How to Tell If Your Router Has Been Hacked (8 Warning Signs)

Q: How do I know if my router has been hacked?

Watch for unusually slow internet, unknown devices on your network, DNS settings changed to unfamiliar servers, an admin password that no longer works, unexpected browser redirects, fake antivirus popups across devices, strange outbound traffic or open ports, and firmware that does not match the manufacturer version.

Q: Can a router be hacked?

Yes. Your router is the front door to your network, so if an attacker compromises it they can intercept all your traffic — passwords, banking, everything. It usually happens through default or weak admin credentials, outdated firmware, or features like WPS and remote management left enabled.

Q: What are the signs of a hacked router?

The main signs are slow internet from someone using your bandwidth, unknown devices in the client list, changed DNS settings redirecting your traffic, losing access to the admin panel, browser redirects to strange sites, fake antivirus popups, unexpected open ports, and altered firmware.

Q: How do I fix a hacked router?

Factory reset it by holding the reset button for 10 to 30 seconds, update to the latest firmware from the manufacturer, set a strong unique admin password, change the WiFi password to WPA3 or WPA2, disable remote management, set DNS to a trusted resolver like 1.1.1.1 or 9.9.9.9, and run malware scans on every device that was on the network.

Q: How do hackers get into your router?

The most common routes are default or guessable admin passwords, outdated firmware with unpatched vulnerabilities, the brute-forceable WPS PIN, and remote management left enabled. Keeping firmware updated, using a strong admin password, and disabling WPS closes most of these doors.

~/sheets/router-hacked-signs.md

Your Router Is the Front Door to Your Network
If an attacker compromises your router, they can intercept all traffic on your network — passwords, banking, everything. Here are the warning signs and what to do.
Warning Signs
Internet is unusually slow — an attacker using your bandwidth. Run a speed test and compare to your plan.
Unknown devices on your network — check your router's connected devices list. See our WiFi intruder detection guide.
DNS settings changed — if your router's DNS was changed to unknown servers, an attacker is redirecting your traffic. Run a DNS leak test.
You cannot access router admin — if your admin password no longer works, someone changed it.
Browser redirects — being sent to strange websites you did not type in.
Fake antivirus popups — appearing on multiple devices on the same network.
Strange outbound traffic — scan for open ports that should not be open.
Router firmware was changed — check the firmware version against the manufacturer's website.
How to Fix a Hacked Router
Factory reset — press and hold the reset button for 10-30 seconds. This wipes all settings including malware.
Update firmware — download the latest firmware from the manufacturer's official website.
Change admin password — use a strong, unique password. Never use the default.
Change WiFi password — use WPA3 or WPA2 with a strong password.
Disable remote management — turn off remote access to the admin panel.
Change DNS settings — set to trusted DNS like 1.1.1.1 (Cloudflare) or 9.9.9.9 (Quad9). See our DNS server guide.
Check all devices — run malware scans on every device that was on the network.
Prevention
Keep firmware updated. Use strong admin and WiFi passwords. Disable WPS. Scan for open ports regularly. Follow our complete WiFi security checklist.
Frequently Asked Questions
How do I know if my router has been hacked?
Watch for unusually slow internet, unknown devices on your network, DNS settings changed to unfamiliar servers, an admin password that no longer works, unexpected browser redirects, fake antivirus popups across devices, strange outbound traffic or open ports, and firmware that does not match the manufacturer version.
Can a router be hacked?
Yes. Your router is the front door to your network, so if an attacker compromises it they can intercept all your traffic — passwords, banking, everything. It usually happens through default or weak admin credentials, outdated firmware, or features like WPS and remote management left enabled.
What are the signs of a hacked router?
The main signs are slow internet from someone using your bandwidth, unknown devices in the client list, changed DNS settings redirecting your traffic, losing access to the admin panel, browser redirects to strange sites, fake antivirus popups, unexpected open ports, and altered firmware.
How do I fix a hacked router?
Factory reset it by holding the reset button for 10 to 30 seconds, update to the latest firmware from the manufacturer, set a strong unique admin password, change the WiFi password to WPA3 or WPA2, disable remote management, set DNS to a trusted resolver like 1.1.1.1 or 9.9.9.9, and run malware scans on every device that was on the network.
How do hackers get into your router?
The most common routes are default or guessable admin passwords, outdated firmware with unpatched vulnerabilities, the brute-forceable WPS PIN, and remote management left enabled. Keeping firmware updated, using a strong admin password, and disabling WPS closes most of these doors.
Published: May 2026