To block unauthorized network access, sign in to your router, review the connected-devices list, and disconnect anything you cannot identify. Rotate the Wi-Fi passphrase, force WPA3 or WPA2-AES, disable WPS, and put guest and IoT gear on a separate SSID. Then verify with a fresh device scan.
Symptoms
- Devices you do not recognize appear in the router's DHCP client list.
- Sustained upload traffic at 2–4 a.m. when nobody in the household is online.
- Wi-Fi throughput drops noticeably on the 2.4 GHz band during idle hours.
- Smart plugs, cameras, or TVs reboot, drop off, or show unexpected commands.
- Router logs show repeated authentication attempts from unknown MACs.
Common Causes
Weak or reused Wi-Fi passphrase
Short passphrases and ones shared across friends, tenants, or leaked in breaches are the single most common entry point. Offline dictionary attacks on captured handshakes finish in minutes.
WPS PIN still enabled
The 8-digit WPS PIN has a known design flaw that reduces brute-force to roughly 11,000 tries. Many consumer routers leave it on by default even when the button is unused.
Outdated firmware with known CVEs
Unpatched routers expose authentication bypass and remote code execution flaws. Attackers scan public IP ranges continuously for vulnerable models.
Legacy encryption (WEP or WPA1/TKIP)
These protocols are broken and can be decrypted with widely available tools. Any network still running them is effectively open.
Exposed admin interface
Remote management enabled on the WAN side, combined with default admin credentials, hands over the entire network without touching Wi-Fi at all.
Step-by-Step Fix
- Sign in to the router and audit the connected-devices list
Reach the admin panel at the gateway address shown by ipconfig or ip route (commonly 192.168.0.1, 192.168.1.1, or 192.168.178.1 on FRITZ!Box). Open the DHCP or connected-clients page. Cross-check every MAC against phones, laptops, printers, and IoT gear you own. Rename known devices so future audits take seconds. - Disconnect and blacklist unknown clients
Use the router's kick or deauthenticate button on each unfamiliar entry. Add the MAC to the access-control block list. Treat MAC filtering as a nuisance layer only; addresses can be spoofed, so this buys time while you rotate credentials. - Rotate the Wi-Fi passphrase and the admin password
Set a fresh WPA passphrase of at least 16 random characters, generated in a password manager. Change the router's admin account separately. If the admin login still uses the label default, the intruder likely already has it. Save, then reconnect trusted devices one by one. - Force WPA3 (or WPA2-AES) and disable WPS
Under wireless security, select WPA3-Personal, or WPA2-PSK with AES only if older clients require it. Never leave TKIP or mixed WEP modes active. Turn WPS off completely, including the physical button behavior if the firmware exposes that option. - Update firmware and turn off remote management
Check the vendor page for the latest firmware and apply it. Disable WAN-side admin access, UPnP if you do not need it, and Telnet or unused SSH. Bind the admin panel to the LAN only, and change its default port if the router allows. - Segment guests and IoT devices onto separate SSIDs
Create a guest network with client isolation enabled so visitors cannot reach your file shares or printers. Put cameras, thermostats, and smart plugs on a third SSID mapped to an isolated VLAN. A compromised IoT device then cannot pivot to your work laptop. - Enable logging and verify
Turn on connection and firewall logs, and email or syslog them if supported. After 24 hours, review authentication events. Run a fresh scan with a tool like Fing or the router's own client list to confirm only expected MACs remain.
Wi-Fi encryption modes and what to do with them
| Mode | Status | Recommended action |
|---|---|---|
| WPA3-Personal (SAE) | Current standard | Use when all clients support it |
| WPA2-PSK (AES/CCMP) | Still acceptable | Use as fallback for older devices |
| WPA2/WPA3 mixed | Transitional | Acceptable while migrating clients |
| WPA2-PSK (TKIP) | Deprecated | Switch to AES immediately |
| WPA1 | Broken | Disable now |
| WEP | Broken | Disable now, replace router if it is the only option |
| Open / no encryption | Unsafe | Use only for isolated guest with captive portal |
Prevention
- Rotate Wi-Fi and admin passwords at least once a year and after any guest visit you did not fully trust.
- Subscribe to your router vendor's security advisories so firmware patches are applied within days.
- Keep a written inventory of every MAC address on the network to make audits fast.
- Disable SSID features you never use: WPS, UPnP, remote admin, and legacy 802.11b compatibility.
FAQ
Is MAC filtering enough to keep intruders out?
No. MAC addresses travel in the clear on every Wi-Fi frame, and any attacker with a laptop can copy a legitimate one in seconds. Treat MAC filtering as a light deterrent that raises the bar for casual users. The real defenses are a long WPA3 passphrase, patched firmware, and disabled WPS.
How do I tell whether an unknown device is actually malicious or just something I forgot?
Look up the MAC address prefix, the first three octets, in an OUI database; it identifies the manufacturer. Match that against your inventory: smart plugs, printers, streaming sticks, and older Android phones are frequent false alarms. If the vendor still does not fit and the device stays connected during quiet hours, disconnect it and watch whether anyone in the household complains.
Should I hide the SSID to prevent unauthorized access?
Hiding the SSID does not meaningfully improve security. The name is broadcast every time a client associates, and passive sniffers pick it up in seconds. It also makes life harder for your own devices, especially IoT gear. Spend the effort on WPA3 and firmware updates instead.
Request a network security review from our IT-support team.