP management and use HTTPS only.

4. Keep firmware updated

Firmware updates patch real, exploited vulnerabilities. Routers are attacked constantly because they are always on, always connected, and rarely updated.

1. Check for updates a few times a year at minimum.
2. Enable automatic updates if your router offers them and you trust the vendor.
3. Check whether your model is still supported. A router that stopped receiving updates three years ago should be replaced, regardless of whether it still works.

5. Use the guest network properly

A guest network isolates visitors from your main network.

Configure it correctly:

• Enable client isolation so guest devices cannot see each other or your devices.
• Use a different passphrase from your main network.
• Change that passphrase periodically.
• Put untrusted smart home devices on it rather than your main network. Many such devices receive infrequent security updates and are a genuine weak point.

6. Review connected devices

Most routers list every connected device. Look at it occasionally.

An unfamiliar device is worth investigating, though be aware that device names are often unhelpful and a phone may appear under a manufacturer code rather than a person's name.

7. Be realistic about SSID hiding and MAC filtering

Hiding your network name does not meaningfully improve security. The network name is still broadcast by connecting clients and any basic scanning tool reveals it. It mainly inconveniences you.

MAC address filtering is similarly weak. MAC addresses are transmitted unencrypted and can be copied trivially. It stops a casual neighbour and nobody else.

Neither is harmful, but do not substitute them for a strong passphrase and current encryption.

8. Check your DNS settings

A documented attack pattern involves altering a router's DNS servers so that traffic is silently redirected.

Check the DNS settings in your router periodically. If they show addresses you do not recognise and did not configure, that is a serious indicator of compromise. Reset the device, update its firmware, and change all credentials.

Enterprise Switch and Router Security

The principles differ because the threat model differs. On business equipment, physical access and internal misuse matter as much as external attack.

Use enable secret, never enable password

enable secret YourStrongPassphrase

enable password stores the value in a form that is trivially reversible. enable secret stores a hash. If both are configured, enable secret takes precedence — but leaving the weaker one configured serves no purpose.

Encrypt stored passwords, with realistic expectations

service password-encryption

Be honest about this command. It applies weak, reversible encryption to plain-text passwords in the configuration file. It prevents someone reading a password over your shoulder or from a printed configuration. It does not protect against anyone who obtains the file and wants the password.

Use it, but do not consider the problem solved by it.

Replace Telnet with SSH

SSH instead of Telnet is one of the most important changes on any managed device.

Telnet transmits everything — including your password — in plain text. Anyone capturing traffic on that segment reads your credentials directly.

Configuring SSH:

hostname SW1
ip domain-name example.local
crypto key generate rsa modulus 2048
ip ssh version 2
username admin privilege 15 secret StrongPassphrase
line vty 0 15
 transport input ssh
 login local
 exec-timeout 10 0
 exit

Two details that catch people out:

1. A hostname and domain name must be set before generating the key. The key is named after them.
2. transport input ssh explicitly forbids Telnet. Without it, both remain available and Telnet will be used by anyone who defaults to it.

exec-timeout 10 0 closes idle sessions after ten minutes, which protects against an unattended terminal.

Restrict who can connect

access-list 10 permit 192.168.100.0 0.0.0.255
line vty 0 15
 access-class 10 in

This permits management connections only from a specific administrative subnet. It is a significant improvement over allowing connections from anywhere on the network.

Secure unused ports

Unused port security is routinely neglected, and it is the easiest physical attack vector in any building.

interface range gigabitEthernet 0/20 - 24
 shutdown
 switchport access vlan 999

Two measures combined: the ports are administratively disabled, and assigned to an unused VLAN with no route anywhere. If someone enables a port, it still leads nowhere.

Apply port security on active ports

interface gigabitEthernet 0/5
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict

This limits which devices may use a port. The maximum of two rather than one accommodates IP phones with a pass-through port, which are extremely common.

Choose the violation mode deliberately. restrict drops traffic and logs it. shutdown disables the port entirely, which is more secure but generates support calls.

Move management off VLAN 1

VLAN 1 is the default on every Cisco switch, which makes it the first thing an attacker assumes.

vlan 99
 name MANAGEMENT
 exit
interface vlan 99
 ip address 192.168.99.10 255.255.255.0
 no shutdown
 exit
interface vlan 1
 shutdown

Change the native VLAN on trunks as well:

interface gigabitEthernet 0/24
 switchport trunk native vlan 999

The native VLAN carries untagged traffic on a trunk. Leaving it as VLAN 1 enables a known VLAN hopping technique. Set it to an unused VLAN that carries nothing.

Enable protective features

interface range gigabitEthernet 0/1 - 20
 spanning-tree portfast
 spanning-tree bpduguard enable

PortFast brings access ports up immediately. BPDU Guard shuts a port down if it receives spanning-tree messages — which should never happen on a port connected to a computer. Together they prevent a user plugging in an unauthorized switch and creating a loop.

Also consider DHCP snooping, which blocks unauthorized DHCP servers from the network. An accidental second DHCP server is one of the most disruptive things that can happen to a business network.

Log everything, with accurate time

service timestamps log datetime msec
logging buffered 16384
ntp server 1.1.1.1

Logs without accurate timestamps are nearly useless during an incident. Configure NTP on every device so that events across multiple devices can be correlated.

Add a login banner

banner motd #Authorized access only. All activity is monitored.#

This is a legal measure rather than a technical one, and it is standard practice in corporate environments.

A Practical Security Checklist

For a home network:

1. Changed the admin password.
2. WPA3 or WPA2-AES with a long passphrase.
3. WPS disabled.
4. Remote management disabled.
5. Firmware current, and the model still supported.
6. Guest network enabled with isolation.
7. DNS settings verified.
8. Connected device list reviewed.

For business equipment:

1. enable secret configured, enable password removed.
2. SSH only, Telnet explicitly disabled.
3. Management restricted by access list.
4. Unused ports shut down and placed in an unused VLAN.
5. Port security on access ports.
6. Management moved off VLAN 1.
7. Native VLAN changed on all trunks.
8. PortFast and BPDU Guard on access ports.
9. Logging enabled with NTP.
10. Configurations backed up and stored securely.

Mistakes That Undermine Everything Else

1. A strong Wi-Fi passphrase with a default admin password.
2. Relying on hidden SSIDs or MAC filtering as primary defences.
3. Leaving Telnet enabled alongside SSH.
4. Running firmware that is years out of date.
5. Using the same credentials across every device, so one compromise exposes all of them.
6. Leaving unused ports live in publicly accessible areas.
7. Never reviewing logs, so a compromise goes unnoticed for months.
8. Storing configuration backups unencrypted — they contain password hashes and your entire network design.

Conclusion

Security on network devices is not about exotic features. It is about not leaving the obvious doors open, and the obvious doors are default credentials, outdated firmware, plain-text management protocols, and live unused ports.

Do one thing in the next ten minutes: log into your router and change the administrator password, then confirm that remote management is disabled. Those two settings address the most commonly exploited weaknesses in any network, and they are the correct starting point for anyone who wants to secure your router and switch properly rather than hopefully.