Signs Your WiFi Is Hacked (And What To Do About It)

The real signs your WiFi is hacked

Most people notice something is wrong before they can explain why. The internet feels slower, or an app keeps timing out, and it's tempting to blame the ISP and move on. Before you do, check for these specific signs, because each one on its own points to a network that has been accessed by someone who shouldn't be there.

• Unfamiliar devices on your network. Every router keeps a list of connected devices, usually by name and MAC address. A device you don't recognize, like a random string of letters and numbers, or a device type that isn't yours, is the single clearest sign of an intruder.
• Sudden, unexplained slowdowns. If nothing changed on your end (no new streaming device, no big download) but speeds dropped noticeably, someone else may be using your bandwidth, running downloads, or worse, using your connection for something that's consuming resources in the background.
• DNS or router settings changed without you touching them. If your router's DNS servers point somewhere you didn't set, or settings like port forwarding or remote management have been turned on, that's a strong sign someone got into the admin panel.
• An alert from your ISP about a new device. Many providers now send a notification when a new device joins your network. Don't dismiss it as a false positive without checking, especially if you didn't add anything recently.
• Getting redirected to unfamiliar websites. If typing a normal address (your bank, a common site) lands you somewhere else, or a warning page, that's a classic symptom of a hijacked DNS setting, which is one of the first things router malware changes.
• Your router admin password suddenly doesn't work. If your saved password stops working and you're sure you typed it correctly, someone with access to the admin panel may have changed it to lock you out.

Any single item here could theoretically have a boring explanation, like a smart plug you forgot you set up. But when two or more show up together, especially an unfamiliar device plus changed settings, treat it as a real intrusion and act on it the same day.

How to check what's actually connected

You don't need special tools for this, just access to your router's admin page.

1. Find your router's IP address. It's usually printed on a sticker on the router itself, commonly 192.168.1.1 or 192.168.0.1. On most computers, you can also find it under network settings as the "default gateway."
2. Type that address into a browser and log in with your admin username and password (also often on the sticker, if you never changed it, which is itself a risk worth fixing).
3. Look for "Connected Devices," "Attached Devices," or "DHCP Client List." The exact wording depends on your router brand, but every consumer router has this list somewhere in the main dashboard.
4. Go through the list device by device. Match each one to something you own: your phone, laptop, smart TV, thermostat, printer. Anything you can't account for after a careful look is worth investigating further, or removing outright.

If you're renting a place and using the landlord's or Airbnb host's router, you may not have admin access at all. In that case, the more practical fix is switching to a personal travel router or a mobile hotspot for anything sensitive, since you can't secure a network you don't control.

What to do once you find an intruder

Once you've confirmed an unfamiliar device or a changed setting, work through these steps in order. Don't skip the password change even if you're not sure anything is actually wrong. It costs nothing and closes the door either way.

1. Change the router's admin password first. This is the password that logs you into the router's settings page, separate from the WiFi password. If an intruder has this, they can undo anything else you change.
2. Change the WiFi password itself. This disconnects every device, including the intruder's, and forces everyone (including you) to reconnect with the new password.
3. Check and reset the DNS settings. Most routers default to using your ISP's DNS automatically. If something else has been entered, switch it back or set it to a known public DNS like 1.1.1.1 or 8.8.8.8.
4. Update the router's firmware. Look for a "Firmware Update" or "Router Update" option in the admin panel. Many real-world router break-ins exploit a vulnerability that the manufacturer already patched months earlier.
5. Factory reset if you were locked out of the admin panel, or if you can't fully trust any of the current settings. This is usually a small recessed button on the back, held for 10 to 30 seconds, and it wipes the router back to its out-of-box state so you can set it up clean.

Stopping it from happening again

Most home and rental routers get compromised through a small number of repeat mistakes, all of which are easy to fix once:

• Use WPA3 or WPA2 encryption for your WiFi, never an open network and never the older, broken WEP standard.
• Set a long, unique WiFi password that isn't the default printed on the router and isn't reused from another account.
• Change the default admin username and password on the router itself. Default router logins are public knowledge and are the first thing automated attack tools try.
• Turn off remote management unless you specifically need to access your router's settings from outside your home network.
• Keep firmware updated, ideally with automatic updates turned on if your router supports it.

If you travel frequently and rely on other people's routers (hotels, Airbnbs, coworking spaces), our guide on hotel and cafe WiFi problems covers what you can and can't control on a network that isn't yours, and our WiFi and network support service handles both home routers and travel setups.

We help travelers and remote workers with this from wherever you are: