Printer Security Basics: How to Lock Down a Home or Small Office Printer in 2026

A modern printer is not a peripheral. It is a small networked computer with a web server, storage, an operating system and, in many cases, a permanent connection to a cloud service. It is also frequently the only device on a home or small office network with no password, no updates and no monitoring. Fixing that takes about twenty minutes and closes the gaps that actually matter.

Quick fixes first

1. Print the network configuration page from the printer's control panel and note its IP address.
2. Type that address into a browser to open the printer's embedded web server, and set an administrator password.
3. Check for and install a firmware update.
4. Turn off Wi-Fi Direct, FTP and Telnet if you do not use them.
5. Confirm your router is not forwarding any port to the printer, and that UPnP is not doing it for you.

Why this matters

Three things changed in the last decade. Printers gained full network stacks and web interfaces. They gained persistent storage, so scanned documents, faxes, address books and held print jobs live on the device. And they gained cloud connections, so a printer often has a standing authenticated link out to the manufacturer's servers and, in some setups, to your email account.

Meanwhile, the defaults did not keep up. A large share of consumer printers still ship with a blank administrator password. That means anyone who can reach the printer - a guest on your Wi-Fi, a housemate, a compromised laptop, or a device on a shared building network - can open its settings page, read the address book, change where scans are sent, or push a firmware image.

The more serious exposure is a printer reachable from the internet. That happens when someone forwards a port to it deliberately, or when UPnP opens one automatically. Internet-exposed printers get found by scanning within hours.

Step 1: Set an admin password on the embedded web server

Every network printer has an embedded web server, reached by typing its IP address into a browser. Find the address from the printer's own network report:

• HP: Settings › Reports › Network Configuration Page
• Canon: Setup › Device settings › LAN settings › Print LAN details
• Epson: Settings › General Settings › Network Settings › Network Status › Print Status Sheet
• Brother: Menu › Print Reports › Network Configuration

In the web interface, look under Settings, Security, or Administrator Settings for a password option. Set a genuinely strong one and store it in your password manager - you will need it again for firmware and network changes, and a printer password you cannot remember means a factory reset later.

Some printers also let you restrict the web interface to HTTPS only. Turn that on. Without it, the admin password crosses your network in the clear.

Step 2: Keep firmware current - with one caveat

Printer firmware updates are overwhelmingly bug and security fixes. Most manufacturers now offer automatic updates; enable them in the printer's web interface or app under Firmware, Update or Web Services.

The caveat is cartridge policy. Manufacturers have repeatedly used firmware updates to tighten the checks that decide whether a cartridge chip is genuine, which can stop compatible cartridges you already own from working. HP's cartridge-authentication behaviour has resurfaced through firmware in recent update cycles. If you rely on third-party supplies, read the release notes before updating, and weigh it against the security benefit. Our guide to third-party ink and toner covers the trade-off in detail, and HP ink cartridge problem covers what to do when a cartridge stops being recognised.

Step 3: Switch off what you do not use

In the printer's web interface, find the Network or Protocols section and disable everything you do not actively need:

If you do use Wi-Fi Direct, do not simply leave it on with the printed default password. Change it, and enable the setting that requires you to approve each connection at the panel. See Wi-Fi Direct printing for how to do that without breaking mobile printing.

Step 4: Put the printer in the right place on your network

Two rules cover almost everything:

• Never expose the printer to the internet. Check your router for port forwarding rules and remove any pointing at the printer, especially port 9100, 631, 21 or 23. Turn off UPnP if you can - it creates forwarding rules without asking.
• Keep guests away from it. Use your router's guest network for visitors, tenants and smart devices, and keep the printer and your own computers on the main network. Guest networks isolate clients, which is exactly what you want here.

If your router supports VLANs or a dedicated IoT network, a printer belongs on it - reachable from your computers, isolated from everything else. That is beyond most home setups, but it is the right answer in a small office with a business-grade router.

Step 5: Protect the documents themselves

Network security is only half of it. The other half is paper and stored data.

Secure print release

Most business multifunction devices support holding a job until you enter a PIN at the panel. Enable it in the driver's job-handling or secure print section. It costs nothing and eliminates the most common real-world leak: confidential documents sitting in an output tray in a shared office.

Stored jobs and scan destinations

Check what the printer is retaining. Under Job Storage, Stored Jobs or Document Box, delete anything you do not need and set a retention limit. Review scan-to-email and scan-to-folder destinations too - a stale entry pointing at an old employee's address is a quiet data leak.

Fax lines

If the machine has a phone line connected and you never fax, unplug it. A connected fax line is a path onto the device that bypasses your network controls entirely.

Step 6: Wipe the device before it leaves your hands

This is the step people skip, and it is the one with the clearest consequences. A multifunction printer can hold copies of everything it has scanned, copied or faxed, plus your Wi-Fi password, your email credentials for scan-to-email, and the entire address book.

1. Find the reset option, typically under Settings › Restore Defaults, Reset Settings, or Security › Clear Data.
2. On consumer models, a full factory reset clears network settings, the address book and stored jobs.
3. On business machines with an internal hard drive or SSD, a factory reset is not enough. Look for Secure Erase, Disk Overwrite, Sanitize Storage or similar, and run it - this can take hours, which is normal.
4. Remove any inserted SD card or USB drive.
5. Print a configuration page afterwards to confirm the network settings are gone.

For a leased device being returned, ask the leasing company in writing what their data handling policy is and run the secure erase yourself anyway.

Brand-specific notes

HP

The embedded web server is well-featured on OfficeJet Pro and LaserJet models, with a dedicated Security tab covering the admin password, access control and certificate management. The HP Smart app, now also called the HP app, surfaces firmware updates but not the full security settings - use the web interface for those. See our HP hub.

Canon

PIXMA models have a limited web interface; imageCLASS and imageRUNNER devices have a full Remote UI with user authentication and department ID management. Set the System Manager PIN on any Canon office device.

Epson

Web Config is Epson's interface, with a Product Security section covering the admin password and protocol control. EcoTank models registered with Epson Connect hold a cloud link - unregister the printer if you stop using it, or the link persists after you sell the device.

Brother

Brother's Web Based Management defaults to a login printed on the device or set at first use. Business models support Secure Function Lock, which restricts colour printing, copying and scanning per user - useful in a small office for cost control as well as security.

A realistic 20-minute checklist

1. Admin password set on the embedded web server, stored in a password manager.
2. HTTPS-only enabled if the printer supports it.
3. Firmware updated, automatic updates on unless you depend on third-party cartridges.
4. Telnet, FTP and unused cloud services off.
5. Wi-Fi Direct off, or password changed and approval required.
6. No port forwarding to the printer, UPnP off.
7. Guests on the guest network, printer on the main network.
8. Secure print release enabled if the machine supports it.
9. Scan destinations and stored jobs reviewed.
10. A note in your records of how to wipe it when it eventually goes.

If you are not sure where to start

If your printer's web interface is unfamiliar territory, prioritise ruthlessly: the admin password and keeping the printer off any guest or public network are worth more than everything else combined. Firmware comes next. The rest is refinement.

There is no repair cost question here, but there is a replacement one. If a printer is old enough that the manufacturer no longer issues firmware for it, it will not get security fixes again - and on a business network handling personal data, that is a genuine argument for replacing a working machine. Check the support page for your model's last firmware date before deciding. Our guide to choosing a printer for a home office covers what to look for if you do replace it.

If you would like someone to walk through the printer's security settings with you and confirm nothing is exposed, you can get help from a printer specialist.