Your router’s blinking lights are trying to tell you something—here’s what they mean


Have you ever wondered what those little blinking lights on your router actually mean? I’ll admit that I haven’t given them much thought until not too long ago. The general rule of thumb is that if they’re all lit up in green, everything’s fine, so what else is there to think about?

But then I got curious, and I ended up in a much deeper rabbit hole than I ever expected to. Let’s dissect the real meaning of the lights on your router.

Your router is already telling you what’s wrong

But you don’t have the decoder ring

Let’s face it, we all ignore our routers (for the most part). You might dive into the settings to optimize your Wi-Fi or fix the occasional dead zone, but other than that, your router is that box that sits there and gives you internet. And that’s good.

Once your router is all set up and the internet works, there’s not much to look at. But on occasion, especially if something’s wrong with your connection, you may notice the little blinking/non-blinking lights that are present on some, but not all, router models.

They’re status indicators, and each one usually corresponds to something specific. Common options include power, internet, Wi-Fi, Ethernet, WPS, USB, or connected device activity. The exact meaning depends on the router, modem, or gateway you have, which makes the whole thing a lot more confusing than it ever needed to be.

In general, though, a solid green light spells good news, but certain routers may have blinking lights, or a white, amber, blue, or red hue on some indicators. Those generally mean that something is connecting, updating, pairing, offline, or just passing traffic like normal.

The Unifi Dream Router 7.

9/10

Brand

Unifi

Range

1,750 square feet

This impressive router is a full-fledged networking beast. It offers fully managed switching, VLANs, a built-in firewall, and Wi-Fi 7.


A blinking light doesn’t mean bad news

Although it technically can …

The Unifi Flex Mini 2.5G Ethernet switch with cables plugged in sitting on a server. Credit: Patrick Campanale / How-To Geek

If we accept that universally decoding every single light on every single router is practically impossible, let’s establish another thing: just because it blinks, it doesn’t mean it’s bad.

In many cases, blinking on a router just means activity. Your Wi-Fi light might blink because devices are actively sending and receiving data, while an Ethernet light might flicker because a device is actively using that wired connection. If everything works and the light’s blinking anyway, that’s just as it should be.

Blinking becomes more concerning if it’s a change from the usual behavior. A light that normally flickers but suddenly turns solid red is worth checking, and the same goes for a power light that keeps blinking during startup or an internet light that never settles, even if you’re not doing anything in particular.


A Wi-Fi router with angled antennas.


Don’t trash your old router: Turn it into a wired workhorse instead

Wi-Fi standards moved on, but your old router can still do something useful

The internet light and the Wi-Fi light are not the same thing

No internet and no Wi-Fi are also not the same problem

Nest Wifi Pro mesh router with the blue system update indicator light. Credit: Jordan Gloor / How-To Geek

It’s also important to note the difference between the Wi-Fi light and the overall internet light. Most modems will have two separate ones, and even if the Wi-Fi is lit up, that still doesn’t mean you actually have an internet connection at all.

A router may still broadcast Wi-Fi just fine while having no actual internet connection behind it. That’s why you might run into a situation where a device shows full bars, but still can’t connect to anything.

The internet light usually points to the connection between your router, modem, gateway, or ISP. The Wi-Fi light, on the other hand, is about the wireless network inside your home. If the Wi-Fi light is on but the internet light is red, off, or stuck blinking in a way it normally isn’t, your wireless network might be fine, but your internet connection is another story.

Some lights deserve more attention than others

These are the patterns I wouldn’t ignore

A network switch with four Ethernet cables connected. Credit: Sydney Louw Butler / How-To Geek

If there’s one light you shouldn’t ignore, it’s actually the power light, especially if it never reaches what you’d expect to see on your router. Most routers will have this light constantly lit up in a normal, ready state, but again, your mileage may vary based on brand and model.

A blinking power light during startup can be totally normal, and some routers will also blink while updating firmware, but if it keeps going for ages or changes color in a way you’re not used to, it’s worth checking the manual or the app (or using good old Google) before doing anything drastic. You definitely don’t want to unplug your router when it’s updating something, so give it some time before doing so.

Red and orange lights are also worth paying attention to, regardless of which feature they’re next to. Again, though, the meaning depends on your model. On some models, red means your router is offline, while orange or yellow might point to a weak mesh connection, a power issue, or problems with Ethernet.


Don’t overthink it, just pay attention

The best thing to do with these lights is to start by learning them. Look at your router at a time when everything’s fine and note the usual state, then check which light stands for what. Those blinking lights can be incredibly useful for surface-level troubleshooting, much like a motherboard POST speaker used to be in PCs.



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link