WPS (WiFi Protected Setup)

What is WPS?

WPS (WiFi Protected Setup) is a feature built into most home routers that lets you connect a new device to your WiFi network by pressing a button on the router instead of typing in your password. Some routers also use a PIN code printed on a sticker.

The idea was to make connecting to WiFi easier, especially for devices without a keyboard. The problem is that the PIN-based method has a serious design flaw that was discovered in 2011, and it has never been truly fixed.

Why it matters

The WPS PIN method breaks the 8-digit PIN into two halves and checks them separately. This means an attacker only needs to guess about 11,000 combinations instead of 100 million, which takes just a few hours with freely available tools. Once they crack the PIN, they get your full WiFi password, regardless of how long or complex it is.

Even the push-button method has risks. If WPS is enabled, the PIN-based attack works whether or not you ever use the button. Some routers claim to disable WPS but still leave the PIN vulnerability active. A strong WPA2 or WPA3 password does not protect you if WPS is enabled, because the attacker bypasses the password entirely.

What you can do

• Log into your router's admin page and disable WPS entirely
• After disabling WPS, verify it is actually off by checking with Network Weather or your router's status page (some routers have a confusing UI that does not fully disable the feature)
• Connect new devices by typing your WiFi password instead of using the WPS button
• If your router does not allow you to disable WPS, consider upgrading to a newer router that does
• Use a strong, unique WiFi password with WPA2 or WPA3 encryption as your primary protection
• Check your router manufacturer's support site for specific instructions on disabling WPS for your model

What Network Weather shows you

Network Weather detects whether WPS is enabled on your router and flags it as a security risk.