Signs Your Router Is Hacked: What to Look For

Why a hacked router matters

Your router is the front door to your home network. An attacker who controls it can change DNS settings, redirect your traffic, capture passwords, or add unwanted firewall rules. Because the router sits between your devices and the internet, a compromise can affect every phone, computer, smart home gadget, and router security basics.

No single symptom is proof of an attack. Many common signs also happen with failing hardware, outdated firmware, or a bad internet connection. The combination matters. If several of the following signs appear at once, treat the router as compromised until you can rule it out.

Unexpected changes to router settings

The most direct sign is a router that no longer works the way you set it. The admin password may fail, the network name or Wi-Fi password can change, unknown profiles can appear, or settings you never touched show up in the admin panel. Attackers often change DNS servers first because those settings redirect your browsing traffic without making an obvious change.

If your login no longer works, use the reset button to restore defaults and set a new admin password before doing anything else. You will need to reconfigure the network afterward.

Unknown devices on your network

A device on your Wi-Fi that you do not recognize can be the cause of odd behavior, though it can also be a guest device, a neighbor with your password, or an old smart device you forgot. Log in to the router and review the connected device list. If you see a suspicious entry, block it and change the Wi-Fi password.

The walkthroughs for how to see connected devices and what to do about an unknown device cover this process in more detail.

Redirects and changed DNS behavior

If your browser lands on pages you did not request, or a familiar site shows a security warning for a completely different domain, DNS resolution may have been tampered with. A hacked router can send your traffic to a malicious server even when you type the address correctly.

Check the DNS settings in the router's admin panel and compare them with the values your internet provider publishes. If the router uses a DNS server you did not configure, treat it as a red flag. Reviewing DNS on routers can help you understand what a normal configuration looks like.

Sudden slowdowns, outages, and odd traffic

A compromised router can become slow because it is forwarding traffic to an attacker, running background scans, or taking part in a larger attack. Symptoms can include a network that freezes, downloads that stall, Wi-Fi that drops at odd hours, or high processor usage on the router's status page. None of these prove a hack, but they are worth investigating.

Check the router's system log if it has one and look for repeated login attempts or unexplained reboots. See how to read router logs for where to start.

What to do immediately

If you suspect an active compromise, contain it first. Disconnect the router from the modem, perform a factory reset, update the firmware, and set a strong admin password before reconnecting it to the internet.

The factory reset guide and firmware update guide give step-by-step instructions. After the reset, review every setting before putting the router back into service.

• Disconnect the router from the modem or ONT.
• Use the physical reset button to return the router to factory defaults.
• Update the router firmware before reconnecting it.
• Change the admin password and the Wi-Fi network name and password.
• Reconnect devices one by one and watch the device list.

When to replace the router instead

A factory reset clears most unwanted configuration changes, but it is not a complete fix. Malware can sometimes survive in the router's firmware or hide in an update mechanism. If the router is several years old, no longer receives firmware updates, or cannot install modern security protocols, replacement is safer.

Modern routers support WPA3, which the Wi-Fi Alliance says is mandatory for Wi-Fi CERTIFIED devices. WPA3 networks disallow outdated legacy protocols and require Protected Management Frames. An older router cannot offer this protection. If yours cannot, see when to upgrade your router for guidance.

Preventing a repeat compromise

Once the router is clean, set up protections that make a second attack harder. Use a unique admin password, enable WPA2 or WPA3 with a strong Wi-Fi passphrase, turn on automatic firmware updates if available, and review connected devices regularly. The security page from the Wi-Fi Alliance describes WPA3 as using the latest security protocols and disallowing outdated legacy protocols.

If your router cannot meet that bar, look at newer hardware. See best Wi-Fi 6 routers and best Wi-Fi 7 routers for current options.

What to pick for your use

Questions

Can a router really be hacked?

Yes. A router connects your whole network to the internet, so attackers sometimes target it directly. Using default passwords, outdated firmware, or weak Wi-Fi encryption makes the job easier.

What should I do first if I think my router is hacked?

Disconnect the router from the modem, perform a factory reset, update the firmware, and set a strong admin password before reconnecting. Then change your Wi-Fi network name and password.

Does a factory reset remove router malware?

A reset clears configuration changes such as rogue DNS settings and unknown rules, but it may not remove malware stored in the firmware. If you are not confident the router is clean after a reset, replace it.

How can I tell if my router is safe after a reset?

Check that the firmware is updated, confirm the admin password works, review the connected device list for unfamiliar entries, and look for any settings you did not configure. If anything unusual returns, replace the router.

Is a hacked router more dangerous than a hacked computer?

It can be, because it sees traffic from every device on your network. A compromised router can redirect you to phishing sites, weaken encryption, or install malicious software on connected devices.

Should I replace my router if it is old but still works?

If it no longer receives firmware updates or cannot support modern security features, replacement is safer even if it still works. Old firmware is a common way attackers get in.