How to Know If Your Router Was Hacked: Warning Signs, Checks and Fixes
If you are trying to work out how to know if your router was hacked, you are looking at the right device. Your router sits between every phone, laptop and smart TV in your home and the internet. If an attacker controls it, they may be able to redirect your traffic, watch what you do, or use your connection for their own purposes, and your antivirus may never notice.
The tricky part is that a hacked router often looks like a slow or glitchy one. This guide explains the real warning signs, shows you how to check your router step by step, helps you separate genuine compromise from ordinary problems, and lays out what to do if you find something wrong.
Answer
Your router may be hacked if you are locked out of its admin page, its DNS or Wi-Fi settings changed without you, unknown devices appear, remote management is switched on, or you are redirected to fake sites. No single sign proves it, so check the settings, then reset, update and secure the router.
Why Attackers Go After Routers
A router is a small computer running its own software, called firmware. It decides where your traffic goes, which devices can connect, and which doors are open to the internet. Because it handles everything, taking control of it is more valuable to an attacker than infecting one laptop.
Routers are also easy to neglect. Most people set one up once and never log in again. Firmware updates are often manual, default passwords stay unchanged, and manufacturers eventually stop releasing security patches for older models. A US FBI alert reported in 2025 warned that criminals were targeting these unsupported, end-of-life routers, installing malware and selling access to the hijacked devices to other criminals. The same reporting noted that this kind of infection is hard to spot because standard antivirus software does not scan router firmware.
That does not mean every router is compromised. It means the router deserves a periodic check, just like a smoke alarm.
How Routers Actually Get Hacked
Understanding the common routes in helps you judge which warning signs matter most.
- Default or weak admin passwords. Many routers ship with a username and password printed on a label or published online. If you never changed them, anyone on your network, or anyone who can reach the login page, has a head start.
- Outdated firmware. Known security flaws are published and then exploited against devices that were never updated.
- Remote management left on. This feature lets you reach the admin page from outside your home. It is rarely needed and is a common way in. US government guidance repeatedly recommends turning it off.
- Unsupported hardware. Once a manufacturer ends support, new flaws stay unpatched permanently.
- Malicious pages and scripts. A fake or compromised website can sometimes trick a browser into changing router settings, especially if the router still uses default credentials.
- Risky features such as UPnP. Universal Plug and Play lets devices open network ports automatically. Some security guides recommend turning it off unless a device genuinely needs it.
- Physical access. Anyone who can touch the router can reset it and log in with the default details.
What a Hacked Router Can Be Used For
Knowing the goal helps you take the risk seriously. A compromised router can be used to redirect your devices to fake login pages, which is how stolen passwords and banking details are collected. It can also quietly relay other people’s traffic through your connection, so their activity appears to come from your address. Some attacks aim to enlist the router in a botnet, a network of hijacked devices that criminals rent out or use to attack other targets.
In many of these cases you notice nothing at all. That is why the quieter checks, such as DNS, remote access and firmware, matter more than waiting for visible symptoms.
Warning Signs at a Glance
Use this table as a first pass. The right-hand column matters as much as the left, because many of these symptoms have innocent explanations.
| Warning sign | How concerning | Possible innocent explanation |
| Locked out of router admin with your usual password | High | You changed it and forgot, or a firmware update reset settings |
| DNS servers you do not recognize | High | Your ISP or a service you set up deliberately |
| Redirects to odd sites or constant pop-ups | High | Adware on a single device, or a bad browser extension |
| Remote management or unknown port forwards enabled | High | You or a past technician enabled them for a reason |
| Wi-Fi name or password changed | Medium to high | A family member or ISP technician |
| Unknown devices in the connected list | Medium | Smart TVs, printers, guests, or devices with generic names |
| Slow or unstable internet | Low on its own | ISP problems, congestion, weak Wi-Fi signal, old hardware |
| Router running hot or restarting | Low on its own | Poor ventilation, failing hardware, power problems |
| Security software warnings about network threats | Medium | A single infected device rather than the router |
The Warning Signs in Detail
You cannot log in to the router
If your known admin password suddenly fails, treat it seriously. Legitimate router software does not normally change its own password. First rule out the simple explanations: did you recently reset the router, did the ISP replace it, or did someone else change the password? If none of those apply, assume someone else may have changed it.
Your DNS settings changed
DNS is the system that turns a website name into an address, like a phone book for the internet. In a DNS hijack, an attacker changes the router’s DNS settings so that your devices use servers they control. Those servers can send you to convincing copies of real sites, including banking pages.
Because the change sits in the router, every device on your network is affected. Look for DNS server addresses you do not recognize. One nuance: it is normal for a router to list its own private address as the DNS server, because it passes requests along. What matters is the upstream DNS, which should be your ISP’s servers or a public service you chose yourself, such as Cloudflare or Google.
Unexpected redirects, pop-ups and certificate warnings
Pop-up ads on sites that normally have none, fake antivirus alerts, and repeated “your connection is not private” errors can all point to DNS tampering. The test that separates a router problem from a device problem is simple: if the behavior appears on several unrelated devices, such as your phone and a laptop, the router becomes a much stronger suspect. If it happens only on one computer, start by scanning that computer.
Devices you do not recognize
Your router’s connected-devices list is useful, but it needs careful reading. Many legitimate devices appear with confusing names, such as a string of letters and numbers, or the manufacturer’s name. Count what you own, including TVs, consoles, speakers, plugs, printers and phones, and compare. An unexplained extra device is worth investigating. The more reliable move is to change your Wi-Fi password, reconnect only your own devices, and see whether the stranger reappears.
Changed Wi-Fi name, password or security settings
If the network name differs, the firewall is off, or the encryption type has been downgraded, someone with admin access made those changes. Again, check whether a household member or technician is responsible.
Remote management and strange port forwarding rules
Look for remote management, remote administration or remote access. If it is on and you did not enable it, that is a significant finding. Also review port forwarding and virtual server entries. Rules you did not create can expose devices on your network to the internet.
Slowdowns, overheating and instability
These are the weakest signs, because they are far more often caused by ordinary issues. They deserve attention when they appear alongside other signs. The FBI has listed overheating, unusual setting changes and poor connectivity among symptoms that may accompany an infection, but treat them as prompts to check, not proof.
How to Check Your Router Step by Step
Do these checks from a device you trust, ideally connected by Ethernet cable. If you suspect the Wi-Fi itself is compromised, a wired connection avoids doubt. Write down what you find before changing anything.
- Find the router’s address. Common addresses include 192.168.1.1 and 192.168.0.1. On Windows, open Command Prompt and type ipconfig; the Default Gateway is your router. On a Mac, look in Network settings for the router address. A label on the router often lists the address too.
- Log in. Use your own admin credentials, not the Wi-Fi password. If they fail and you did not change them, note that as a warning sign.
- Check DNS. Find the Internet, WAN or DNS section. Compare the DNS servers with your ISP’s documented servers or any you configured yourself. Write down anything unfamiliar.
- Review remote management. Find the setting under Administration, Remote Access or similar. It should normally be off.
- Review port forwarding and UPnP. Delete rules you did not create. Consider turning UPnP off, and test that your games and smart devices still work.
- Inspect connected devices. Match each entry to something you own. Note the unknown ones and their addresses.
- Check the firmware version. Compare it with the latest version on the manufacturer’s support page. Also look up whether your exact model still receives security updates.
- Read the logs if your router keeps them. Look for logins or setting changes at times you were not home.
A useful extra test: temporarily set the router’s DNS to a well-known public service such as Cloudflare (1.1.1.1) or Google (8.8.8.8). If strange redirects stop, that supports the DNS-hijack explanation. Note that this is a diagnostic aid, not a cure, because the underlying access still needs closing.
Is It Hacked or Just a Glitch? A Simple Framework
Because many symptoms are ambiguous, sort what you found into three groups.
| Level | What you found | What to do |
| Likely compromised | Locked out unexpectedly, unknown DNS servers, remote management on without your action, or rules you did not create | Follow the full recovery steps below |
| Possibly compromised | Several mild signs together, or an unexplained device plus unusual behavior on multiple devices | Change admin and Wi-Fi passwords, update firmware, recheck in a few days; reset if signs persist |
| Probably not compromised | One mild sign such as slowness, with all settings as expected | Restart the router, check with your ISP, test other devices, and harden the router |
An illustrative scenario (hypothetical, not a real case): Suppose pop-ups appear on both a laptop and a phone, and the router’s DNS lists an address neither you nor your ISP set. Two unrelated devices plus an unfamiliar DNS entry put this firmly in the “likely compromised” group. By contrast, a single laptop showing pop-ups while the router settings are untouched points toward adware on that laptop.
What to Do If Your Router Was Hacked
Work through these in order. Use a clean device, and if possible a different network such as mobile data, for password changes.
- Note your current settings. Take photos of the admin pages. Some internet connections need ISP login details to reconnect after a reset, so check with your ISP first if the router came from them.
- Factory reset the router. Use the small reset button or the admin menu. This wipes changed DNS entries, rogue rules and passwords, but it is not always enough on its own.
- Install official firmware. Download the latest version only from the manufacturer’s support site and apply it. If your model no longer receives updates, go to step 8.
- Set a new admin username and password. Use a long, unique password that you have not used elsewhere. A password manager helps. US guidance has suggested long random passwords for router admin pages.
- Set up Wi-Fi again. Use WPA3 if available, or WPA2 with AES. Choose a new Wi-Fi password and reconnect only your own devices.
- Switch off risky features. Turn off remote management and WPS, and consider turning off UPnP.
- Change important passwords. If DNS hijacking was possible, change passwords for email, banking and cloud accounts, using a trusted device, and turn on multi-factor authentication. Scan your computers with reputable security software.
- Replace the router if it is unsupported or reinfection continues. Some attackers use techniques that persist through reboots, so replacement is the safer option for old hardware.
- Report it if appropriate. In the US, you can file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Readers elsewhere should use their national reporting service, and your ISP can often help.
If your router was supplied by your ISP, contact them before replacing it. They may swap it, push a firmware update remotely, or confirm which settings are theirs.
How to Confirm the Problem Is Fixed
After cleaning up, give the network a few days and then verify. Log in again and confirm that DNS, remote management and port forwarding still match what you set. Check that the connected-devices list contains only your own devices, and watch whether the redirects or pop-ups return on any device. Repeat the check after a week.
If a setting you fixed has changed again, or you are locked out a second time, do not keep resetting. That pattern suggests either reinfection through unpatched firmware or access from someone with physical or network access, and replacing the router, or asking your ISP to investigate, becomes the sensible next move.
When You Should Replace Your Router
Replace the router when the manufacturer no longer provides security updates, even if it still works. Lifespans vary by brand and model, so check the support page for your exact model rather than relying on a general rule. FBI warnings in 2025 singled out older models, particularly those from around 2010 and earlier, along with specific Linksys models that no longer receive support.
When buying a replacement, look for a manufacturer that publishes a support or update policy, offers automatic firmware updates, and supports current Wi-Fi security. A faster router is a bonus. A supported one is the point.
How to Prevent Your Router Being Hacked
Prevention takes about twenty minutes and removes most of the common routes in.
- Change the default admin username and password.
- Turn on automatic firmware updates if your router offers them, or check manually every few months.
- Disable remote management unless you truly need it.
- Use WPA3 or WPA2 with AES, and a long Wi-Fi password.
- Turn off WPS and, where practical, UPnP.
- Create a guest network for visitors and consider a separate network for smart-home devices.
- Keep the router in a place where visitors cannot easily reach the reset button.
- Review the connected-devices list and settings every few months.
US National Security Agency guidance for home networks recommends several of these measures, including firmware updates, disabling remote administration, and segmenting your network into main, guest and smart-device networks.
Common Mistakes to Avoid
- Assuming antivirus covers the router. It scans your devices, not the router’s firmware.
- Resetting without a plan. Skipping the step of saving ISP details can leave you offline.
- Resetting but keeping the old firmware and password. The router can be compromised again quickly.
- Panicking over unknown devices. Many are your own gadgets with unhelpful names.
- Using only one sign as proof. Slow speeds alone rarely mean a hack.
- Downloading firmware from search results. Use the manufacturer’s official support page only.
- Ignoring the router’s age. A fully reset but unsupported router remains exposed to known flaws.
Conclusion
Knowing how to tell if your router was hacked comes down to checking a few specific places: whether you can still log in, what DNS servers are set, which devices are connected, whether remote management is on, and whether the firmware is current and supported. Individual symptoms can be innocent, but a combination, or one serious sign like unknown DNS servers, deserves action.
Your next step is simple: log in to your router today, run through the eight checks above, and write down what you find. If anything looks wrong, reset, update, secure and, if the model is unsupported, replace it.
Frequently Asked Questions
Can antivirus software detect a hacked router?
Usually not. Standard antivirus tools protect your computers and phones, but they do not scan router firmware. Some security vendors offer router or network checkers, though these have limits, so manual checks of DNS, remote access and firmware remain important.
Will a factory reset remove a hacker?
A factory reset removes changed settings and passwords, which fixes many compromises. It may not remove malicious firmware or a flaw that allows reinfection. Reset, then install official firmware, set new credentials and disable remote management. Replace the device if it is unsupported.
Does an unknown device on my network mean I was hacked?
Not necessarily. Smart devices, printers and guest phones often appear with generic names. Count your devices, change the Wi-Fi password, reconnect your own and see whether the unknown device returns.
Can someone hack my router without my Wi-Fi password?
Yes, in some cases. Attacks can target the router’s admin interface or unpatched flaws, especially when remote management is on or the firmware is outdated. A strong Wi-Fi password helps but does not replace updates and a strong admin password.
Should I tell my internet provider?
Yes, particularly if the router is ISP-supplied. They can check the device, update firmware, and confirm whether odd settings are theirs.