A hacked router often shows warning signs like unexplained slowdowns, unfamiliar devices connected to your network, changed settings you didn't make, or websites redirecting you to strange pages. If you notice any of these, it's worth investigating right away, since a compromised router gives attackers access to everything that passes through your home network.
One of the clearest signs is unrecognized devices in your router's connected-device list, which you can usually view by logging into the router's admin page through a web browser. If you see device names you don't recognize, especially ones connected at odd hours, someone else may be using your WiFi or has gained deeper access to your network.
Another red flag is router settings that have changed without your knowledge. This includes a different WiFi password, a new admin password that locks you out, altered DNS server settings, or new port-forwarding rules you never set up. Hackers often change DNS settings specifically so they can redirect your traffic to fake websites designed to steal passwords or payment information, even when you type the correct address yourself.
Unexpected pop-up ads, frequent redirects to unfamiliar sites, or antivirus warnings that suddenly spike across multiple devices in your home can also point to a compromised router rather than an infected individual computer. If several different devices on the same network start showing similar problems at the same time, the router itself is a more likely culprit than each device being infected separately.
A sudden, persistent drop in internet speed, especially when no one in the household is using much bandwidth, can indicate someone else is using your connection or that malware on the router is sending data out in the background. Overheating, a router that reboots on its own, or indicator lights blinking in unusual patterns are less common but worth noting too.
If you suspect your router has been hacked, start by logging into its admin panel directly (not through a link in an email or text) and checking the device list and settings. Change the WiFi password and the separate admin password immediately, using strong, unique passwords for each. Update the router's firmware, since outdated firmware is one of the most common ways attackers get in.
If settings were changed that you can't fully identify or undo, the safest fix is a full factory reset, followed by reconfiguring the router from scratch with new passwords and the latest firmware installed. After resetting, disable remote management and WPS if you're not using them, since both are common entry points for attackers. Also turn on WPA3 or WPA2 encryption if it isn't already active.
Going forward, change default admin credentials as soon as you set up any new router, keep firmware updated automatically if that option exists, and periodically check the connected-device list. If you continue seeing suspicious activity after a reset, or if sensitive accounts tied to devices on that network show signs of compromise, contact your internet provider or a professional for further help.