How to configure a new router

Decide where the router is going before you plug anything in. For a mobile router, that means the position with the best signal, which is usually high and near a window on the side of the building facing the mast. For a fixed-line router, it means as central to the building as the incoming cable allows.

If the router takes a SIM, insert it with the unit powered off. Note the SIM size required and use an adapter if necessary rather than forcing a card into the tray. If the SIM has a PIN, either disable it on a phone first or be ready to enter it in the router's admin page.

Find the default Wi-Fi name, Wi-Fi password and admin password on the label underneath the unit and photograph it. You will need those details in a minute, and the label is invariably the hardest thing to read once the router is mounted on a wall.

Power the router on and give it two to three minutes to boot and register on the network. Rushing this step causes a great many unnecessary factory resets. Wait until the status indicator settles into its normal operating state before judging anything.

Connect a laptop or phone to the default Wi-Fi network using the password on the label, then open a browser and go to the router's admin address — commonly 192.168.1.1, 192.168.0.1 or 192.168.8.1, printed on the same label. Log in with the default administrator credentials.

The very first change you make should be the administrator password. This is separate from the Wi-Fi password and is the credential that protects every setting on the device. Leaving it at the factory default is the single most common security failure we see in the field.

Set a network name that identifies the network to you without identifying you to everyone in the street. Avoid your surname, house number or business name. Give the 2.4 GHz and 5 GHz networks the same name so that devices move between them automatically, unless you have equipment that specifically needs a 2.4 GHz-only network.

Choose WPA3 if every device supports it, or WPA2/WPA3 mixed mode if you have older equipment. Never use WEP or an open network. Pick a passphrase of at least twelve characters — three unrelated words with a number are easy to dictate over the phone and hard to guess.

Turn off WPS. It is convenient and it is also a well-known weakness, and pairing a device manually takes only a few seconds longer.

Enable automatic firmware updates if the router offers them, or check manually for an update now. Manufacturers fix real security problems in firmware, and an unpatched router is exposed for as long as it stays unpatched.

Set the time zone correctly. It sounds trivial, but it makes logs readable and lets any scheduled features such as guest network hours or parental controls work as you expect.

Enable the guest network if you will have visitors or customers on the connection. A guest network gives internet access while keeping those devices away from your computers, printers and cameras, and it costs nothing to turn on.

• Change the admin password.
• Set a strong Wi-Fi passphrase with WPA2/WPA3.
• Disable WPS.
• Update the firmware.
• Enable the guest network.
• Reserve fixed local addresses for printers, cameras and network recorders.

Walk the building with a phone and check coverage in every room you care about, including outdoors if that matters to you. Note anywhere the signal falls away, because that is where a mesh node or access point will need to go later.

Run a speed test on a wired connection and again over Wi-Fi so you have a baseline recorded for the day of installation. When someone says months later that the internet has got slower, that baseline is the only way to know whether it has.

Finally, record the admin password, Wi-Fi passphrase and the router's admin address somewhere you will find them in a year. The most common reason for a needless factory reset is a forgotten administrator password.