Modern users often encounter the abbreviation WPS On the router's casing or in the smartphone's settings menu, but not everyone understands the actual purpose of this technology. It's a standardized protocol developed by the Wi-Fi Alliance, designed to simplify the process of connecting devices to a wireless network without the need to enter long and complex passwords. The main idea was to make the internet accessible even to tech-inexperienced people who find it difficult to remember or type a string of numbers and letters on a phone screen.
Despite its convenience, the feature has been the subject of much controversy due to security vulnerabilities discovered by researchers in recent years. Wi-Fi Protected Setup While it does allow you to instantly connect devices, the price of this convenience is the potential risk of hackers hacking your home network. Understanding how the protocol works will help you weigh the pros and cons before pressing that coveted button on your router.
In this article, we'll take a detailed look at how data exchange occurs, the different authentication methods available, and why many cybersecurity experts recommend keeping this feature disabled. You'll learn the differences between PBC and PIN authentication methods, as well as how to protect your network from common brute-force attacks. This information will be useful for both home network owners and small office system administrators.
The operating principle and purpose of WPS technology
Technology Wi-Fi Protected Setup was introduced as the industry's response to the growing complexity of WPA2 encryption passwords. While security standards required the creation of long keys from random characters, it was becoming increasingly difficult for the average user to enter them on TV remotes, printers, or game consoles without a full keyboard. The protocol takes on the task of automatically transmitting network settings, including the SSID and encryption key, from the router to the client device.
The setup process happens in the background and takes just a few seconds. When you activate the feature, the router creates a temporary communication channel through which it transmits the necessary credentials. This eliminates human error, such as typos when entering a password or confusion with letter case. It is critical to understand that WPS does not replace traffic encryption, but only simplifies the initial pairing process for devices.
⚠️ Warning: Using WPS can create a security hole in your network if your router doesn't have the latest firmware updates. Outdated PIN generation algorithms are often predictable.
There are several use cases where this technology proves particularly effective. For example, when connecting a guest laptop or a new smart device to a smart home system. Instead of dictating a complex password to guests or searching for it in a notebook, they can simply press a button or scan a QR code (in newer implementations). This is especially relevant in environments where connected devices are frequently changed.
Authentication methods: PBC, PIN and NFC
The protocol supports several different connection methods, each with its own technical features and level of convenience. The most common method is PBC (Push Button Configuration). In this case, the user must physically press a button on the router's body and then activate the WPS network search on the client device within two minutes. This creates a window of opportunity during which the key exchange occurs.
The second popular method is to use PIN codeHere, an eight-digit numeric code is generated or displayed on the client device (for example, a printer screen or OS interface). This code must be entered into the router's web interface or, conversely, the router's PIN must be entered into the client's settings. This method is convenient for devices without a screen, but historically, it has been the source of major security vulnerabilities due to the limited number of combinations.
- 📱 PBC (Push Button): Requires physical access to the router and client, most secure when turned on for short periods.
- 🔢 PIN Code: Allows you to connect devices remotely (if the code is known), but is susceptible to brute-force attacks.
- 📡 NFC / QR: Modern variations use near-field communication or a smartphone camera to instantly transmit a network profile.
It's worth noting that not all routers support all methods simultaneously. Budget models often only have a PBC button, while enterprise-grade equipment may require a PIN to audit connections. When setting up your network, it's important to check your documentation. routerto understand what options are available in your case.
Technical details of packet exchange
During a WPS handshake, devices exchange EAP (Extensible Authentication Protocol) packets. The router acts as the registrar, and the client acts as the enroller. If the PIN method is used, the hash of the first and second halves of the code is verified separately, which reduces brute-force time.
Instructions: How to connect a device via WPS
Connecting a gadget to a network using this technology usually takes less than a minute. Before you begin, make sure your device (smartphone, tablet, or laptop) supports the WPS standard. In modern versions of Android (starting with 9.0), this feature has been removed for security reasons, so owners of newer phones will have to use traditional password entry or a QR code.
For devices that support this feature, the procedure is as follows. First, find the button labeled WPS or the corresponding icon (two arrows forming a circle). If there is no physical button, log in to the router's web interface at 192.168.0.1 or 192.168.1.1 and find the wireless network section.
☑️ Connection algorithm
After activating the mode on the router (usually the Wi-Fi or WPS indicator will start blinking), go to the Wi-Fi settings on your device. Select "Connect via WPS" or a similar option. The system will automatically detect the router and establish a connection. If a connection is not established within 2 minutes, the router will exit standby mode, and you will have to repeat the procedure.
⚠️ Note: Router interfaces from different manufacturers (TP-Link, ASUS, Keenetic, MikroTik) may vary. The location of the WPS button often depends on the device model.
Critical vulnerabilities and security risks
Despite its convenience, the WPS protocol has been the target of criticism from the information security community. The main problem lies in the implementation of the PIN code. An eight-digit code seems quite complex, but the verification algorithm is divided into two parts: the first four digits and the second four digits. This reduces the number of possible combinations from 100 million to approximately 11,000, making it possible to brute-force the code in a matter of hours.
The attack, known as Reaver or Bully, allows an attacker within range of the network to automatically guess the PIN. Once a valid PIN is obtained, the attacker gains full access to the network configuration, including the WPA2 password. This allows them to not only use your internet connection but also redirect traffic, inject malware, or attack other devices on the local network.
| Risk parameter | Description of the threat | Probability |
|---|---|---|
| Brute-force PIN | Automatic access code selection | High (on older routers) |
| Physical access | Anyone who comes to the router can press the button | Average (depending on location) |
| Implementation vulnerabilities | Router firmware errors (bugs) | Average |
A particularly dangerous situation is when WPS is enabled by default and has no mechanism to lock after several unsuccessful PIN attempts. Many older router models lack this protection, making them easy targets. Even if you use a complex Wi-Fi password, enabling WPS negates its security by bypassing the password entry step.
How to disable WPS on a router to secure your network
Given the risks described above, the best solution for most users is to completely disable this feature if you're not currently using it. This won't affect internet speed or connection stability, but it will significantly increase the security of your local network. Disabling is done through the administrator's web interface.
To get started, you need to log into your router's control panel. Open your browser and enter the device's IP address (often 192.168.1.1). Enter the administrator login and password. Next, find the section related to the wireless network. It may be called Wireless, Wi-Fi or Wireless networkWithin this section, look for a tab or subsection titled WPS.
In the menu that opens, you will see a function status switch. Set it to the On position. Disable or OffOn some router models, such as those from ASUS or Zyxel, you may need to uncheck the "Enable WPS" box. After applying the settings, the router may reboot, and the feature will be deactivated.
Example of a path in the TP-Link menu:
Wireless -> WPS -> Enable WPS: [Uncheck] -> Save
If you don't see this setting explicitly, your router may be using a simplified interface. In this case, try switching to "Advanced Mode." On some devices, the WPS function may be hard-coded to a button on the device and can't be disabled through software. In this case, it's time to consider upgrading to a more modern router.
Alternative and secure connection methods
Abandoning WPS doesn't mean you'll have to manually enter long passwords on every device. There are more modern and secure methods that combine convenience and security. One of the most popular is the use of QR codes generated by Android and iOS operating systems.
Smartphone owners can generate a QR code with their network details in their Wi-Fi settings. Guests simply point their phone's camera at this code to connect automatically. This eliminates the need to dictate a password and doesn't require activating vulnerable protocols on the router. Furthermore, many modern routers support the standard. Wi-Fi Easy Connect (DPP), which uses a similar principle but with a higher level of encryption.
- 📷 QR codes: Fast, secure, does not require access to router settings.
- 🔗 WPS NFC: If the router and phone support NFC, simply touch the devices to each other.
- 📲 Provider applications: Many operators allow you to manage guest access through a mobile app.
It's also worth considering creating a separate guest network. This is an isolated Wi-Fi segment that prevents access to your personal files, printers, and other devices on the main network. Even if a guest device is infected with a virus, it won't be able to spread to your main devices. This is a best practice for any modern home or office.
Is it possible to hack a network if WPS is disabled, but the button is on the router?
If the function is disabled programmatically in the settings (Disable), then physically pressing the button will have no effect—the router will ignore the signal. However, if there's a critical firmware bug, it's theoretically possible to affect the router at the hardware level, but for a home network, the risk is minimal. The key is a software-based shutdown.
Does WPS affect internet speed?
The WPS function itself doesn't affect data transfer speed, as it's only active during a connection. However, background security checks or password brute-force attempts by attackers can place a strain on the router's processor, which can indirectly reduce network performance.
Why doesn't my new phone have a WPS button?
Starting with Android 9 (Pie), Google removed WPS support from the operating system due to the protocol's weak security. Connection is now only possible via password entry, QR code, or NFC.
I forgot my WPS PIN, where can I find it?
The PIN is usually located on a sticker on the bottom of the router, next to the Wi-Fi password. It can also be found in the router's web interface under the WPS section. If the code was changed manually and forgotten, resetting the router to factory settings will help.