How to Tell If Your Router Has Been Hacked (8 Warning Signs)

~/sheets/router-hacked-signs.md
Your Router Is the Front Door to Your Network
If an attacker compromises your router, they can intercept all traffic on your network — passwords, banking, everything. Here are the warning signs and what to do.
Warning Signs
Internet is unusually slow — an attacker using your bandwidth. Run a speed test and compare to your plan.
Unknown devices on your network — check your router's connected devices list. See our WiFi intruder detection guide.
DNS settings changed — if your router's DNS was changed to unknown servers, an attacker is redirecting your traffic. Run a DNS leak test.
You cannot access router admin — if your admin password no longer works, someone changed it.
Browser redirects — being sent to strange websites you did not type in.
Fake antivirus popups — appearing on multiple devices on the same network.
Strange outbound traffic — scan for open ports that should not be open.
Router firmware was changed — check the firmware version against the manufacturer's website.
How to Fix a Hacked Router
Factory reset — press and hold the reset button for 10-30 seconds. This wipes all settings including malware.
Update firmware — download the latest firmware from the manufacturer's official website.
Change admin password — use a strong, unique password. Never use the default.
Change WiFi password — use WPA3 or WPA2 with a strong password.
Disable remote management — turn off remote access to the admin panel.
Change DNS settings — set to trusted DNS like 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9). See our DNS server guide.
Check all devices — run malware scans on every device that was on the network.
Prevention
Keep firmware updated. Use strong admin and WiFi passwords. Disable WPS. Scan for open ports regularly. Follow our complete WiFi security checklist.
Last updated: April 2026