Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.

Disaster Lab
BlogSomeone is using my Wi-Fi

Someone is using my Wi-Fi

An unfamiliar name on the router is often your own phone. Private Wi-Fi addresses make one Apple device look new. Change the admin password and the Wi-Fi password if a stranger stays after that, or if the router settings changed.

A new row in the router’s device list is usually a device you already own. Apple’s private-address page says an iPhone, iPad, Mac, Watch, or Vision Pro uses a different Wi-Fi address on each network. From iOS 18, iPadOS 18, and macOS Sequoia 15, that address stays fixed on a network with WPA2 or stronger security. On an open or weakly protected network it rotates every two weeks. Erase the phone, or reset its network settings, and the next join uses another address. The router then shows what looks like a stranger.

Check the list against the phones, TVs, bulbs, and speakers you know. A name like “ESP” or a string of hex digits is often a cheap smart device. The case for a real compromise is narrower. The admin password on the sticker no longer works. DNS, remote management, or port forwarding changed. Browsers on several devices jump to sites you did not open. An unknown device comes back after you changed the Wi-Fi password and reconnected only your own hardware.

The recovery steps for that case are in Home router or Wi-Fi hacked. If the real problem is that nothing can get online, use Home internet stops working and Home internet not working. A slow evening is not the same incident as a changed DNS setting.

See who is connected, without guessing

Open the router admin page from a device you trust, using the address in the router manual or on the label. The menu name varies. Look for connected devices, wireless clients, or a DHCP client list. Write down names you recognize so the next unknown row stands out.

CISA’s home Wi-Fi guide says each router is different, and the manual is the map. The label usually shows an IP address, the network name (SSID), a key, and a MAC address. Those printed defaults are the problem if you never changed them. CISA says default router logins are publicly available.

Do this from inside the house, on your own Wi-Fi or with an Ethernet cable. If you already suspect the router is sending browsers to the wrong place, do not type your email password or a bank password on that network. Use mobile data for those accounts.

If it is your own devices

Leave private addresses on. Apple says to update first, and to turn the feature off only if a network still will not work with it. A rotating address on a weak network is a reason to upgrade the encryption, in the next section.

A guest who visited last week can still be on the list until the router forgets idle clients. Phones that sleep and wake can appear twice during the change to a new private address. Reboot the router once, reconnect the devices you know, and read the list again tomorrow. A single unknown name that never returns is a weak signal.

Smart speakers, cameras, and plugs belong on a guest network if the router has one. CISA says the guest network should have its own long password, and that smart devices which only need the internet should use it. They then cannot browse your computers. The NCSC smart-device guide says to change a default device password, turn on 2-step verification if the app offers it, and turn off remote access if you do not need the device while you are away.

In the UK, the NCSC notes that from 29 April 2024 new smart devices have to meet basic security requirements, including a stated support end date, and must not ship with default passwords. A camera bought before that, or imported outside those rules, can still have a printed password. Change it. The exact consumer rights if a shop sold you a non-compliant device depend on the country. The NCSC says it does not give consumer-rights advice.

If someone else can get on

Change both passwords, and make them different. CISA’s list is the minimum:

  1. Change the router admin username and password. Make the password long, random, and unique. This is the password for the settings page, not the password phones use to join Wi-Fi.
  2. Install the current firmware. Turn on automatic updates if the router has them. If the maker no longer publishes updates, replace the router or ask the provider for a supported one.
  3. Change the Wi-Fi name if it is still the default. Skip your own name, address, or the router brand. CISA says a default name can point at known bugs for that model.
  4. Change the Wi-Fi password to a different passphrase. CISA suggests 5 to 7 unrelated words, at least 16 characters, used nowhere else. Every phone and laptop will ask for it again. That is the point.
  5. Set encryption to WPA3 Personal, or WPA2 AES (also called WPA2 PSK or WPA2). CISA says those are the two setups to use. An open network, WEP, WPA, or WPA2-TKIP is not. If the router only offers those, ask the provider that supplied it for a replacement, or buy a current router.
  6. Turn off remote management, so the settings page is not open from the internet.
  7. Turn off WPS. That is the push-button join. CISA says it makes unauthorized access more likely.
  8. Turn off UPnP when you do not need it. CISA says attackers can use it to reach devices through the firewall. You may need it on for a few minutes while a gadget joins, then off again.
  9. Log out of the admin page when you finish.

The Wi-Fi password and the admin password do different jobs. A person who knows only the Wi-Fi password can use your connection. A person who knows the admin password can change the Wi-Fi password, point DNS somewhere else, or turn remote management back on. Changing the Wi-Fi password alone leaves that door open.

Put the router where a visitor cannot hold the reset button. CISA says anyone who can reset it can come back with the defaults printed on the sticker.

Reconnect your own devices a few at a time. Start with the laptop, then phones, then cameras and doorbells. Change factory passwords on those gadgets as you go. Watch the client list for a day. A device that returns without the new password is not finished.

When the admin page itself is wrong

If your admin password fails, or DNS and remote management are not what you set, disconnect the router’s internet cable and leave the power on so you can still open the settings from inside the house. Photograph the model, the firmware version, and the screens for DNS, remote management, port forwarding, and connected devices.

Write down the provider account details before you reset. A reset can wipe the settings the line needs, and the house stays offline until you rebuild them. How you reach the provider depends on the country and the company. There is no single support number.

Factory-reset with the button in the manual. Do not load an old settings backup if you do not know whether that backup already contained the bad DNS or the remote-management switch. After the reset, apply the CISA list above before the rest of the house rejoins. Until the admin password is new, the sticker password is public.

If browsers were redirecting, assume passwords you typed in that period need a change. Do that on mobile data. Start with email, then the bank and the card accounts you used. The router playbook has the order for the network. Account recovery, if a password no longer works, is a separate job on each site.

Reporting differs by country. In the United States, the CISA page lists CISA Central at 1-844-Say-CISA and contact@cisa.dhs.gov. In the UK, follow the maker’s steps and the NCSC guidance linked above. Other countries have their own national cyber centre. Use the one for where you live, and keep the photos of the router screens.

If the connection is down, and the admin password still works, a router reset leaves you waiting on the provider. That case is Home internet not working.

When the passwords are changed and the unknown device is gone, keep going through Home router or Wi-Fi hacked until remote management, WPS, and UPnP stay off after a restart.

Questions

Does a new device name mean someone hacked my Wi-Fi?

Often it is your own phone. Apple gives each network a private Wi-Fi address, and on a weakly protected network that address can change every two weeks. A visitor, a watch, or a bulb can also show up with a factory name. Treat it as an intruder if the device returns after you change the Wi-Fi password, or if DNS, remote management, or the admin password changed without you.

Is changing the Wi-Fi password enough?

It knocks current devices off the network. It does not help if someone can still open the router admin page with the default password printed on the sticker. CISA says those defaults are public. Set a different admin password, turn off remote management, WPS, and UPnP, and use WPA3 Personal or WPA2 AES.

Should I factory-reset the router?

Reset it if the admin password no longer works, or if settings you did not change are already wrong. Write down the provider login and the Wi-Fi details first. After the reset, change the defaults before you reconnect the house. Do not restore an old settings file if you do not know when the problem started.

The browser keeps opening the wrong site. What do I do on the phone?

Use mobile data, not the home Wi-Fi, and change the email password and any bank or shop password you typed while the redirects were happening. Then reset the router with the steps in the home-router playbook. How you report the incident depends on the country. In the United States, CISA Central is 1-844-Say-CISA.