3 signs someone is stealing your Wi-Fi and how to stop it

At a glance:

• Slow internet, unknown devices, and Wi-Fi that cuts out can all point to an unauthorized user on your network.
• Intruders may get in through weak passwords, shared credentials, WPA weaknesses, misconfiguration, or outdated router firmware.
• Use your router gateway, network scanners such as Fing, Nmap, or WiFi Analyzer, then change passwords, upgrade security, and add a guest network.

What the warning signs look like

A home Wi-Fi network can feel suddenly sluggish for plenty of ordinary reasons: bad router hardware, damaged external cables, weak signal strength, ISP outages, or a VPN server that is routing traffic inefficiently. Still, if your connection drops from fast to unusable while your own devices are not doing anything unusual, an unauthorized device may be consuming bandwidth. The risk grows when that hidden user is streaming high-resolution video, gaming online, or torrenting large files, because those activities can push a residential connection into congestion quickly.

Before blaming a neighbor or housemate, rule out the mundane causes first. Check your ISP's service status page, visit downforeveryoneorjustme.com to see whether specific online services are disrupted, and inspect your hardware, including cables and connectors, because loose cabling can cause broadband problems that look suspicious. If the slowdown follows a pattern, such as a sharp dip every evening, it becomes more useful evidence than a one-off lag spike.

The clearest warning sign is an unfamiliar device on your network. Someone using your Wi-Fi without permission needs a device, such as a smartphone, PC, speaker, or smart home device, and many router gateways list connected clients by name, IP address, or MAC address. If you see a device you do not recognize, especially one that appears repeatedly, it is worth investigating before assuming it belongs to a forgotten smart plug or an old tablet.

A second sign is unexpected network activity when the house should be quiet. Flashing lights on your router may indicate traffic, though you should check the router manual before jumping to conclusions because hardware indicators vary by model. High traffic loads can also cause video buffering, lower speeds, and even disconnect authorized devices as they compete for the same bandwidth.

The third warning sign is more alarming: your router stops working, your Wi-Fi disappears, or you lose access at odd times. If the network turns off and on at specific moments, such as when music is playing, or if the Wi-Fi password has changed and you have been kicked out, someone may have gained access to the gateway and changed settings. Hardware failure, poor ISP service, and weather-related connectivity issues can still be responsible, but repeated interruptions at the same hour can suggest deliberate tampering.

How someone gets onto your Wi-Fi

The simplest explanation is often your password. A weak or easy-to-guess passphrase can be cracked or guessed, and a password that was shared with a guest can continue circulating after that guest leaves. Even a decent password becomes risky if it is reused across too many people or stored somewhere someone else can see it.

Attackers can also try brute-force or dictionary attacks against some Wi-Fi networks, using software to test combinations of letters, numbers, phrases, and special characters. This does not mean every Wi-Fi network is easy to break into, but weak credentials and poor configuration can make an otherwise modern network vulnerable. The more valuable the connection, the more important it is to treat the Wi-Fi password like a key to your digital home rather than a casual convenience.

Wi-Fi security standards also matter. The main protocols to know are WPA, WPA2, and WPA3, and you can check which one your network uses in your router's wireless settings. On macOS, hold down the option key and click the Wi-Fi icon; on Windows, go to Settings, Wi-Fi, and then the security tab. WPA3 is the strongest option when your router and devices support it, while WPA is obsolete and should not be trusted for a modern home network.

Outdated router firmware is another route into trouble. Firmware updates often patch vulnerabilities that could let attackers exploit the router gateway, interfere with settings, or weaken network security. You can usually check the firmware version in the router gateway and see whether updates are automatic or whether you need to apply them manually through the web interface.

How to verify and remove unwanted devices

The fastest way to investigate is to access your router gateway through a browser. Your router manufacturer or ISP should provide the address you need, but if you are unsure, common gateway addresses include 192.168.0.1 and 192.168.1.1. Another option is to open your smartphone's Wi-Fi settings, tap your home Wi-Fi hotspot, go to Settings, and choose Manage router if that option is available, which may take you directly to the gateway.

Once inside, you may see a browser warning that the connection is not private; that is common for local router interfaces. You will usually need to sign in with your router or hub password, and after that you can look for a connected-devices list, depending on your ISP or router brand. If the gateway interface is limited, use a dedicated network scanner to display devices and IP addresses, then compare the results against the phones, laptops, TVs, speakers, and smart home devices you actually own. Network scanner options include Fing, Nmap, and WiFi Analyzer.

You can gather more evidence by running speed checks at different times of day. If your connection starts low and drops sharply when someone comes home and starts streaming Netflix in 4K, the pattern may point to a bandwidth thief. People comfortable with technical tools can also generate connection logs using Nmap and Fing to see what is connecting, how long it stays connected, and when it appears.

Context matters too. If a neighbor is blaring a Spotify playlist and the music stops when you disconnect your router, you may have found the source of intermittent Wi-Fi service. This is not definitive proof on its own, but combined with unknown devices, suspicious login times, and repeated speed drops, it can help you decide whether to reset access immediately.

To stop intruders, change your Wi-Fi password through the router gateway. This is the quickest way to kick out devices that were using old credentials, though it means reconnecting every authorized device afterward. For a residential network, it is reasonable to write the new password down and keep it in a safe place at home, even if you avoid writing down passwords for important online accounts.

Choose a stronger password and check the router's administrator password as well. Do not rely on defaults, easy-to-remember phrases, or credentials such as admin/admin; change the admin password to something strong and store it somewhere safe. Then check your Wi-Fi security standard and upgrade it if necessary, moving away from WPA and toward WPA2 or, preferably, WPA3. If you share access with visitors, set up a guest network so they can use a separate access point away from your main devices, with more control over who connects, how long they stay connected, and how much bandwidth they can use.