Most New Zealand homes run the modem their provider sent, with the settings it arrived with. That is usually fine — but a handful of changes, none of them technical, close the gaps that actually get exploited: default admin passwords, old firmware, and smart devices sitting on the same network as your laptop.
Start with the router’s admin password
Two passwords matter on your modem and they are not the same thing. The Wi-Fi password lets devices join the network. The admin password lets someone change the settings, including the DNS servers every device relies on.
Many routers still ship with an admin login of admin and password, printed on a sticker anybody in the house can read. Change it to something long and unique, and store it in a password manager — our password generator will produce one.
You reach the settings by typing the router’s address into a browser, usually 192.168.1.1 or 192.168.0.1 for most models sold here. The sticker on the unit lists the right one.
Then the Wi-Fi password and encryption
Use WPA3 if your router offers it, or WPA2 if not. Anything older — WEP or an open network — should be treated as broken. A passphrase of 20 characters or more puts it beyond offline cracking, and because you read it out to visitors rather than typing it daily, a few random words works well.
Turn off WPS, the button-or-PIN pairing feature. Its PIN design has been known to be crackable in roughly 11,000 attempts since 2011, which turns a strong Wi-Fi password into a weak one.
Keep the firmware current
Router firmware carries the same kind of security flaws as any other software, and an unpatched router is one of the easier ways into a home network. Provider-supplied modems from Spark, One NZ and 2degrees generally update themselves; if you bought your own, check the admin page for an update option and turn on automatic updates if it has them.
If your router no longer receives updates at all, replace it. That is the United States National Security Agency’s advice for home networks and it is sound: hardware that has stopped being patched will not get safer with age.
Separate the smart devices
Cameras, plugs, speakers and televisions run software that is rarely updated and often written cheaply. Putting them on the guest network keeps them away from the laptop holding your files and your banking session. Every modern router supports a guest network, and it takes about a minute to set up. Give visitors the same network.
The settings worth turning off
| Setting | Why turn it off |
|---|---|
| Remote administration | Lets the settings page be reached from the internet. Almost no household needs it. |
| WPS | The PIN method can be brute-forced, exposing the Wi-Fi password. |
| UPnP | Lets any device on your network open ports to the internet by itself. Turn it off unless a console or application breaks without it. |
| Default network name | A name identifying the model tells an attacker which flaws to try. Rename it to something that is not your surname or address either. |
What a VPN does and does not do here
A VPN encrypts traffic between your device and the VPN server, which matters most on public Wi-Fi — Netsafe recommends one for exactly that. On your own network, with HTTPS already encrypting nearly everything, it changes little about local security: it does not stop a neighbour joining a badly protected Wi-Fi network, and it does not patch your router. Install one on the router if you want whole-house coverage for privacy reasons, but fix the basics above first. Our best VPN guide explains what to look for.
If the network is also slow or unstable, that is a different problem — the guides to connections that keep dropping out and extending Wi-Fi coverage cover it, and our speed test shows what you are getting right now.
A ten-minute checklist
- Change the router admin password and save it in a password manager.
- Set Wi-Fi to WPA3 or WPA2 with a passphrase of 20 characters or more.
- Turn off WPS, UPnP and remote administration.
- Check for a firmware update and enable automatic updates.
- Rename the network to something that does not identify the model or your family.
- Move smart devices and visitors onto the guest network.
- Restart the router and reconnect your devices.
Disclaimer
General information only. Settings names vary by model; if your modem came from your provider, their support pages document the exact steps for that device.
Reference sources
Frequently asked questions
How do I change my router’s settings in New Zealand?
Type the router’s address into a browser — usually 192.168.1.1 or 192.168.0.1, printed on the sticker — and sign in with the admin login, not the Wi-Fi password.
Is WPA3 better than WPA2?
Yes. WPA3 resists offline guessing of your Wi-Fi password far better. Use it where your router and devices support it; WPA2 remains acceptable, and mixed WPA2/WPA3 mode keeps older devices working.
Should I hide my Wi-Fi network name?
It adds very little. Hidden networks are trivially discoverable with free tools and make connecting harder for you. A strong passphrase is what protects the network.
Do I need a guest network at home?
It is the easiest useful change you can make. It keeps smart devices and visitors’ phones away from the computers holding your files and banking sessions.
How often should I update router firmware?
Turn on automatic updates if the router offers them, and check manually every few months if not. Replace a router that no longer receives updates.
Can someone use my Wi-Fi without me knowing?
If the password is weak or WPS is on, yes. The admin page lists connected devices; unfamiliar entries plus a sudden slowdown are the usual sign. Change the passphrase and they are all disconnected.
Does a VPN secure my home Wi-Fi?
No. It encrypts traffic leaving your device, which is valuable on public networks, but it does not stop someone joining your Wi-Fi or fix an unpatched router. Do the checklist above first.
