Your internet is slow and the thought arrives that somebody is on your network. Usually they are not. Slow internet is almost always your provider, your router’s age, or the fact that four people are streaming at once.
Worth checking anyway, because the check takes five minutes and the things you find while you are in there tend to matter more than the neighbor you were looking for.
Look at the connected devices list
Every router keeps a list of what is currently attached. Getting to it:
- Open your router’s admin page. Type 192.168.1.1 or 192.168.0.1 into a browser. If neither loads, the address is printed on a sticker on the router itself. If your provider gave you an app, the list is in there and it is easier to read.
- Sign in. The default username and password are on the same sticker. If you have never changed them, that is finding number one and we will come back to it.
- Find the list. It is called Connected Devices, Attached Devices, DHCP Clients or Device List depending on who made the thing.
Now count. Most households have far more devices than they expect. Every phone, laptop and tablet, then the TV, the streaming stick, the console, the thermostat, the doorbell, the printer, the speakers, the watch, and a robot vacuum nobody remembers naming.
Names are unhelpful on purpose. You will see entries like ESP-4A2F or android-dh38 or a bare MAC address. Before assuming the worst, turn the Wi-Fi off on one device at a time and watch which entry disappears. Tedious, and it resolves nearly every case.
A genuine intruder is unlikely. What you will actually find is three devices you no longer own still holding a reservation, and a smart plug you forgot about.
What an intruder would look like
If someone really is on your network, the signs are more specific than slow video:
- A device that stays connected while every device you own is switched off
- Traffic at hours when your house is asleep, if your router logs it
- A connected device whose manufacturer prefix matches nothing you own
- Your admin password no longer working, which means they got in and locked you out
That last one is the serious one and it means changing everything, not just the Wi-Fi password.
Fix these while you are in there
This is the part worth your five minutes regardless of what the device list showed.
Change the router’s admin password. Not the Wi-Fi password. The separate one that gets you into the settings page, which on most home routers is still admin and admin, or admin and password. Anyone already on your network can open that page, and with it they can redirect where your browsing goes. This is the single most important item here and the one most people skip because they confuse it with the Wi-Fi password.
Check your encryption. You want WPA3. WPA2 is acceptable. If it says WEP or Open, change it now, because WEP takes minutes to break and Open means no encryption at all.
Update the firmware. There is an update button in the admin page. Routers ship with known vulnerabilities and most people never once install a patch in the life of the device. If yours is more than five or six years old, it may have stopped receiving updates entirely, which is a reason to replace it.
Turn off WPS. The button that connects devices with a PIN instead of a password. The PIN system has a long-standing weakness and you do not need the feature.
Turn off remote administration unless you deliberately use it. This is the setting that lets the admin page be reached from outside your house, and there is rarely a reason for it to be on.
Set up the guest network. Then put every smart device on it. Your doorbell, your thermostat, your TV, the vacuum. Cheap smart devices are the least maintained software in your home, and a guest network keeps a compromised one away from the laptop with your tax returns on it.
Doing this properly once, including the guest network split and what to do about a router too old to patch, is what The Home Office Lockdown walks through. Built for people working from home, where the network is now a work problem as well as a personal one. $19.99.
If you find something you cannot explain
Work in this order:
- Change the Wi-Fi password to something long. Every legitimate device gets kicked off and you reconnect them, which is annoying and is also the point, because it removes anything you did not authorize.
- Change the router admin password separately.
- Reboot the router so every connection re-establishes under the new credentials.
- Check the device list again after everything of yours is back on. Anything still unexplained now is worth taking seriously.
- Factory reset the router if the unexplained device is still there. This wipes any configuration change someone made, including the DNS settings a compromised router gets used for.
The thing that is actually slowing you down
Since this usually starts with slow internet, the honest list of causes, in order: too many devices streaming, a router sitting in a closet behind a wall, a router old enough to predate your current internet speed, your provider throttling or having a bad night, and the 2.4GHz band being crowded by every neighbor within range.
A stranger on your Wi-Fi is far down that list. Moving the router to an open central spot fixes more slow internet than any security setting in this article.
What someone on your Wi-Fi could actually do
Since the worry is what brought you here, here is the honest version, worst first.
Change where your browsing goes. Access to the router means access to your DNS settings, which decide which server your browser reaches when you type a bank’s address. This is the genuinely serious one, and it is why the admin password matters more than the Wi-Fi password.
Reach devices with no real security. Printers, older network drives, some cameras and plenty of smart devices trust anything already on the local network. A file share with no password is invisible from the internet and wide open from your living room.
Use your connection for things that trace back to you. Illegal downloads and worse arrive at your address, because your router is what the outside world sees.
Watch unencrypted traffic. Less than it used to be. Nearly everything runs over HTTPS now, so the content of your banking session is not readable from the same network. This is the threat people imagine and it is the one that shrank most.
Slow you down. Real, and the least of it.
The pattern worth noticing: the damaging items need router access, not Wi-Fi access. Which is why the admin password change is the line item that matters.
The bottom line
Open your router’s device list and count. You will almost certainly find nothing worse than a smart plug you forgot and two devices you no longer own.
While the page is open, change the admin password, confirm WPA2 or WPA3, install the firmware update, and move your smart devices onto the guest network. That is five minutes against a stack of problems that are real, unlike the neighbor, and it is worth doing tonight rather than the next time the video buffers.