How to choose a wireless router

Wi-Fi generations are IEEE standards with friendlier names. Each is backwards compatible, so a new router works with old devices and vice versa, at the speed of the older side.

The band matters more than the generation for everyday feel. 2.4 GHz reaches furthest and penetrates walls best, but it is slow and shared with microwaves, Bluetooth and every neighbor; 5 GHz is faster with less reach; 6 GHz is faster still, nearly empty, and stops at the first solid wall. A good router steers each device to the best band automatically ("band steering"), and the 6 GHz band is only usable by devices that have a 6E or 7 radio, which in 2026 means recent flagship phones and laptops, not TVs, consoles or smart plugs.

Treat the number on the box as a label, not a measurement: "AX5400" adds the theoretical peak of every band together, under conditions no device can meet. A single phone on Wi-Fi 6 with two antennas typically achieves a few hundred megabits per second in the same room and less through a wall; that is still far more than most internet plans deliver. The practical ceiling is your plan, which the speed test measures from your actual device, over Wi-Fi and, for comparison, over a cable.

Radio does not care how expensive the router is: a single unit covers roughly a flat or a small house, and every floor, brick wall or long corridor beyond that costs speed. The usual symptom is a strong signal next to the router and a weak one in the bedroom at the far end, where devices cling to a poor connection instead of giving up. The fix is more access points, not a bigger antenna.

A mesh system is two or more units sold together that share one network name and hand devices over as you move. Three things separate a good mesh from a frustrating one. First, the backhaul, the link between the units: a wired Ethernet backhaul is always best, and if your home has cabling or you can run one cable, use it; without it, a tri-band system with a dedicated backhaul band keeps speed up, while a cheap dual-band mesh halves its throughput at every hop. Second, support for the roaming standards 802.11k, v and r, which let phones switch units quickly instead of hanging on to the old one. Third, placement: units should sit where the signal from the previous one is still good, roughly halfway, not where coverage has already died.

Alternatives to mesh: a second access point connected by cable (any spare router in access-point mode will do, with the same network name and password), or powerline adapters where cabling is impossible, which work well in some houses and badly in others depending on the wiring. Wi-Fi "range extenders" that repeat the signal wirelessly are the weakest option; they halve speed and often create a second network name. If you need coverage in one far room, a cabled access point beats a mesh; if you need it everywhere in a large house, a wired-backhaul mesh is the clean answer.

Ports are where routers quietly limit you. The WAN port connects to your modem or fiber terminal, and your internet speed cannot exceed it: a gigabit WAN port caps a 2 Gbit/s plan at 1 Gbit/s (slightly less in practice). Plans above a gigabit need a 2.5 Gbit/s WAN port, which has become common on mid-range routers; 10 Gbit/s ports exist for the rare plans that need them. The LAN ports serve your wired devices: a desktop, a TV, a console, a network drive, a mesh unit's backhaul. Count what you want to cable and add a spare; a cheap unmanaged switch extends them if you run out. Prefer at least one 2.5 Gbit/s LAN port if you have a fast plan and any wired device that can use it.

Understand what the router is not. It is not a modem: cable and DSL lines need a modem (often the box your provider supplied), and fiber needs the optical terminal; the router plugs into those. Provider-supplied all-in-one gateways can usually be switched to "bridge mode" so that your own router handles everything, which avoids double NAT, the situation where two routers each translate addresses and port forwarding and some games stop working. If the provider's box cannot be bridged, put it in its own DMZ setting or ask the provider for a plain modem.

Other features worth checking: a USB port only if you will actually share a drive or printer; Wi-Fi 6 on 2.4 GHz for the many small devices that live there; and a processor fast enough for the extras you intend to run. VPN tunnels, traffic analysis and parental controls all cost CPU, and a budget router that advertises them may deliver them at a fraction of your line speed. Reviews that measure throughput with those features switched on are worth more than specification sheets.

IPv6. Half of the internet's users already reach major sites over IPv6, and providers increasingly put new customers behind carrier-grade NAT for IPv4, which breaks port forwarding and some games. A router that does IPv6 properly gives every device a public IPv6 address, keeps a firewall in front of them, and takes the CGNAT problem away for everything that supports IPv6. Look for native IPv6 with DHCPv6 prefix delegation (the mechanism providers use to hand you a block of addresses) and a configurable IPv6 firewall; "IPv6 pass-through" is a lesser mode. The card below shows whether your current connection has IPv6 at all, and the IPv6 test shows what your browser prefers; IPv4 vs IPv6 explains why it matters.

VPN. Two different features share the name. A VPN client on the router sends the whole house through a commercial VPN service, useful for devices that cannot run a VPN app, such as a TV, but limited by the router's CPU; WireGuard support is the one to look for, since it is several times faster than OpenVPN on the same hardware. A VPN server on the router lets you reach your home network securely from elsewhere, which is the safe alternative to opening ports; it needs a public IPv4 address or working IPv6, so it does not work behind carrier-grade NAT without a workaround.

Security. The router is the one device in your home that is exposed to the internet around the clock, and attackers scan for unpatched models continuously. The features that protect you are unglamorous: automatic firmware updates turned on by default, a maker that publishes how long each model will receive them, WPA3 for the Wi-Fi (with WPA2 fallback for old devices), a separate guest network for visitors and smart-home gadgets so they cannot see your computers, an administration page served over HTTPS that is reachable only from inside the network, and the ability to switch off WPS (whose PIN method is weak) and UPnP (which lets any program on your network open ports to the internet without asking). Change the admin password on day one, and check the port checker afterwards: it shows which ports on your public address answer from the outside, and the right answer for a home is none.