What to do if…
your router settings show remote administration was turned on and you did not enable it

What to do now

1. Disconnect the router from the internet.
   Unplug the WAN or Internet cable, or power off the modem-router if it is one combined device. This gives you a safer pause while you check settings.

2. Take quick photos or screenshots before changing anything major.
   Capture the remote administration setting, firmware version, admin users, port forwarding rules, firewall rules, DNS settings, connected-device list, and recent logs if they are easy to see.

3. Log in from inside your home network.
   Use a wired Ethernet connection if you can. If you use Wi-Fi, make sure it is your own network and not a public or guest network.

4. Turn off remote administration.
   Disable settings called Remote Administration, Remote Management, Web Access from WAN, Admin from Internet, or similar. If the router offers “local network only” admin access, choose that. Disable unknown or unused cloud-management access unless your ISP clearly requires it for support.

5. Change router admin access.
   Set a strong, unique router admin password. Change the admin username if the router allows it. If the router supports multi-factor or 2-step verification for admin access, turn it on. Use any “sign out all sessions” option if available.

6. Check the settings attackers commonly change.

   • DNS: set it back to automatic or to a trusted DNS provider you chose.
   • Port forwarding and firewall rules: remove rules you did not create.
   • UPnP: turn it off unless you deliberately need it.
   • WPS: turn it off.
   • Admin accounts: remove or disable any account you do not recognize.
   • Unknown devices: note them, but do not panic; some device names are vague.

7. Update firmware using only an official route.
   Use the router’s built-in update page, your ISP’s official app, or the router manufacturer’s official support site. Do not use update links from pop-ups, unexpected emails, or search ads.

8. Reboot, reconnect the internet, and re-check.
   After the update or setting changes, reconnect the internet and confirm remote administration is still off. Check that DNS and port forwarding rules stayed as you set them.

9. Factory reset if control still looks unreliable.
   Factory reset and rebuild the router settings manually if remote administration turns back on, you cannot change the admin password, unknown admin accounts return, or the router is unsupported and no longer receiving updates. Do not restore an old backup unless you are sure it was made before the suspicious change.

10. Contact your ISP if it is ISP equipment or you cannot secure it.
    Ask whether remote administration was enabled by them, whether the router is still supported, and whether they can replace it. Use the phone number, website, or app printed on your bill or on the ISP’s official site.

11. After the router is stable, change Wi-Fi access.
    Set a new WPA3 or WPA2 Wi-Fi password. Reconnect devices one at a time so you can notice anything you do not recognize.

12. Protect important accounts if there are signs of wider compromise.
    If you saw suspicious account logins, password-reset emails you did not request, or unknown devices using the network, change your email password first, turn on 2-factor authentication, and sign out of other sessions.

13. Report only if there is cybercrime, fraud, or identity harm.
    You can report cyber-enabled crime to IC3. If your identity or accounts were misused, use IdentityTheft.gov for recovery steps.