Is your home router
a security risk?

The FCC has proposed prohibiting new equipment authorizations for routers and networking gear manufactured by companies on the Covered List - primarily Chinese-owned manufacturers like TP-Link, Huawei, and ZTE. The policy is rooted in the Secure and Trusted Communications Networks Act, which restricts federal funds for equipment deemed a national security risk. New models from covered companies cannot receive FCC authorization to be sold in the United States.

Not necessarily right now. The ban affects new device authorizations, not routers already in use in your home. However, high-risk routers (D or F grade) are worth replacing soon - especially if they're no longer receiving firmware updates or were manufactured by Chinese-owned companies. A compromised router is a persistent backdoor into your entire home network.

TP-Link Technologies Co. Ltd. is headquartered in Shenzhen, China and is legally subject to Chinese national intelligence laws that can compel cooperation with state intelligence services. Multiple U.S. federal agencies - the FBI, NSA, and CISA - have documented TP-Link devices as attack vectors actively exploited by Chinese state hackers (the Volt Typhoon campaign). New TP-Link models are under FCC authorization review. All TP-Link models in our database score F.

Each router is scored on three algorithmic factors: corporate ownership & jurisdiction (0–35 pts), supply chain & FCC status (0–40 pts), and active software support (0–25 pts). Those three components make up the Ban Risk Score. A final composite grade is then weighted 70% ban risk / 30% security capabilities. No grades are manually assigned - every score is computed from the same formula. See the full methodology for the complete breakdown.

It depends on the model. ISP gateways from major U.S. carriers are owned by US entities, which is a positive signal - but many are still manufactured in China under contract. AT&T's BGW320 (made by Humax in South Korea) scores B. Older ISP gateways like the AT&T NVG589 or Verizon G1100 score F due to China manufacturing, aging hardware, and end-of-life support status. Check your specific model using the search bar above.

Your router sits between every device in your home and the internet - it sees all traffic and controls all connections. A compromised router means an attacker can intercept passwords and financial data, redirect you to fake websites even if you typed the right address, and silently monitor every device on your network. Unlike a hacked laptop, a hacked router is invisible: your devices appear normal while all traffic passes through an attacker's hands. The FBI and CISA have issued repeated public warnings about router-based attacks targeting home networks. In 2024 alone, botnets built from compromised home routers were used in attacks on critical US infrastructure. Most people never update their router firmware - making it the easiest entry point in the home.

B and C grades indicate moderate risk. These routers are generally safe for everyday home use but have specific limitations - for example, hardware manufactured in China, limited advanced security features, or support lifecycles that may not extend far into the future. You don't need to replace immediately, but you should keep firmware updated, use a strong admin password, and check for an end-of-support date. B-grade examples include most ASUS, Netgear Nighthawk, and Firewalla models.

When a router reaches end-of-life (EOL), the manufacturer permanently stops releasing firmware and security patches. Any newly discovered vulnerabilities - and new ones are found regularly - will remain permanently unpatched. Attackers actively scan for and target EOL devices because they're known to be exploitable. An EOL router is effectively a frozen, undefended device sitting at the perimeter of your entire network.

Plan to replace it. In the meantime: (1) Apply any available firmware updates immediately. (2) Change default admin credentials to a strong, unique password. (3) Disable remote management if it's enabled. (4) Consider placing a more secure router behind your ISP gateway to create a security layer. For a permanent fix, the only A-grade replacement currently available is Rio Router. B-grade alternatives include ASUS AX-series and Netgear Nighthawk AX models.

Device VPN (NordVPN, ExpressVPN, etc.): partial protection only. A VPN app on your laptop or phone encrypts traffic between that device and the VPN exit node. But it does not protect your local network from router-level exploitation. If your router has an unpatched vulnerability or a firmware-level backdoor, a VPN on your laptop won't prevent an attacker from monitoring DNS queries, redirecting traffic, or compromising other devices on your network - your smart TV, thermostat, and phone are still exposed. VPNs are a useful layer, but they don't fix a compromised router.

Router-level VPN: a fundamentally different class of protection. A router with a built-in VPN encrypts all traffic leaving your network - before it even touches your ISP. Every device on your network is automatically protected: your laptop, phone, TV, IoT devices, everything. There's no app to install, no device to remember, and no gaps. The encryption happens at the network boundary, not on individual devices.

Some of the highest-rated routers in our database have this built in:

• Rio Router - always-on VPN with no subscription required; every device on the network is protected by default
• Firewalla Gold - WireGuard and OpenVPN server built in; also functions as a secure VPN gateway for remote access

If you're relying on a device VPN to compensate for a router with a D or F grade, it's not enough. The right fix is the router itself.

Yes. Rio makes what we believe is the safest consumer router available in the US - and we built this tool to make that security data public for everyone, not just Rio customers. Our router is in the database, graded by the same algorithm as every other model. We score A. We'd tell you if we didn't. See the full methodology →