What Does the WPS Button on Your Router Do—and Should You Turn It Off?

The WPS button lets a device join your WiFi network without you typing the password. Push-button WPS is relatively low risk, but the WPS PIN method has a known flaw that can let a nearby attacker break in. 

For most households, the answer is yes: disable the PIN method, or WPS entirely, unless you actually use it. With October marking Cybersecurity Awareness Month, it’s a good time to check your router’s settings.

What Is WPS on a Router?

WPS stands for Wi-Fi Protected Setup, a feature built into most home routers that connects devices without the WiFi password. It offers two methods: a push button and an eight-digit PIN. Think of the button as a doorbell that works for two minutes after you press it. The PIN is more like a short combination lock that many routers leave enabled by default [1].

What Does the WPS Button Do?

Pressing the WPS button opens a pairing window, typically two minutes, during which a nearby device can join automatically. You start WPS on the device, such as a printer, WiFi extender, or smart plug, then press the button on the router. The router hands over the network credentials without anyone typing them. Here is how WPS vs entering your WiFi password compares:

Is WPS Safe? The WPS PIN Vulnerability Explained

Push-button WPS is generally safe at home, but the PIN method is not. For WPS button router security, the main exposure is physical. Anyone who can press the button during the pairing window can add a device, so keep the router out of reach of guests and visitors. Researcher Stefan Viehböck reported the WPS PIN vulnerability in late 2011, and CERT published it as VU#723755 [2]. The flaw is in the design. A router reveals when the first half of the eight-digit PIN is correct, and the last digit is just a checksum. WPS itself dates to 2007, and this flaw cuts the guesses needed from 100 million to roughly 11,000 [3].

The U.S. government took notice. A January 2012 US-CERT alert warned that freely available tools could recover a PIN in four to ten hours, after which an attacker could obtain the WiFi password and monitor traffic [4]. That is the core WPS security risk, and it is what people mean by a WPS router hack. Even a long, strong WiFi password can’t help, because WPS acts as a side door around it. The attacker does have to be within radio range, and many routers back then had no lockout for repeated failed guesses.

Manufacturers responded. NETGEAR routers now lock out PIN attempts temporarily after repeated failures, yet the company still recommends disabling the PIN method [5]. Google also deprecated WPS in Android 9 [6].

Should I Disable WPS?

Yes, in most cases. The convenience is small, since you save typing a password once per device, while the exposure is real. At minimum, disable PIN-based WPS. You can disable WPS router settings from the admin page in about a minute, and you can switch it back on if you ever need it.

• Turn WPS off completely if your devices can connect with a password or QR code.
• Keep push-button only if you rely on it for smart home gear or printers, and disable the PIN.

How to Turn Off WPS on Your Router

Log in to your router’s admin page or app, then look under Wireless settings for WPS, Router PIN, or external registrar. Menus vary by model, so check your manual. After saving, reboot if prompted and confirm your existing devices still connect.

• NETGEAR: Go to Advanced > Advanced Setup > Wireless Settings, check Disable Router’s PIN, and click Apply [7]. The push button keeps working.
• TP-Link: Go to Advanced > Wireless > WPS and turn off Router’s PIN. Some models also have a full WPS toggle under System Tools > System Parameters.
• Internet provider gateways (Xfinity, Spectrum, and similar): Options vary and are sometimes limited to the provider’s app. If you can’t disable WPS, ask your provider or use your own router.
• Other brands: Check the app or manual for the same WPS or PIN setting.

What Should You Use Instead of WPS?

Entering the password works on every device, and a password manager or your phone’s QR code sharing makes it fast. Newer devices also support Wi-Fi Easy Connect, which pairs by scanning a QR code, uses public-key encryption, and works with WPA3 networks [8]. 

Android 10 and later supports it as the WPS replacement. Advanced users can go further and put smart home devices on a separate guest network, so a compromised gadget never touches their laptops.

When Should You Replace Your Router?

Older routers more often have weak lockouts and no more firmware updates, so a router that can’t disable PIN-based WPS is a reason to upgrade. Read our guides on router security settings and how often to replace your router to decide.

If you’re upgrading hardware, review your plan too. Internet prices vary widely: a BroadbandNow survey in March 2026 put the national average at $81.16 per month, from $65.43 in New Jersey to $109.88 in Alaska [9]. 

Compare internet plans to see whether a faster, cheaper option beats your current deal, especially if you rent a gateway.

Use our zip tool to find the best internet in your area, compare internet providers, and run an internet comparison of the best internet providers.

FAQs

Is it safe to leave WPS on?

Push-button WPS carries lower risk because it requires a press within a short window. PIN-based WPS is vulnerable to brute-force guessing, so disable the PIN if your router allows it.

Can someone hack my WiFi through WPS?

Only if PIN-based WPS is enabled and they are within WiFi range. A successful attack can reveal your WiFi password, so turning off the PIN closes that door.

Will turning off WPS disconnect my smart home devices?

No. Devices already connected stay connected. Disabling WPS only affects new devices that would join by button or PIN, which can use the password instead.

Does disabling WPS change my WiFi password or speed?

No. Your password, network name, and speeds stay the same. Only the WPS pairing options change.

Sources

[1] TP-Link. “How to Use the WPS Button on Your TP-Link Router.”

[2] CERT Coordination Center. “WiFi Protected Setup (WPS) PIN brute force vulnerability (VU#723755).”

[3] SANS Internet Storm Center. “Wi-Fi Protected Setup (WPS) PIN Brute Force Vulnerability.”

[4] CISA. “Wi-Fi Protected Setup (WPS) Vulnerable to Brute-Force Attack (TA12-006A).”

[5] NETGEAR. “How does my NETGEAR router protect me from Wi-Fi Protected Setup (WPS) PIN brute force attacks?”

[6] Android Developers. “Wi-Fi Easy Connect.”

[7] NETGEAR. “How do I specify WPS settings on my Nighthawk router?”

[8] Wi-Fi Alliance. “Wi-Fi Easy Connect™ Explained: How DPP Is Revolutionizing Secure Device Onboarding”

[9] Benton Institute for Broadband & Society. “The Cost of Staying Connected in 2026.”